186362bae3f7ec5e5c9f988ba0c07ef1b47cca565f5b78a4ca167ece37ebb7e1

Analysis

max time kernel
1s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74f76feb756e5f44d38bd4d94074226b.exe
Size

789KB
MD5

74f76feb756e5f44d38bd4d94074226b
SHA1

cce797f369add6cedd736a084a2a8ee110adcac5
SHA256

186362bae3f7ec5e5c9f988ba0c07ef1b47cca565f5b78a4ca167ece37ebb7e1
SHA512

c6675ac65b4fd4060888feda42b9f29a0a740a959bd9b3bcd532768a3cbfa76f447579e6506a04ba4e760a7104067f044b70a6f038ec4e4b9232e77b256b97e5
SSDEEP

24576:HGi2Gi2Gi2Gi2GiyGivGiNGimGitGimGiIGiFGimGi4GiBGiG:HGi2Gi2Gi2Gi2GiyGivGiNGimGitGimz

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

cute.exe74f76feb756e5f44d38bd4d94074226b.exeTiwi.exeIExplorer.exewinlogon.exeimoet.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	cute.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

cute.exe74f76feb756e5f44d38bd4d94074226b.exeTiwi.exeIExplorer.exewinlogon.exeimoet.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	imoet.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

74f76feb756e5f44d38bd4d94074226b.exeTiwi.exeIExplorer.exewinlogon.exeimoet.execute.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cute.exe

Disables RegEdit via registry modification 6 IoCs

evasion

Processes:

winlogon.exeimoet.execute.exe74f76feb756e5f44d38bd4d94074226b.exeTiwi.exeIExplorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	IExplorer.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 6 IoCs

evasion

Processes:

cute.exe74f76feb756e5f44d38bd4d94074226b.exeTiwi.exeIExplorer.exewinlogon.exeimoet.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Executes dropped EXE 7 IoCs

Processes:

Tiwi.exeIExplorer.exewinlogon.exeimoet.execute.exeTiwi.exeTiwi.exe

pid process

2516 Tiwi.exe
2244 IExplorer.exe
2980 winlogon.exe
1972 imoet.exe
2632 cute.exe
3020 Tiwi.exe
812 Tiwi.exe

pid	process
2516	Tiwi.exe
2244	IExplorer.exe
2980	winlogon.exe
1972	imoet.exe
2632	cute.exe
3020	Tiwi.exe
812	Tiwi.exe

Loads dropped DLL 8 IoCs

Processes:

74f76feb756e5f44d38bd4d94074226b.exe

pid	process
948	74f76feb756e5f44d38bd4d94074226b.exe
948	74f76feb756e5f44d38bd4d94074226b.exe
948	74f76feb756e5f44d38bd4d94074226b.exe
948	74f76feb756e5f44d38bd4d94074226b.exe
948	74f76feb756e5f44d38bd4d94074226b.exe
948	74f76feb756e5f44d38bd4d94074226b.exe
948	74f76feb756e5f44d38bd4d94074226b.exe
948	74f76feb756e5f44d38bd4d94074226b.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

74f76feb756e5f44d38bd4d94074226b.exewinlogon.exeimoet.execute.exeTiwi.exeIExplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

winlogon.exeimoet.exe74f76feb756e5f44d38bd4d94074226b.exeTiwi.exeIExplorer.execute.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	imoet.exe

Modifies WinLogon 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

cute.exeTiwi.exeIExplorer.exewinlogon.exeimoet.exe74f76feb756e5f44d38bd4d94074226b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	imoet.exe

Drops file in System32 directory 16 IoCs

Processes:

Tiwi.exewinlogon.exe74f76feb756e5f44d38bd4d94074226b.exeIExplorer.exe

description	ioc	process
File created	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	winlogon.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	winlogon.exe
File created	C:\Windows\SysWOW64\tiwi.scr	74f76feb756e5f44d38bd4d94074226b.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File created	C:\Windows\SysWOW64\shell.exe	74f76feb756e5f44d38bd4d94074226b.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	74f76feb756e5f44d38bd4d94074226b.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	74f76feb756e5f44d38bd4d94074226b.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	74f76feb756e5f44d38bd4d94074226b.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	74f76feb756e5f44d38bd4d94074226b.exe

Drops file in Windows directory 8 IoCs

Processes:

74f76feb756e5f44d38bd4d94074226b.exeIExplorer.exeTiwi.exewinlogon.exe

description	ioc	process
File created	C:\Windows\tiwi.exe	74f76feb756e5f44d38bd4d94074226b.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	Tiwi.exe
File created	C:\Windows\tiwi.exe	Tiwi.exe
File opened for modification	C:\Windows\tiwi.exe	winlogon.exe
File created	C:\Windows\tiwi.exe	winlogon.exe
File opened for modification	C:\Windows\tiwi.exe	74f76feb756e5f44d38bd4d94074226b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 54 IoCs

evasion

Processes:

74f76feb756e5f44d38bd4d94074226b.exewinlogon.exeimoet.exeTiwi.exeIExplorer.execute.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\s2359 = "Tiwi"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Mouse\	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Mouse\	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Mouse\SwapMouseButtons = "1"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\s2359 = "Tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\s1159 = "Tiwi"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Mouse\SwapMouseButtons = "1"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Mouse\	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\s2359 = "Tiwi"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Mouse\SwapMouseButtons = "1"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\s2359 = "Tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\s1159 = "Tiwi"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\s2359 = "Tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\s1159 = "Tiwi"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Mouse\SwapMouseButtons = "1"	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\s2359 = "Tiwi"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Mouse\	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Mouse\SwapMouseButtons = "1"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\s1159 = "Tiwi"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\s1159 = "Tiwi"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Mouse\SwapMouseButtons = "1"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Mouse\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\s1159 = "Tiwi"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Mouse\	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\	cute.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

Processes:

74f76feb756e5f44d38bd4d94074226b.exeIExplorer.exeimoet.execute.exeTiwi.exewinlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\	Tiwi.exe

Modifies Internet Explorer start page 1 TTPs 6 IoCs

stealer

Modify Registry

T1112

Processes:

imoet.execute.exe74f76feb756e5f44d38bd4d94074226b.exeTiwi.exeIExplorer.exewinlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	winlogon.exe

Modifies registry class 64 IoCs

Processes:

winlogon.exe74f76feb756e5f44d38bd4d94074226b.execute.exeTiwi.exeIExplorer.exeimoet.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	74f76feb756e5f44d38bd4d94074226b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

74f76feb756e5f44d38bd4d94074226b.exe

pid process

948 74f76feb756e5f44d38bd4d94074226b.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

74f76feb756e5f44d38bd4d94074226b.exeTiwi.exeIExplorer.exewinlogon.exeimoet.execute.exeTiwi.exeTiwi.exe

pid process

948 74f76feb756e5f44d38bd4d94074226b.exe
2516 Tiwi.exe
2244 IExplorer.exe
2980 winlogon.exe
1972 imoet.exe
2632 cute.exe
812 Tiwi.exe
3020 Tiwi.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

74f76feb756e5f44d38bd4d94074226b.exeTiwi.exewinlogon.exe

description	pid	process	target process
PID 948 wrote to memory of 2516	948	74f76feb756e5f44d38bd4d94074226b.exe	Tiwi.exe
PID 948 wrote to memory of 2516	948	74f76feb756e5f44d38bd4d94074226b.exe	Tiwi.exe
PID 948 wrote to memory of 2516	948	74f76feb756e5f44d38bd4d94074226b.exe	Tiwi.exe
PID 948 wrote to memory of 2516	948	74f76feb756e5f44d38bd4d94074226b.exe	Tiwi.exe
PID 948 wrote to memory of 2244	948	74f76feb756e5f44d38bd4d94074226b.exe	IExplorer.exe
PID 948 wrote to memory of 2244	948	74f76feb756e5f44d38bd4d94074226b.exe	IExplorer.exe
PID 948 wrote to memory of 2244	948	74f76feb756e5f44d38bd4d94074226b.exe	IExplorer.exe
PID 948 wrote to memory of 2244	948	74f76feb756e5f44d38bd4d94074226b.exe	IExplorer.exe
PID 948 wrote to memory of 2980	948	74f76feb756e5f44d38bd4d94074226b.exe	winlogon.exe
PID 948 wrote to memory of 2980	948	74f76feb756e5f44d38bd4d94074226b.exe	winlogon.exe
PID 948 wrote to memory of 2980	948	74f76feb756e5f44d38bd4d94074226b.exe	winlogon.exe
PID 948 wrote to memory of 2980	948	74f76feb756e5f44d38bd4d94074226b.exe	winlogon.exe
PID 948 wrote to memory of 1972	948	74f76feb756e5f44d38bd4d94074226b.exe	imoet.exe
PID 948 wrote to memory of 1972	948	74f76feb756e5f44d38bd4d94074226b.exe	imoet.exe
PID 948 wrote to memory of 1972	948	74f76feb756e5f44d38bd4d94074226b.exe	imoet.exe
PID 948 wrote to memory of 1972	948	74f76feb756e5f44d38bd4d94074226b.exe	imoet.exe
PID 948 wrote to memory of 2632	948	74f76feb756e5f44d38bd4d94074226b.exe	cute.exe
PID 948 wrote to memory of 2632	948	74f76feb756e5f44d38bd4d94074226b.exe	cute.exe
PID 948 wrote to memory of 2632	948	74f76feb756e5f44d38bd4d94074226b.exe	cute.exe
PID 948 wrote to memory of 2632	948	74f76feb756e5f44d38bd4d94074226b.exe	cute.exe
PID 2516 wrote to memory of 3020	2516	Tiwi.exe	Tiwi.exe
PID 2516 wrote to memory of 3020	2516	Tiwi.exe	Tiwi.exe
PID 2516 wrote to memory of 3020	2516	Tiwi.exe	Tiwi.exe
PID 2516 wrote to memory of 3020	2516	Tiwi.exe	Tiwi.exe
PID 2980 wrote to memory of 812	2980	winlogon.exe	Tiwi.exe
PID 2980 wrote to memory of 812	2980	winlogon.exe	Tiwi.exe
PID 2980 wrote to memory of 812	2980	winlogon.exe	Tiwi.exe
PID 2980 wrote to memory of 812	2980	winlogon.exe	Tiwi.exe

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

Processes:

Tiwi.exeIExplorer.exewinlogon.exeimoet.execute.exe74f76feb756e5f44d38bd4d94074226b.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	74f76feb756e5f44d38bd4d94074226b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	74f76feb756e5f44d38bd4d94074226b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe

C:\Users\Admin\AppData\Local\Temp\74f76feb756e5f44d38bd4d94074226b.exe
"C:\Users\Admin\AppData\Local\Temp\74f76feb756e5f44d38bd4d94074226b.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:948

C:\Windows\Tiwi.exe
C:\Windows\Tiwi.exe
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2516

C:\Windows\Tiwi.exe
C:\Windows\Tiwi.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3020

C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
3⤵
PID:2600

C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
3⤵
PID:2184

C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
3⤵
PID:1764

C:\Windows\SysWOW64\IExplorer.exe
C:\Windows\system32\IExplorer.exe
3⤵
PID:2312

C:\Windows\SysWOW64\IExplorer.exe
C:\Windows\system32\IExplorer.exe
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2244

C:\Windows\Tiwi.exe
C:\Windows\Tiwi.exe
3⤵
PID:2900

C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
3⤵
PID:2640

C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
3⤵
PID:2164

C:\Windows\SysWOW64\IExplorer.exe
C:\Windows\system32\IExplorer.exe
3⤵
PID:472

C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
3⤵
PID:2612

C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2980

C:\Windows\Tiwi.exe
C:\Windows\Tiwi.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:812

C:\Windows\SysWOW64\IExplorer.exe
C:\Windows\system32\IExplorer.exe
3⤵
PID:1472

C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
3⤵
PID:2128

C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
3⤵
PID:2168

C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
3⤵
PID:2740

C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies WinLogon
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2632

C:\Windows\Tiwi.exe
C:\Windows\Tiwi.exe
3⤵
PID:1740

C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
3⤵
PID:2092

C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
3⤵
PID:2592

C:\Windows\SysWOW64\IExplorer.exe
C:\Windows\system32\IExplorer.exe
3⤵
PID:1580

C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
3⤵
PID:2044

C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies WinLogon
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1972

C:\Windows\Tiwi.exe
C:\Windows\Tiwi.exe
3⤵
PID:1688

C:\Windows\SysWOW64\IExplorer.exe
C:\Windows\system32\IExplorer.exe
3⤵
PID:1824

C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
3⤵
PID:2484

C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
3⤵
PID:3000

C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
3⤵
PID:1624

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\cute.exe
Filesize
789KB

MD5
9f348a7317d32662349d8752ac97b520

SHA1
481bb0dc1473bdc5367c4915f6d0833491c62c27

SHA256
ad0915ee29666508a91cd9f6910f98bd1248724a019a4a01c8a4e4de5a000cc3

SHA512
8c4b7f5fd6dc18436f2d5b3bc271a91f4528a8d99949f5cace7e1de4cec559d585de5ca021c05b388060dbf69e053ec93c1fe6db8b2c1c52089a013d75d076c6

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
Filesize
45KB

MD5
4ddbe3b7021de4eee5f50ca8030adcec

SHA1
58ad7badc84a605735a3cbad5da46243f3aef503

SHA256
0ef3776711ad1ff14fc3ca27455d9b38d86f4543ab3dbf7f3b38d6373d5d50ed

SHA512
8eb72b6aec412a86adac6982284e4d66f63b67eb059d3862c697bd974dbf01108b08d7df98d14f644891e42bf933df644bbdd2a1ceb83498699526d6e976a009

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
Filesize
45KB

MD5
20936e975f5d9aaaffce3f82aac3dac9

SHA1
ae066a5ffb06c482ea835953804ef8c64bd52df7

SHA256
57f424f30c7e5a1960815b3671db78c5f66439cc0f366247c80a34ab554265d1

SHA512
60c47a3e24fc7097c0fa650715e8beebcb28c3bcd8beff841f63219861a16578e627dba6f0600a1910395831c8742cc408ac49746dacecb48b6a5ab81aa90f2f

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
Filesize
45KB

MD5
f262eafdd1b7f078764f45c07ac880c8

SHA1
21ef73e997a17bde9da773286836315f4095a482

SHA256
9a93f3edb13fbb8ce1d718797adedf3a715f9d9c0b14e375a8de4bd48f16b156

SHA512
eb697174ac9c5defb17a73320cb5bd5f203377f9679de12fa2870264a4cd1e37d84eb528d6f1e8fbc8e949ee5f299cf1e09c87e2d26c63e2abb2b2b097de0ba6

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe
Filesize
453KB

MD5
34d78487ac7769877cfa1db76e3132d3

SHA1
5bacd005fd2c36d923836640ac96c16693978a6f

SHA256
6755d78b88958537477685fadce0ecf8de2b393c2c3bfaecd60fda8ada98fda1

SHA512
dc583896082954b915723a144be677516ea3ec0d028810fae5a6f9757c49e675c49d532784764571c0c8b9f9f080d337462bc833e08c2ad0ef267118c3e50949

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe
Filesize
507KB

MD5
b06e0b3093682e93e3f57bdbc1eda012

SHA1
af26686bb664d682afd35c06271d97b81c34dba5

SHA256
465ae58ab6c1acb865f219cb53c38e67c308a11ec2f0cb96a0e6de043f9fbb16

SHA512
1f672e9ef6079bc587548a8f26060ec0d9c7b499d4ccfc5928434e56bcac6fc473c3f7180e476338035f29aad04a1b2b3824d62a517b8dcccd316ee6e5c77c8a

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Filesize
576KB

MD5
1de1bafae4ec22236f2fcc93e9b9549e

SHA1
28d87163f5fa5dc70a0fbbc469065086a5a0cbcb

SHA256
d8a852a8a4f1e8ba04c889457eb066f0193659e1e4a77f6e5173276e5029752f

SHA512
e1752f5869d453dc46c3339533829d886fe64dc87f012b887deef252cda75147155f3d40358377b5e5e7910b216370cfea273cc1bef1a8aa66acdd52f1f41135

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Filesize
789KB

MD5
af6c14a844607ee97088d59831e433e5

SHA1
3e08f160f95fc3aca8157a7a4a9fac65316f7fc2

SHA256
39bde54e98f7c071a4781070a0a916a0846cd4963cab3553ab759ce48ccf0ac5

SHA512
78e68060ea041342786c13f2f20848992801a6e161160d70f2283c916f9817e83aa9f1714c8f2b2b10d5cc0f658c07aec03e46195295511f779de30a59e90a18

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Filesize
429KB

MD5
dbb3823e23e0971b49039a2bc1bbd9f8

SHA1
c8c2f58c834c2dedae4ba7d0a0dc5fd37e83dda4

SHA256
64bd0dc04ac49e4109e828fe0a53b5e55f5f2881489e2d50b0901d6ad1b139cc

SHA512
0cc00d215fa73edc232000fc87c0f2634428308ad86b849dc7eccb9e3d937d9464eac9ecf7f9875730c83d0faeba48ec68a4921789fd480a2a871e7d277a6fce

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Filesize
301KB

MD5
2e67dbe60c6128e49a274be8663fee5f

SHA1
7c25a8fbbfe427d58a154361871bb9c6ec79a0d8

SHA256
4538f98c8dbdbab6ea506ac3915223db00877e03e175368ebb958fb2357d2b96

SHA512
9a6ed79dde5c1170cb22cd38693a6c057142c8b7eb80e3024526e147f165ca4480f728b3dad72381d2fd66ce4b70fa55c6e46306a11fd97f3624a7e25befe846

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Filesize
179KB

MD5
35f56bf9687bdbaeb376b806f2157070

SHA1
f5b7ee6cbe344baa56be68b2b2dc7fd80ef29c6a

SHA256
c0aaef60de0aa579d82789ee41f16a8b154a91386e2d5d16940e3f35e6cecd9a

SHA512
5d0c1c304c2b15b200efa1a1e5fac786ac4dc7e32ea1b8d5f9232711a60980caff3f038750e2f1fa83b4af656865e8554b9e223d10d3053fc92770999d29d483

Download Submit
C:\Windows\MSVBVM60.DLL
Filesize
528KB

MD5
7d699438b64ebb893c9fe918ac831dc0

SHA1
44f81de4c91ddffe35c7b654ef06bf2f13d8a315

SHA256
a974e95341bc53d3b83072c91b1fc1483bb2c204e4a1699bdadbf4d5cc5610e0

SHA512
15b7f8ad3546c368eae9ff32b381ddabd1673dd177f0b9651365f53896911306311520e9ef3f17e03d41102491e24b84016c87dfa38b888624ed6261cd4bb1d6

Download Submit
C:\Windows\SysWOW64\IExplorer.exe
Filesize
456KB

MD5
5c90d4c6297a4858c4f5ae0231162e5f

SHA1
f972f82d5a31ab6bfbdda8deb322ec3a79aa58e3

SHA256
aaf43103f49365a8e261e1f12883bc40742726f66101b1204cba69c8b05a0e30

SHA512
55d9df5073d79abdd87ef6de6b302a2cef42a19fccc630ac1d763c6fe223be7966b8744531696a0e44ecfeb552c99967e39297cb0206399d55bc38e33271bca9

Download Submit
C:\Windows\SysWOW64\IExplorer.exe
Filesize
520KB

MD5
8affa31088389a9548c9aafafe07acd4

SHA1
48ab312f283ba5ed05db84ad467d9d7ad1764b52

SHA256
a7426c4c255b359da067925c170a1b62c73cd408cbcb3bfcb6305337d4d50e67

SHA512
b8924fb51f0bd32535bf5bf0a9802c0ae797c31739043fbd33af346260041c28feb025529a9ad15c5f2d4ce1fe6e674b233909feab0ec8f6e7fd3aa54a901722

Download Submit
C:\Windows\SysWOW64\shell.exe
Filesize
789KB

MD5
057ed4358658d35c6a81c0165e671ad3

SHA1
4411e132ee5dd1e0211e3e7c3d3a7f491a51d597

SHA256
94dda9b66f0332e86f6b503bd239f357df0a0f5a0c5580a96ab091f71876ce5a

SHA512
71d81d56ba70f5d2eb06916f71b950b3a13e859336bfbcec6aea16579fef52d7b52bf3b24ceb17db9a35eb61af82d823a5f8e5acd7c5047f5eeb0e43c8176d3d

Download Submit
C:\Windows\SysWOW64\shell.exe
Filesize
305KB

MD5
136f9c9a7ac33163b75e88cc199704d3

SHA1
eabb3c185103c0bd385456cc2243071f8d7b0dfa

SHA256
106c1e7635220dfcad125ef6629290f3583c6483345ed5d03ec310a4bd18ae89

SHA512
02b8a54cf423c95b5f2007fee95bb65517b04035393423d88108069b0a9fd1b82224a8fc579b3afe4887daec944ea47d8bd3c7adc89a05e0099742742dfa2871

Download Submit
C:\Windows\SysWOW64\shell.exe
Filesize
396KB

MD5
637fab7e44d18a57347ac6a5ee851241

SHA1
a2c667f42f7b96f3860f83c671826674e91f9ba9

SHA256
b856ea50c9c04f20e2868c30196ca404df0f2f4c6886340d8cd5e51cc43aacc4

SHA512
f9268d4edf21a94af4bc69a7495211984462964774e44f7e73576a75720706f9dd9c8488bd15424036a6e1d048c054f0a8219377e44428ab2ea1ce98e04fb73e

Download Submit
C:\Windows\SysWOW64\shell.exe
Filesize
208KB

MD5
8d5fb2734f002535a298fc32d1c0bfbe

SHA1
dba849648c2458b405183001b5197c061815b3a6

SHA256
ef9dbe2727c30eb306bab1a2049c7e6ebcac7191b4a4304ac03f52b3a0271d4d

SHA512
a1d8152b96e8d2f061f179ad2573b8980d455a27bb5f4fdadc397797eb1cb356fdfff4698bf04f12ec78e132bc3b19edf7c512a0110af540010d921e12cc52d4

Download Submit
C:\Windows\SysWOW64\shell.exe
Filesize
789KB

MD5
74f76feb756e5f44d38bd4d94074226b

SHA1
cce797f369add6cedd736a084a2a8ee110adcac5

SHA256
186362bae3f7ec5e5c9f988ba0c07ef1b47cca565f5b78a4ca167ece37ebb7e1

SHA512
c6675ac65b4fd4060888feda42b9f29a0a740a959bd9b3bcd532768a3cbfa76f447579e6506a04ba4e760a7104067f044b70a6f038ec4e4b9232e77b256b97e5

Download Submit
C:\Windows\SysWOW64\tiwi.scr
Filesize
567KB

MD5
ed47a4fa945456ae3d20dfeb58100908

SHA1
edef9f1b54e63e9ad36beb1855c4843a65f0b873

SHA256
627711fe6a2fee3f6673a58d5c40ab28da02de519cab153e5990c69ea276c206

SHA512
0420c30d02ecbdbd63e4149aa44fe49e57b3abe3dcd45d09f17e407d2267859a6bee0808664957343e6b0eaccd4a12443fa02ca354a3697efc4934083ee7d3ef

Download Submit
C:\Windows\SysWOW64\tiwi.scr
Filesize
789KB

MD5
da7715ca42a21c69791418f0671c0800

SHA1
bf9a9d3a2be22166a4b0eac58672ef88430c82a2

SHA256
505f08974e28fcec00d47ec43214731860ec6681201c3523510341c708e2ba90

SHA512
6e246004934ab8c433d51ecb7597afb7188f7dda33b64df1b6f7283a690d2dce5bc54e7d3bc47e84f884a3b28e8deb3a1783c1ebe25c1e77831c5efa36f05d07

Download Submit
C:\Windows\SysWOW64\tiwi.scr
Filesize
773KB

MD5
fbc5c1693d4c2063544ae5424054627c

SHA1
efc63f27309425ad3f6a284b299a3107d5caea52

SHA256
d4d22af5d7fa36736bd7a7c84e8537757bbd630e192ae67633bb66033a41872a

SHA512
e49b8cbae183ca09627252d731390568460606fda921c349e0b62725be880eea8f99d075fe6791adeb4246e04030b419be3dc16c197be6669d25ef0a0edab2fd

Download Submit
C:\Windows\SysWOW64\tiwi.scr
Filesize
251KB

MD5
a685c91d552e6b53c64924448d2559bd

SHA1
bb7c14394b387251a04badd01b78f1521391a81e

SHA256
2f936e75cf84b2b8946161e0d10badd7f5e141dacb9652fadfe10371d4bbc335

SHA512
72beee9b9bac8101602bcd250f7cd27b4120118a872b7082708e2b1a4e7a90f5b6a4ffed17f41287717181f65c9a43771c2977b8856d352113cc64b71b48323b

Download Submit
C:\Windows\SysWOW64\tiwi.scr
Filesize
244KB

MD5
f7e594c274d9459254cd32b93c9dbd14

SHA1
ef651268c8822405c12110fafbf30134937bbbda

SHA256
5f16aa4b0036ec3ea0817ebc85e3c2657a17881450d0c36b7647c2e24f714626

SHA512
7b22da90a684c53d240a4ec2d13036fb10c77bbd8af9a984fdd3d1de12cbc0d285608b907e3e892cbb1811f20627ce282bffd8cdb761b9a23ef362fa016c23f0

Download Submit
C:\Windows\tiwi.exe
Filesize
300KB

MD5
b0a9c311f4d61ed772fe1109f3bd3b11

SHA1
9a4751afcfa38e90925a7212d6fa5628c152e2b7

SHA256
15d378c340b85ff401898c886e9877cbc5eed1d0724a32e97b970ee3e1da9649

SHA512
ef5da194586c9af99d5f2aa4c698519f5de6271f9887aad35003bbe5db8c2421002c2ab6a186a131729e786613ecc69c69e9536754660a8dd1abe9e280704562

Download Submit
C:\Windows\tiwi.exe
Filesize
514KB

MD5
a4e962c298e2a30b5a1b29f5051935aa

SHA1
4126a46c6254baae48d745efea375fce18ea3805

SHA256
7f2dc2b53f8e74c726c1ced49fe182506e0104eaa7ba44dde223afc4d6cc2f85

SHA512
6e4d79e6312e89d6e3d03573b2bd3d29ec9cb29aa7bf90d898e34d49e8757928502b23b865e774d7f1f1337a3d215dfd02deb2235f907a416647e92c6f1fe00c

Download Submit
C:\Windows\tiwi.exe
Filesize
789KB

MD5
ddccd00031b05755f987e8a05ecad721

SHA1
eecd380644b6793e97f6133dfc66df9ed288315c

SHA256
f27b164b9effea3a750929ef7bf599dbc3747192d3dbb9998ab49c9aacf04d0f

SHA512
56493d6e71e4e27e06cbd4b323a7df040dc874eea8ec4886126da734d3265b3d359b1dafc53e067bedd7d4c8a32c47f6f3c52d0cc38f5c93b30bf22d106c8926

Download Submit
C:\present.txt
Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\tiwi.exe
Filesize
789KB

MD5
d39f9f3592637147dcf0cd63fe83d65e

SHA1
31224f6b1e87a96a6866fcdea50b91768438ac5c

SHA256
0689b542a91219073c40cd488c69f03b3858a3fff02df50f84749f44c7028e3b

SHA512
82cd7b8047e1c1c525dbabf5427553dd44bef97dc56155ee2a423d9e33473686d8282b0726204681ae701d7b920ba30dc90e37dedcef14b946cd18c6a21ab16d

Download Submit
C:\tiwi.exe
Filesize
513KB

MD5
3c33d149bc17516158e86c72f4c92638

SHA1
025830933053c3c578e8a598f67b63ffb7a1b9ee

SHA256
d3c18c6a559416b2d0f32f18c334c5342cf9c119d89829e913bb21924c74c7fa

SHA512
c4af6a3f88dadd548af84c6a1ff3e6926ff316c92f6389cc186b10617e77edd5bb42b657b0a002e7040ccd45259b4634eb7cd9990da8c70545e10882ae836fc5

Download Submit
C:\tiwi.exe
Filesize
424KB

MD5
c2aac33b4516d795d247377a4c0d2592

SHA1
7861a608122134105700e04334b36fed150356b8

SHA256
947c642ee6ab382c897cce25b4feee3f49e9cd37a94fe9fd47b75eed53a0f9b0

SHA512
93eeec1260910ad3c41cdf62881d2334870b91bbf69c036772e13f539eac49fdcc3f9a6c0012bbba0b9406362e4a45008da9902279e271dd810238880ef796a2

Download Submit
C:\tiwi.exe
Filesize
369KB

MD5
307bfd60df4ac8ef5d16f8075b17fc75

SHA1
185c274ad21135b7d4d609430a7896d4c7dccf84

SHA256
37f6bc0d58774efe5e4fc7e8eddaeb033aa668f563c2acf41bfe9772105887b9

SHA512
07cc476bd241e677337cd317aaa9627d1bda111a0eb680c1039caefe34dd054d686b77f076cd8ed615fe6e67d8158c7b1aac557688aba7b17ca4fc82cb2c3b77

Download Submit
C:\tiwi.exe
Filesize
187KB

MD5
ce8c955baf0492a5f2605387ed72718f

SHA1
da8409a6dfbb8817916b95384d0f758330a2515c

SHA256
66c81d7816766cf33b8c590e4695d0d59433746fe7165cdae9308675fa8d4f0d

SHA512
d456c040d77a5508ebbcf3c5fc98c8efe1ff046057bb0ba0d1dfbda1dacfae86a056fb77dd52d82069576826b255f1362137c892a6b83e568b1d208788b076eb

Download Submit
F:\autorun.inf
Filesize
39B

MD5
415c421ba7ae46e77bdee3a681ecc156

SHA1
b0db5782b7688716d6fc83f7e650ffe1143201b7

SHA256
e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

SHA512
dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe
Filesize
789KB

MD5
6d8d11a15558e37e742c317047ef1cf0

SHA1
f26e0cb8ed956273a116853bc3b28546418ef931

SHA256
32af5d49fc28f4b5f371330782fe766537ec4240b321d7df296934fd2ea9b59c

SHA512
fb283ef601b0453fa58e11c9592b4ed2495b3f935f879d6b72e17ed96f8c7cb8267cd04d8386db3425c111cbbbd0ae369caa8dea4cf5a8336405fe87d741bede

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe
Filesize
789KB

MD5
4aad3e9e84757f1b9600662892083f4c

SHA1
03c74b7cf2b06f738e94303f418f4598dc8dba79

SHA256
58e0cbf266018b3824c034a1efaacc3481d7242a39b2491d05b242513ae8b1ac

SHA512
c8b91874435251a4876528beee5debf0bdc6b293a0e2ca8e4a1d92e4ab175de995788aaf9a6ad9a38ee9772941a6dd458fc6d9950bdd1b98e9c2883321c1c7be

Download Submit
\Windows\SysWOW64\IExplorer.exe
Filesize
789KB

MD5
3215004ede7523fd42ba6a31dbbbc4f3

SHA1
62227c683fc607ccefc6b2da651930c971d44143

SHA256
0db46f733f101d7a89345121d7006e26fcf5202c1d4b573fc90f3c102732e5f7

SHA512
54d2240403b0ef2f9fe4d5e530928b4c1fcb7a062f17618fa05ae5f45f71930624d409544686bebc6b8d0c639ec3be12e4187c86d592a21b32f315ce666c53a6

Download Submit
memory/472-340-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/472-333-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/812-240-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/812-218-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/948-122-0x0000000002430000-0x000000000245B000-memory.dmp

Filesize
172KB

Download
memory/948-101-0x0000000002430000-0x000000000245B000-memory.dmp

Filesize
172KB

Download
memory/948-123-0x0000000002430000-0x000000000245B000-memory.dmp

Filesize
172KB

Download
memory/948-104-0x0000000002430000-0x000000000245B000-memory.dmp

Filesize
172KB

Download
memory/948-149-0x0000000002430000-0x000000000245B000-memory.dmp

Filesize
172KB

Download
memory/948-136-0x0000000002430000-0x000000000245B000-memory.dmp

Filesize
172KB

Download
memory/948-137-0x0000000002430000-0x000000000245B000-memory.dmp

Filesize
172KB

Download
memory/948-100-0x0000000002430000-0x000000000245B000-memory.dmp

Filesize
172KB

Download
memory/948-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/948-145-0x0000000002430000-0x000000000245B000-memory.dmp

Filesize
172KB

Download
memory/948-151-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1472-247-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1472-331-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1580-339-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1624-426-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1624-423-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1688-323-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1688-311-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1740-329-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1764-334-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1764-335-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1972-469-0x0000000001E00000-0x0000000001E2B000-memory.dmp

Filesize
172KB

Download
memory/1972-446-0x0000000001E00000-0x0000000001E2B000-memory.dmp

Filesize
172KB

Download
memory/1972-444-0x0000000001E00000-0x0000000001E2B000-memory.dmp

Filesize
172KB

Download
memory/1972-434-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1972-138-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1972-424-0x0000000001E00000-0x0000000001E2B000-memory.dmp

Filesize
172KB

Download
memory/1972-336-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2044-395-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2092-352-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2128-406-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2128-348-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2164-342-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2164-353-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2168-420-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2184-344-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2184-356-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2244-378-0x0000000002430000-0x000000000245B000-memory.dmp

Filesize
172KB

Download
memory/2244-332-0x0000000002430000-0x000000000245B000-memory.dmp

Filesize
172KB

Download
memory/2244-400-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2244-327-0x0000000002430000-0x000000000245B000-memory.dmp

Filesize
172KB

Download
memory/2244-409-0x0000000002430000-0x000000000245B000-memory.dmp

Filesize
172KB

Download
memory/2244-408-0x0000000002430000-0x000000000245B000-memory.dmp

Filesize
172KB

Download
memory/2244-310-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2244-361-0x0000000002430000-0x000000000245B000-memory.dmp

Filesize
172KB

Download
memory/2244-425-0x0000000002430000-0x000000000245B000-memory.dmp

Filesize
172KB

Download
memory/2244-419-0x0000000002430000-0x000000000245B000-memory.dmp

Filesize
172KB

Download
memory/2312-321-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2484-403-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2516-421-0x0000000002510000-0x000000000253B000-memory.dmp

Filesize
172KB

Download
memory/2516-185-0x0000000002510000-0x000000000253B000-memory.dmp

Filesize
172KB

Download
memory/2516-102-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2516-250-0x0000000002510000-0x000000000253B000-memory.dmp

Filesize
172KB

Download
memory/2516-355-0x0000000002510000-0x000000000253B000-memory.dmp

Filesize
172KB

Download
memory/2516-359-0x0000000002510000-0x000000000253B000-memory.dmp

Filesize
172KB

Download
memory/2516-397-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2516-244-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2592-376-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2600-366-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2612-396-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2632-404-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2632-379-0x0000000000520000-0x000000000054B000-memory.dmp

Filesize
172KB

Download
memory/2632-341-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2632-147-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2632-417-0x0000000000520000-0x000000000054B000-memory.dmp

Filesize
172KB

Download
memory/2632-407-0x0000000000520000-0x000000000054B000-memory.dmp

Filesize
172KB

Download
memory/2632-312-0x0000000000520000-0x000000000054B000-memory.dmp

Filesize
172KB

Download
memory/2640-375-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2740-430-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2740-427-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2900-322-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2980-433-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2980-362-0x00000000004E0000-0x000000000050B000-memory.dmp

Filesize
172KB

Download
memory/2980-125-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2980-243-0x00000000004E0000-0x000000000050B000-memory.dmp

Filesize
172KB

Download
memory/2980-411-0x00000000004E0000-0x000000000050B000-memory.dmp

Filesize
172KB

Download
memory/2980-324-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2980-466-0x00000000004E0000-0x000000000050B000-memory.dmp

Filesize
172KB

Download
memory/2980-412-0x00000000004E0000-0x000000000050B000-memory.dmp

Filesize
172KB

Download
memory/2980-484-0x00000000004E0000-0x000000000050B000-memory.dmp

Filesize
172KB

Download
memory/3000-416-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3020-187-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3020-248-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads