dcrat | 87f220dad3bbeec6f39ed3e74eaa5b63f91924104b238fd33b4c5d49cc88f1ac

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
09eef44272d050d8054cf913ed7bbf48.exe
Size 3.2MB
Sample240310-mxtnnabb81
SHA256 87f220dad3bbeec6f39ed3e74eaa5b63f91924104b238fd33b4c5d49cc88f1ac
MD5 09eef44272d050d8054cf913ed7bbf48
SHA1 b4cd2add18e8445529b107d5ee847b89c70db333
SHA512 867189c8cde505c22c377d4b68665c235e019b7127b3dbfdf4babdf8cd67985753898945d767c99122b3fe348b768e1e11bf3c340feedc0182c4c584a20ecf30
SSDEEP 98304:Cc8eC24luyRsHatJTnXk8AkY9/7x0go6/e6BJ4:9kuyRsHSXk777oq3U
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer persistence rat spyware stealer trojan

Malware Config

Signatures

DcRat 19 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2516	schtasks.exe
		2688	schtasks.exe
		2480	schtasks.exe
		1856	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		09eef44272d050d8054cf913ed7bbf48.exe
		2420	schtasks.exe
		2360	schtasks.exe
		800	schtasks.exe
		1672	schtasks.exe
		2344	schtasks.exe
		1644	schtasks.exe
		2452	schtasks.exe
		1964	schtasks.exe
		2732	schtasks.exe
		1736	schtasks.exe
		2704	schtasks.exe
		1360	schtasks.exe
		768	schtasks.exe
		2648	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\services.exe\""	09eef44272d050d8054cf913ed7bbf48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\services.exe\", \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\explorer.exe\""	09eef44272d050d8054cf913ed7bbf48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\services.exe\", \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\explorer.exe\", \"C:\\Windows\\Branding\\Basebrd\\de-DE\\wininit.exe\""	09eef44272d050d8054cf913ed7bbf48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\services.exe\", \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\explorer.exe\", \"C:\\Windows\\Branding\\Basebrd\\de-DE\\wininit.exe\", \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\dllhost.exe\""	09eef44272d050d8054cf913ed7bbf48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\services.exe\", \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\explorer.exe\", \"C:\\Windows\\Branding\\Basebrd\\de-DE\\wininit.exe\", \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\dllhost.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\spoolsv.exe\""	09eef44272d050d8054cf913ed7bbf48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\services.exe\", \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\explorer.exe\", \"C:\\Windows\\Branding\\Basebrd\\de-DE\\wininit.exe\", \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\dllhost.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\audiodg.exe\""	09eef44272d050d8054cf913ed7bbf48.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2644	schtasks.exe	28

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	09eef44272d050d8054cf913ed7bbf48.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	09eef44272d050d8054cf913ed7bbf48.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	09eef44272d050d8054cf913ed7bbf48.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2904-0-0x0000000000C60000-0x0000000000F8E000-memory.dmp	dcrat
behavioral1/files/0x000600000001471a-41.dat	dcrat
behavioral1/memory/1036-97-0x00000000011B0000-0x00000000014DE000-memory.dmp	dcrat
behavioral1/files/0x000600000001471a-195.dat	dcrat

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\de-DE\acpi.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\en-US\usbport.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\it-IT\tpm.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\it-IT\ULIAGPKX.SYS.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\wfplwf.sys	wininit.exe
File opened for modification	C:\Windows\System32\drivers\fr-FR\battc.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\es-ES\WUDFUsbccidDriver.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\http.sys	wininit.exe
File opened for modification	C:\Windows\System32\drivers\tcpip.sys	wininit.exe
File opened for modification	C:\Windows\System32\drivers\it-IT\usbport.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\fsdepends.sys	wininit.exe
File opened for modification	C:\Windows\System32\drivers\en-US\disk.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\en-US\srv.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\es-ES\pnpmem.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\fr-FR\amdide.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\fr-FR\processr.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\ja-JP\GAGP30KX.SYS.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\en-US\ndiscap.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\es-ES\volmgrx.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\de-DE\partmgr.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\fr-FR\BrParwdm.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\fr-FR\bthenum.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\it-IT\i8042prt.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\it-IT\isapnp.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\de-DE\isapnp.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\fr-FR\fltmgr.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\es-ES\bthenum.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\it-IT\rndismpx.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\fr-FR\WpdMtpDr.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\es-ES\pacer.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\volmgr.sys	wininit.exe
File opened for modification	C:\Windows\System32\drivers\en-US\parport.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\en-US\volmgrx.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\umbus.sys	wininit.exe
File opened for modification	C:\Windows\System32\drivers\de-DE\pnpmem.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\en-US\luafv.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\fr-FR\intelppm.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\it-IT\srv.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\en-US\cdrom.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\es-ES\umbus.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\fr-FR\ndisuio.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\it-IT\BTHUSB.SYS.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\blbdrive.sys	wininit.exe
File opened for modification	C:\Windows\System32\drivers\en-US\amdk8.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\es-ES\serscan.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\ja-JP\srv.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\it-IT\amdide.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\it-IT\atikmdag.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\netio.sys	wininit.exe
File opened for modification	C:\Windows\System32\drivers\RNDISMP.sys	wininit.exe
File opened for modification	C:\Windows\System32\drivers\spsys.sys	wininit.exe
File opened for modification	C:\Windows\System32\drivers\de-DE\ntfs.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\dxgkrnl.sys	wininit.exe
File opened for modification	C:\Windows\System32\drivers\es-ES\bthport.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\ja-JP\BrSerIb.sys.mui	wininit.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\pacer.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\es-ES\battc.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\de-DE\amdk8.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\es-ES\NV_AGP.SYS.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\it-IT\1394ohci.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\hwpolicy.sys	wininit.exe
File opened for modification	C:\Windows\System32\drivers\de-DE\rndismp6.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\fr-FR\MTConfig.sys.mui	wininit.exe
File opened for modification	C:\Windows\System32\drivers\ja-JP\mssmbios.sys.mui	wininit.exe

Manipulates Digital Signatures 4 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wintrust.dll	wininit.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll	wininit.exe
File opened for modification	C:\Windows\System32\wintrust.dll	wininit.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll	wininit.exe

Deletes itself 1 IoCs

pid	Process
1036	wininit.exe

Executes dropped EXE 1 IoCs

pid	Process
1036	wininit.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\explorer.exe\""	09eef44272d050d8054cf913ed7bbf48.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Branding\\Basebrd\\de-DE\\wininit.exe\""	09eef44272d050d8054cf913ed7bbf48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Branding\\Basebrd\\de-DE\\wininit.exe\""	09eef44272d050d8054cf913ed7bbf48.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Internet Explorer\\it-IT\\spoolsv.exe\""	09eef44272d050d8054cf913ed7bbf48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Internet Explorer\\it-IT\\spoolsv.exe\""	09eef44272d050d8054cf913ed7bbf48.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\audiodg.exe\""	09eef44272d050d8054cf913ed7bbf48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\audiodg.exe\""	09eef44272d050d8054cf913ed7bbf48.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\MSOCache\\All Users\\services.exe\""	09eef44272d050d8054cf913ed7bbf48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\MSOCache\\All Users\\services.exe\""	09eef44272d050d8054cf913ed7bbf48.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\explorer.exe\""	09eef44272d050d8054cf913ed7bbf48.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\dllhost.exe\""	09eef44272d050d8054cf913ed7bbf48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\dllhost.exe\""	09eef44272d050d8054cf913ed7bbf48.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	09eef44272d050d8054cf913ed7bbf48.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	09eef44272d050d8054cf913ed7bbf48.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe

Drops desktop.ini file(s) 52 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-us-component_31bf3856ad364e35_6.1.7601.17514_none_b52573ad8e4c2d89\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-characters_31bf3856ad364e35_6.1.7600.16385_none_bde0eaed84920a21\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..ini-systemtoolsuser_31bf3856ad364e35_6.1.7600.16385_none_7ca09f65fd387e58\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..soundthemes-savanna_31bf3856ad364e35_6.1.7600.16385_none_8501e89d0b011992\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-garden_31bf3856ad364e35_6.1.7600.16385_none_f7a4bf1e15863e21\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_6.1.7600.16385_none_73076dd9cf3a9dce\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-shell-soundthemes-raga_31bf3856ad364e35_6.1.7600.16385_none_2fe300bf8e73cdbd\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-scenes_31bf3856ad364e35_6.1.7600.16385_none_a4393b1a254aeaee\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ehome-samplemedia_31bf3856ad364e35_6.1.7600.16385_none_b6b9b223710b3802\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-ca-component_31bf3856ad364e35_6.1.7601.17514_none_fae061a2e0ae5019\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-za-component_31bf3856ad364e35_6.1.7601.17514_none_a5926b147a413e6a\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..ini-accessoriesuser_31bf3856ad364e35_6.1.7600.16385_none_7ff91f5d2dd6c770\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..undthemes-landscape_31bf3856ad364e35_6.1.7600.16385_none_7a83a914edc3de49\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-fontext_31bf3856ad364e35_6.1.7601.17514_none_fcab9df20a3cd55f\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-musicsamples_31bf3856ad364e35_6.1.7600.16385_none_06495209cbd8e93b\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_6.1.7600.16385_none_36604ea896f9a97d\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..undthemes-afternoon_31bf3856ad364e35_6.1.7600.16385_none_2a05e57d5ab3659e\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ehome-reg-inf_31bf3856ad364e35_6.1.7601.17514_none_535245f3d98ecb9a\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ie-offlinefavorites_31bf3856ad364e35_11.2.9600.16428_none_4382f60666c7c23b\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..-us-links-component_31bf3856ad364e35_6.1.7601.17514_none_b325aa489d61d3a5\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_6.1.7600.16385_none_bf396ba9226e0702\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..oundthemes-heritage_31bf3856ad364e35_6.1.7600.16385_none_5872c0830d0c4747\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ringtonesamples_31bf3856ad364e35_6.1.7600.16385_none_135e536ebbe59c28\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-landscapes_31bf3856ad364e35_6.1.7600.16385_none_e57abb2f66db71a9\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-videosamples_31bf3856ad364e35_6.1.7600.16385_none_51a21f033003affd\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ie-offlinefavorites_31bf3856ad364e35_8.0.7601.17514_none_da0c2f9edf5b1353\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_6.1.7600.16385_none_480c0d8bd31ae43f\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..l-soundthemes-delta_31bf3856ad364e35_6.1.7600.16385_none_fbf7e0678b64a4b8\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..undthemes-cityscape_31bf3856ad364e35_6.1.7600.16385_none_5b48f43248490503\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.2.9600.16428_none_197d7b3a29314757\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-sonata_31bf3856ad364e35_6.1.7600.16385_none_201752c112c5078c\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..ndthemes-characters_31bf3856ad364e35_6.1.7600.16385_none_08da32b0fdad9220\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..sktopini-sendtouser_31bf3856ad364e35_6.1.7600.16385_none_64398328adc9c59d\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..ini-maintenanceuser_31bf3856ad364e35_6.1.7600.16385_none_61fc91b36f901b87\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gameexplorer_31bf3856ad364e35_6.1.7601.17514_none_a026547dd7dc8bbc\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..-gb-links-component_31bf3856ad364e35_6.1.7601.17514_none_0ea01e97df141032\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_8.0.7600.16385_none_add5a10aa4d614d5\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-au-component_31bf3856ad364e35_6.1.7601.17514_none_36a5754e72dd8aff\desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..ktopini-maintenance_31bf3856ad364e35_6.1.7600.16385_none_ba8f25a3b6d81a68\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..ktopini-systemtools_31bf3856ad364e35_6.1.7600.16385_none_da623240a154f357\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-nature_31bf3856ad364e35_6.1.7600.16385_none_d5909570704a09c0\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-quirky_31bf3856ad364e35_6.1.7600.16385_none_e55404efe49bb9cb\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..dthemes-calligraphy_31bf3856ad364e35_6.1.7600.16385_none_c1407bc73caf8dfc\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..oundthemes-festival_31bf3856ad364e35_6.1.7600.16385_none_121f20b55f0bde68\Desktop.ini	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_subsystem-for-unix-based-applications_31bf3856ad364e35_6.1.7601.17514_none_d20e5d35068f261a\Desktop.ini	wininit.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ipinfo.io
6	ipinfo.io

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf	wininit.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-s..ccessagent-binaries_31bf3856ad364e35_6.1.7600.16385_none_de06b4fbd5b45f78\autorun.inf	wininit.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ja-JP\xmlfilter.dll.mui	wininit.exe
File opened for modification	C:\Windows\SysWOW64\spp\tokens\ppdlic\GroupPolicy-License-ppdlic.xrm-ms	wininit.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj4680t.exp	wininit.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnrc006.inf_amd64_neutral_7e12a60cc98d3f89\Amd64\RIA400B6.GPD	wininit.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wiaca00c.inf_amd64_neutral_27f4ad26fea72eb1\CNHL210.DLL	wininit.exe
File opened for modification	C:\Windows\System32\es-ES\atl.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\fr-FR\UIAutomationCore.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\wbem\es-ES\mof.xsl	wininit.exe
File opened for modification	C:\Windows\System32\wbem\fr-FR\interop.mfl	wininit.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\at.exe.mui	wininit.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prngt004.inf_amd64_neutral_f5bf8a7ba9dfff55\Amd64\GS3172E3.PPD	wininit.exe
File opened for modification	C:\Windows\System32\es-ES\diskmgmt.msc	wininit.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\mprmsg.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\tintlgnt.ime	wininit.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\prnep00l.PNF	wininit.exe
File opened for modification	C:\Windows\System32\es-ES\ntlanui2.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\migration\modemmigplugin.dll	wininit.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_Throw.help.txt	wininit.exe
File opened for modification	C:\Windows\System32\atmlib.dll	wininit.exe
File opened for modification	C:\Windows\System32\vga.dll	wininit.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\rdvgwddm.inf_amd64_neutral_dd691eae66f3032d\rdvgkmd.sys	wininit.exe
File opened for modification	C:\Windows\SysWOW64\zh-TW\cdosys.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\da-DK\FntCache.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\de-DE\drprov.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\en-US\fthsvc.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\fr-FR\timedate.cpl.mui	wininit.exe
File opened for modification	C:\Windows\SysWOW64\wimserv.exe	wininit.exe
File opened for modification	C:\Windows\System32\apss.dll	wininit.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wdmvsc.inf_amd64_neutral_a2cf745000e2ea92\wdmvsc.inf	wininit.exe
File opened for modification	C:\Windows\System32\en-US\PeerDistSvc.dll.mui	wininit.exe
File opened for modification	C:\Windows\SysWOW64\wbem\nci.mof	wininit.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\hid.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\de-DE\rpcping.exe.mui	wininit.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ph6xib64c0.inf_amd64_neutral_a43df8f7441e1c61\ph6xib64c0.PNF	wininit.exe
File opened for modification	C:\Windows\System32\en-US\thumbcache.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\en-US\Licenses\_Default\Ultimate\license.rtf	wininit.exe
File opened for modification	C:\Windows\System32\spp\tokens\ppdlic\Shell-MultiplayerInboxGames-Common-ppdlic.xrm-ms	wininit.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\provsvc.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\ja-JP\sechost.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\ja-JP\SmartcardCredentialProvider.dll.mui	wininit.exe
File opened for modification	C:\Windows\SysWOW64\msvcp60.dll	wininit.exe
File opened for modification	C:\Windows\SysWOW64\en-US\pdhui.dll.mui	wininit.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\oleaccrc.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\expand.exe	wininit.exe
File opened for modification	C:\Windows\System32\fr-FR\els.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\wbem\wbemcore.dll	wininit.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\AdmTmpl.dll.mui	wininit.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\dot3api.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\en-US\csrss.exe.mui	wininit.exe
File opened for modification	C:\Windows\System32\es-ES\objsel.dll.mui	wininit.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\wiascanprofiles.dll.mui	wininit.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml	wininit.exe
File opened for modification	C:\Windows\System32\zh-HK\d2d1.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\IdListen.dll	wininit.exe
File opened for modification	C:\Windows\System32\de-DE\elscore.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\hidbth.inf_loc	wininit.exe
File opened for modification	C:\Windows\System32\ja-JP\spwizui.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\migwiz\dlmanifests\MigrationDisplayGroups-DL.man	wininit.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnok002.inf_amd64_neutral_616c1e9b7df7d5a9\Amd64\OK8800U5.PPD	wininit.exe
File opened for modification	C:\Windows\System32\it-IT\TCPMON.dll.mui	wininit.exe
File opened for modification	C:\Windows\System32\wbem\es-ES\interop.mfl	wininit.exe
File opened for modification	C:\Windows\SysWOW64\gptext.dll	wininit.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mtconfig.inf_amd64_neutral_4de24f49b5e60c45\mtconfig.inf	wininit.exe
File opened for modification	C:\Windows\System32\es-ES\wlanpref.dll.mui	wininit.exe

Modifies termsrv.dll 1 TTPs 1 IoCs

Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol

T1021.001

description	ioc	Process
File opened for modification	C:\Windows\System32\termsrv.dll	wininit.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\4.png	wininit.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll	wininit.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll	wininit.exe
File opened for modification	C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui	wininit.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\highDpiImageSwap.js	wininit.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html	wininit.exe
File opened for modification	C:\Program Files\Windows Journal\ja-JP\NBMapTIP.dll.mui	wininit.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\settings.html	wininit.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll	wininit.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\System.ServiceModel.Resources.dll	wininit.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	wininit.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\square_m.png	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\settings.js	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\settings.html	wininit.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF	wininit.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\MpAsDesc.dll.mui	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\setup_wm.exe.mui	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\calendar.js	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\gadget.xml	wininit.exe
File opened for modification	C:\Program Files\Common Files\System\wab32res.dll	wininit.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui	wininit.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\logo.png	wininit.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\es-ES\msaddsr.dll.mui	wininit.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_s.png	wininit.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\glow.png	wininit.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\en-US\F12Tools.dll.mui	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_up.png	wininit.exe
File opened for modification	C:\Program Files\Windows Media Player\it-IT\wmpnscfg.exe.mui	wininit.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_thunderstorm.png	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\es-ES\mpvis.dll.mui	wininit.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\calendar.css	wininit.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\slideShow.css	wininit.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt	wininit.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui	wininit.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll	wininit.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msadomd28.tlb	wininit.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll	wininit.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll	wininit.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\settings.js	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_over.png	wininit.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml	wininit.exe
File opened for modification	C:\Program Files\Windows Journal\fr-FR\JNTFiltr.dll.mui	wininit.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui	wininit.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\DMR_48.png	wininit.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\ehshellLogo.png	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_pressed.png	wininit.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui	wininit.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui	wininit.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\it-IT\WMPDMCCore.dll.mui	wininit.exe
File opened for modification	C:\Program Files\Windows Journal\en-US\NBMapTIP.dll.mui	wininit.exe
File opened for modification	C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui	wininit.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iedvtool.dll	wininit.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty.png	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_down.png	wininit.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml	wininit.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png	wininit.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	wininit.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winsxs\Catalogs\2f0a2db4688d13c79a6b8fd83dd09f5e315202734a977ca6e0ace75180493050.cat	wininit.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-n..xcorecomp.resources_31bf3856ad364e35_6.1.7601.17514_es-es_6bc8c2f4dd77ad5d\vbc7ui.dll	wininit.exe
File opened for modification	C:\Windows\PLA\Reports\fr-FR\Report.System.Summary.xml	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-winocr-ocrengines_31bf3856ad364e35_6.1.7600.16385_none_ff3a08834cc21b39\twrece.dll	wininit.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_698ac5bc9a8c1572_rasauto.dll.mui_12fa2c50	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\amd64_microsoft-windows-p..rolspanel.resources_31bf3856ad364e35_6.1.7600.16385_it-it_53ca68d49dc78692.manifest	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\wow64_netfx35-cdf_31bf3856ad364e35_6.1.7601.17514_none_c2558ed487674936.manifest	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_wiaca00d.inf_31bf3856ad364e35_6.1.7600.16385_none_9b51e5b3b1f90953\CNFRA0.ICC	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\wow64_microsoft-windows-uianimation.resources_31bf3856ad364e35_7.1.7601.16492_en-us_311af095b15b9836.manifest	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\x86_microsoft-windows-snmp-winsnmp-api_31bf3856ad364e35_6.1.7601.17514_none_e254e6fd20e48b79.manifest	wininit.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Filters\soniccolorconverter.ax	wininit.exe
File opened for modification	C:\Windows\PolicyDefinitions\fr-FR\sdiagschd.adml	wininit.exe
File opened for modification	C:\Windows\Help\Windows\it-IT\netvsta.h1s	wininit.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-wow64.resources_31bf3856ad364e35_6.1.7600.16385_it-it_70bb692c4654ddb5\setup16.exe.mui	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\amd64_microsoft-windows-l..terprisen.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_064ef2a4b72f72b1.manifest	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\msil_mscorlib.resources_b77a5c561934e089_6.1.7600.16385_es-es_66b4f1d2756f92ed.manifest	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-isoburn.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_5bb3643f0c3357bc\isoburn.exe.mui	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\amd64_win7-microsoft-wind..oyment-languagepack_31bf3856ad364e35_7.1.7601.16492_ko-kr_40a034a05d78fe79.manifest	wininit.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_type_operators.help.txt	wininit.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-n..xcorecomp.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_0e8038f3d049c3bf\System.Design.Resources.dll	wininit.exe
File opened for modification	C:\Windows\diagnostics\system\WindowsMediaPlayerMediaLibrary\en-US\CL_LocalizationData.psd1	wininit.exe
File opened for modification	C:\Windows\winsxs\FileMaps\$$_diagnostics_system_performance_d48bf95b5c828123.cdf-ms	wininit.exe
File opened for modification	C:\Windows\servicing\Packages\Win8IP-Microsoft-Windows-DownlevelApisets-Windows-WinIP-Package~31bf3856ad364e35~amd64~en-US~7.1.7601.16492.cat	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_cpu.inf_31bf3856ad364e35_6.1.7600.16385_none_b93f4c460912265a\processr.sys	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-msieftp.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9d13c71944888fe5\msieftp.dll.mui	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_server-help-chm.rsop.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f2be05771884bd72\rsop.CHM	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\amd64_microsoft-windows-wpfcorecomp.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_3f0a45b66435bdc5.manifest	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\amd64_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7601.17514_none_a0cf62efee3228a3.manifest	wininit.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_6079f415110c0210_protocol_e16769d2	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\msil_ehiupnp_31bf3856ad364e35_6.1.7600.16385_none_8adffc21a4ac51fe.manifest	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\msil_smsvchost.resources_b03f5f7f11d50a3a_6.1.7600.16385_en-us_c9a8fb43c97ca5db.manifest	wininit.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-openfiles.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7929ff44da9dae75\openfiles.exe.mui	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..utilities.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_83f81bfd004e80b6\attrib.exe.mui	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-n..xcorecomp.resources_31bf3856ad364e35_6.1.7601.17514_es-es_617418a2a916eb62\wizardFinish.ascx.es.resx	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_wnetvsc.inf_31bf3856ad364e35_6.1.7601.17514_none_b5443138e61b56e0\wnetvsc.inf	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\wow64_microsoft-windows-b..smcnative.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_3e05bdf0fe58f40a.manifest	wininit.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-x..lugin-mui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f828566d189f067e\xwtpw32.dll.mui	wininit.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-c..vider-dll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_01d05823a99ac86b_certcredprovider.dll.mui_b5ad161e	wininit.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_hr-hr_40dc0024304153a4\comctl32.dll.mui	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\403-18.htm	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..-taskhost.resources_31bf3856ad364e35_6.1.7600.16385_de-de_af30b86a262710bb\taskhost.exe.mui	wininit.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-webservices_31bf3856ad364e35_6.1.7601.17514_none_6ca25da84551ca13.manifest	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_es-es_be8a1256afbafd72.manifest	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_e89908d79afacf17.manifest	wininit.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-dataclen.resources_31bf3856ad364e35_6.1.7600.16385_de-de_142d3e4e8f7ea4a1\dataclen.dll.mui	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..iadisc-style-travel_31bf3856ad364e35_6.1.7600.16385_none_f2a7c66510a5395d\content-background.png	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_prngt004.inf_31bf3856ad364e35_6.1.7600.16385_none_a0b67189fe7a0ea1\Amd64\GS1432E3.PPD	wininit.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-ie-ratings_31bf3856ad364e35_8.0.7601.17514_none_e453ef7731ff4c4f\ticrf.rat	wininit.exe
File opened for modification	C:\Windows\servicing\Packages\Win8IP-Microsoft-Windows-DownlevelApisets-Base-WinIP-Package~31bf3856ad364e35~amd64~lv-LV~7.1.7601.16492.mum	wininit.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-t..services-publicapis_31bf3856ad364e35_6.1.7600.16385_none_2325dd04e00642c2_wtsapi32.dll_470d4d41	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\amd64_microsoft-windows-s..rtup-core.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b11647bd474cce12.manifest	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..ntconsole.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1a32eaa5fc9b4450\iis.msc	wininit.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-profsvc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f1814dbfdb6aeac1\profsvc.dll.mui	wininit.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-kernelbase.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d3dd093ad06026e1_kernelbase.dll.mui_16288a65	wininit.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-m..eplacementmanifests_31bf3856ad364e35_6.1.7601.17514_none_fdfbc5f949b9a49e\shmig-replacement.man	wininit.exe
File opened for modification	C:\Windows\en-US\winhlp32.exe.mui	wininit.exe
File opened for modification	C:\Windows\Speech\Engines\SR\en-GB\l2057.ngr	wininit.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_et-ee_b849dde6b3c0da01_comctl32.dll.mui_0da4e682	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\amd64_microsoft-windows-help-artuimedia_31bf3856ad364e35_6.1.7600.16385_none_42f1b1550d772524.manifest	wininit.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-d..gement-winproviders_31bf3856ad364e35_6.1.7601.17514_none_b9552383032e38d6\CbsProvider.dll	wininit.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-d..rectplay4.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_1f6725588fa7ac8e\dpmodemx.dll.mui	wininit.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\amd64_microsoft-windows-h..-blutooth.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_900dd83f133ea4ca.manifest	wininit.exe
File opened for modification	C:\Windows\winsxs\Manifests\amd64_microsoft-windows-s..tools-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_122baf121ffbd283.manifest	wininit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2516	schtasks.exe
2420	schtasks.exe
1644	schtasks.exe
2704	schtasks.exe
1856	schtasks.exe
768	schtasks.exe
2648	schtasks.exe
2480	schtasks.exe
1964	schtasks.exe
1360	schtasks.exe
2688	schtasks.exe
1736	schtasks.exe
1672	schtasks.exe
2344	schtasks.exe
800	schtasks.exe
2732	schtasks.exe
2360	schtasks.exe
2452	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	wininit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	wininit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2904	09eef44272d050d8054cf913ed7bbf48.exe
2904	09eef44272d050d8054cf913ed7bbf48.exe
2904	09eef44272d050d8054cf913ed7bbf48.exe
2904	09eef44272d050d8054cf913ed7bbf48.exe
2904	09eef44272d050d8054cf913ed7bbf48.exe
2904	09eef44272d050d8054cf913ed7bbf48.exe
2904	09eef44272d050d8054cf913ed7bbf48.exe
2904	09eef44272d050d8054cf913ed7bbf48.exe
2904	09eef44272d050d8054cf913ed7bbf48.exe
2904	09eef44272d050d8054cf913ed7bbf48.exe
2904	09eef44272d050d8054cf913ed7bbf48.exe
1808	powershell.exe
1580	powershell.exe
1212	powershell.exe
1960	powershell.exe
840	powershell.exe
1780	powershell.exe
1824	powershell.exe
2348	powershell.exe
2372	powershell.exe
1448	powershell.exe
2852	powershell.exe
2364	powershell.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe
1036	wininit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1036	wininit.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	09eef44272d050d8054cf913ed7bbf48.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	1036	wininit.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeBackupPrivilege	1864	vssvc.exe
Token: SeRestorePrivilege	1864	vssvc.exe
Token: SeAuditPrivilege	1864	vssvc.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 1824	2904	09eef44272d050d8054cf913ed7bbf48.exe	47
PID 2904 wrote to memory of 1824	2904	09eef44272d050d8054cf913ed7bbf48.exe	47
PID 2904 wrote to memory of 1824	2904	09eef44272d050d8054cf913ed7bbf48.exe	47
PID 2904 wrote to memory of 1808	2904	09eef44272d050d8054cf913ed7bbf48.exe	48
PID 2904 wrote to memory of 1808	2904	09eef44272d050d8054cf913ed7bbf48.exe	48
PID 2904 wrote to memory of 1808	2904	09eef44272d050d8054cf913ed7bbf48.exe	48
PID 2904 wrote to memory of 2348	2904	09eef44272d050d8054cf913ed7bbf48.exe	49
PID 2904 wrote to memory of 2348	2904	09eef44272d050d8054cf913ed7bbf48.exe	49
PID 2904 wrote to memory of 2348	2904	09eef44272d050d8054cf913ed7bbf48.exe	49
PID 2904 wrote to memory of 1960	2904	09eef44272d050d8054cf913ed7bbf48.exe	50
PID 2904 wrote to memory of 1960	2904	09eef44272d050d8054cf913ed7bbf48.exe	50
PID 2904 wrote to memory of 1960	2904	09eef44272d050d8054cf913ed7bbf48.exe	50
PID 2904 wrote to memory of 2372	2904	09eef44272d050d8054cf913ed7bbf48.exe	51
PID 2904 wrote to memory of 2372	2904	09eef44272d050d8054cf913ed7bbf48.exe	51
PID 2904 wrote to memory of 2372	2904	09eef44272d050d8054cf913ed7bbf48.exe	51
PID 2904 wrote to memory of 2364	2904	09eef44272d050d8054cf913ed7bbf48.exe	52
PID 2904 wrote to memory of 2364	2904	09eef44272d050d8054cf913ed7bbf48.exe	52
PID 2904 wrote to memory of 2364	2904	09eef44272d050d8054cf913ed7bbf48.exe	52
PID 2904 wrote to memory of 2852	2904	09eef44272d050d8054cf913ed7bbf48.exe	53
PID 2904 wrote to memory of 2852	2904	09eef44272d050d8054cf913ed7bbf48.exe	53
PID 2904 wrote to memory of 2852	2904	09eef44272d050d8054cf913ed7bbf48.exe	53
PID 2904 wrote to memory of 1212	2904	09eef44272d050d8054cf913ed7bbf48.exe	54
PID 2904 wrote to memory of 1212	2904	09eef44272d050d8054cf913ed7bbf48.exe	54
PID 2904 wrote to memory of 1212	2904	09eef44272d050d8054cf913ed7bbf48.exe	54
PID 2904 wrote to memory of 1580	2904	09eef44272d050d8054cf913ed7bbf48.exe	56
PID 2904 wrote to memory of 1580	2904	09eef44272d050d8054cf913ed7bbf48.exe	56
PID 2904 wrote to memory of 1580	2904	09eef44272d050d8054cf913ed7bbf48.exe	56
PID 2904 wrote to memory of 840	2904	09eef44272d050d8054cf913ed7bbf48.exe	58
PID 2904 wrote to memory of 840	2904	09eef44272d050d8054cf913ed7bbf48.exe	58
PID 2904 wrote to memory of 840	2904	09eef44272d050d8054cf913ed7bbf48.exe	58
PID 2904 wrote to memory of 1448	2904	09eef44272d050d8054cf913ed7bbf48.exe	59
PID 2904 wrote to memory of 1448	2904	09eef44272d050d8054cf913ed7bbf48.exe	59
PID 2904 wrote to memory of 1448	2904	09eef44272d050d8054cf913ed7bbf48.exe	59
PID 2904 wrote to memory of 1780	2904	09eef44272d050d8054cf913ed7bbf48.exe	60
PID 2904 wrote to memory of 1780	2904	09eef44272d050d8054cf913ed7bbf48.exe	60
PID 2904 wrote to memory of 1780	2904	09eef44272d050d8054cf913ed7bbf48.exe	60
PID 2904 wrote to memory of 1036	2904	09eef44272d050d8054cf913ed7bbf48.exe	71
PID 2904 wrote to memory of 1036	2904	09eef44272d050d8054cf913ed7bbf48.exe	71
PID 2904 wrote to memory of 1036	2904	09eef44272d050d8054cf913ed7bbf48.exe	71
PID 1036 wrote to memory of 480	1036	wininit.exe	72
PID 1036 wrote to memory of 480	1036	wininit.exe	72
PID 1036 wrote to memory of 480	1036	wininit.exe	72
PID 1036 wrote to memory of 1100	1036	wininit.exe	73
PID 1036 wrote to memory of 1100	1036	wininit.exe	73
PID 1036 wrote to memory of 1100	1036	wininit.exe	73

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	09eef44272d050d8054cf913ed7bbf48.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	09eef44272d050d8054cf913ed7bbf48.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	09eef44272d050d8054cf913ed7bbf48.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\09eef44272d050d8054cf913ed7bbf48.exe
"C:\Users\Admin\AppData\Local\Temp\09eef44272d050d8054cf913ed7bbf48.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1780
- C:\Windows\Branding\Basebrd\de-DE\wininit.exe
  "C:\Windows\Branding\Basebrd\de-DE\wininit.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Manipulates Digital Signatures
  - Deletes itself
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops desktop.ini file(s)
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Modifies termsrv.dll
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1036
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd70d56d-3845-40f8-98d5-212591122b20.vbs"
    3⤵
    PID:480
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ab9b9eac-2c0d-4cb2-af8e-4ccef1e4bd11.vbs"
    3⤵
    PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\Branding\Basebrd\de-DE\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Branding\Basebrd\de-DE\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\Branding\Basebrd\de-DE\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\it-IT\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2648

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1864

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

c5b4cb5e9653cc

Path C:\MSOCache\All Users\c5b4cb5e9653cc
Size 639B
SHA256 e712023a3a4a9b45a013c1dbd82f49c9c2c896d06480063287781ffe8d113e90
MD5 966707b9eb5a6273cf1c52581ff24dbe
SHA1 37c198ebc4ce550c67de083b3b1c29ab0b637e1c
SHA512 d740fad0374e80f7a461a2597ddfe1b1c45d7e2fe9a2c9a9844e9ca6aad0ca6af40b3399d2e1ad46fdba509aa93b65020af94f8104c48feec95637c6be1cb478
MD5 SHA1 SHA512

Submit Download

42af1c969fbb7b

Path C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\42af1c969fbb7b
Size 570B
SHA256 c4d7962a04d7f81a5517bf845847bd2d9eee31b169ed376f4b225340400b9781
MD5 b8ef8e0067e39f42d1cf63a1babe1686
SHA1 3d633333f523a5d55997263deae12025a4906dbb
SHA512 86edc57a08a05e4bd487266d7dcf9951f92241773aab2e406cff114f277896ffd739daf4f39510c8420662cc19cea77bc8a5e3a339fb5c5aa79902096427d1b5
MD5 SHA1 SHA512

Submit Download

f3b6ecef712a24

Path C:\Program Files\Internet Explorer\it-IT\f3b6ecef712a24
Size 711B
SHA256 9d848d569d7ad8e67c30fdd17b5e2e21fcd709de68c2f3878a66d988b212db8b
MD5 02e7edf4f2e3de201de5815463b05c0a
SHA1 9611ef1499ae30f515b22b57a04e73370fca5ca0
SHA512 923fc1839d6da9ecff6f2d9834a5a55a0ad19b1e2a15ac425f78c09f9479b7a83ed6ec1acd6ddef4236f6db06dfee2cd311751d49aabc359c002e5c67f07d1eb
MD5 SHA1 SHA512

Submit Download

spoolsv.exe

Path C:\Program Files\Internet Explorer\it-IT\spoolsv.exe
Size 671KB
SHA256 fc35e6d76d59bdb8aac7a97c6a23f6615c7176f145e15815371a277d63b59f74
MD5 5e454ff67c52593eabba01f1c203b112
SHA1 f8eb82a5249f59b7b1e4edbff37db23687c8b423
SHA512 1bbf412f1e71c205c888424907d48665526edc14ca2ff230080bd2cda6a59b4ae2ad819584be105e5ad5c27e2b5df7cffe5dfa96fed8f53cc64aa5d161375891
SSDEEP 12288:Fmc3m3Nfv21zz0MPE+XpVB7gBuJew8Srj9JTor7N7KcqzFch:U3gHHPExc8Srj/0r7BKcqz4
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Program Files\Internet Explorer\it-IT\spoolsv.exe
Size 3.2MB
SHA256 87f220dad3bbeec6f39ed3e74eaa5b63f91924104b238fd33b4c5d49cc88f1ac
MD5 09eef44272d050d8054cf913ed7bbf48
SHA1 b4cd2add18e8445529b107d5ee847b89c70db333
SHA512 867189c8cde505c22c377d4b68665c235e019b7127b3dbfdf4babdf8cd67985753898945d767c99122b3fe348b768e1e11bf3c340feedc0182c4c584a20ecf30
SSDEEP 98304:Cc8eC24luyRsHatJTnXk8AkY9/7x0go6/e6BJ4:9kuyRsHSXk777oq3U
MD5 SHA1 SHA512 SSDEEP

Submit Download

5940a34987c991

Path C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\5940a34987c991
Size 372B
SHA256 bfe41c76b18ed9cfb974e29ffdaa9fdc9ee185172ef301482f660fe91fa4e878
MD5 6aef6cb23cdfdbc342747681e80966b0
SHA1 bf02e4bc1b818826d8dead86dc94d34b3e91f94d
SHA512 7b81b39fda24e3eb3a4127f43750dceefd33b2aaecc9b84547e28333eaa324594b127e00a954f0c73a59b0343a6a954b9886ce7408db974170d832ccd1821fc8
MD5 SHA1 SHA512

Submit Download

7a0fd90576e088

Path C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\7a0fd90576e088
Size 397B
SHA256 c9bffcb32d8786bf187e0b0b03eafaa03607ec5df111635e4b4100a28fddf34d
MD5 421c13779908100c6458b0bb99ddef8c
SHA1 cb283813fe68c72abc993e20b110bf191052109c
SHA512 6da884e5eb97defbda7fbfa7abada189f656445e8dbc368f94b39dacb9d35d6cad2326c887df950429168acf6abad1763591b9f8914a378f0885d242cb1e3dea
MD5 SHA1 SHA512

Submit Download

ab9b9eac-2c0d-4cb2-af8e-4ccef1e4bd11.vbs

Path C:\Users\Admin\AppData\Local\Temp\ab9b9eac-2c0d-4cb2-af8e-4ccef1e4bd11.vbs
Size 497B
SHA256 63127c1e99b7c1fcc60084289649676db57b787ee82de42b48df5a4c8c4b2647
MD5 5042f906f16e76ce4527f31e9be8d4e7
SHA1 1d5e132e91d6acb17830ac6568b8c215e759ec05
SHA512 eaea4f8a2ddbe114cec6ed99aaf9f0edc76b5fd1c0a02d93bfa2bf004b07b8cb83ef852ede1a7f4f642a00c737e13a339d01a3a45c0750641c7f34fc00a2843a
MD5 SHA1 SHA512

Submit Download

bd70d56d-3845-40f8-98d5-212591122b20.vbs

Path C:\Users\Admin\AppData\Local\Temp\bd70d56d-3845-40f8-98d5-212591122b20.vbs
Size 721B
SHA256 6df9be9dae04061a527b684f9f2477f0b29b0cce02655c2963d3cf3005d68b4e
MD5 21417da1ab88bc7f5a865b08a1cd1d66
SHA1 84028a93de2499caac7475a2898544a098267384
SHA512 af846921d3a20de72979afb6d006d27aceadd5b04b664ebace4d6a6a0a09c76718e46ba9d0b742e2f40aca86b953485cb57f679f558044bdc1cae84e805793a0
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 2f486d893df49b4dd7e12aff7dd0621f7477a3a51db7273d7c9b85ecaf385d65
MD5 9d131a5b8411130e51db160a11e227ab
SHA1 d85c40e97eba085100603890073940c6a16e00ad
SHA512 0f86e2dfd82c25ebf4e62c3664dd4ebea4e156f391e05af2f7acea6ca0361a0497f63388d1bf4f0e87e3a6953b4994f63922e5a6977e6d5966c6e9e23af6e2d9
SSDEEP 96:jEh2ClM84nqvsqvJCwocEh2ClM84nqvsEHyqvJCwor1E/pQHNi7jjXlUVI:4rUUozrUAHnor124i7jjP
MD5 SHA1 SHA512 SSDEEP

Submit Download

56085415360792

Path C:\Windows\Branding\Basebrd\de-DE\56085415360792
Size 406B
SHA256 a2405248f559706b0351bc760faa009e9ce187f5a736a69351f6f20da0ec68bb
MD5 8dbb71c029934d665bb4c7cbf3c4aec1
SHA1 d821ad54e2629b131593aa474cf03d342dbcd14f
SHA512 49e21c44b9d28524627cc4d46306fa606c818c9cc6731a2f972d6d2ce4cba581d6e99aef12d7f5920d185287baadfe0d7428901c4cdd7cfc91955d8ba1f17b41
MD5 SHA1 SHA512

Submit Download

memory/840-113-0x0000000002E20000-0x0000000002EA0000-memory.dmp

Download

memory/840-114-0x000007FEECEE0000-0x000007FEED87D000-memory.dmp

Download

memory/840-116-0x0000000002E20000-0x0000000002EA0000-memory.dmp

Download

memory/840-115-0x0000000002E20000-0x0000000002EA0000-memory.dmp

Download

memory/1036-97-0x00000000011B0000-0x00000000014DE000-memory.dmp

Download

memory/1036-99-0x000007FEF5660000-0x000007FEF604C000-memory.dmp

Download

memory/1212-103-0x000007FEECEE0000-0x000007FEED87D000-memory.dmp

Download

memory/1212-105-0x0000000002890000-0x0000000002910000-memory.dmp

Download

memory/1212-106-0x0000000002890000-0x0000000002910000-memory.dmp

Download

memory/1212-104-0x0000000002890000-0x0000000002910000-memory.dmp

Download

memory/1580-100-0x000007FEECEE0000-0x000007FEED87D000-memory.dmp

Download

memory/1580-102-0x0000000003000000-0x0000000003080000-memory.dmp

Download

memory/1580-101-0x0000000003000000-0x0000000003080000-memory.dmp

Download

memory/1780-117-0x0000000002AD0000-0x0000000002B50000-memory.dmp

Download

memory/1780-120-0x0000000002AD0000-0x0000000002B50000-memory.dmp

Download

memory/1780-119-0x0000000002AD0000-0x0000000002B50000-memory.dmp

Download

memory/1780-118-0x000007FEECEE0000-0x000007FEED87D000-memory.dmp

Download

memory/1808-92-0x0000000002810000-0x0000000002818000-memory.dmp

Download

memory/1808-112-0x0000000002830000-0x00000000028B0000-memory.dmp

Download

memory/1808-69-0x000000001B540000-0x000000001B822000-memory.dmp

Download

memory/1808-93-0x000007FEECEE0000-0x000007FEED87D000-memory.dmp

Download

memory/1808-94-0x0000000002830000-0x00000000028B0000-memory.dmp

Download

memory/1808-95-0x000007FEECEE0000-0x000007FEED87D000-memory.dmp

Download

memory/1808-96-0x0000000002830000-0x00000000028B0000-memory.dmp

Download

memory/1824-109-0x000007FEECEE0000-0x000007FEED87D000-memory.dmp

Download

memory/1824-108-0x0000000002B10000-0x0000000002B90000-memory.dmp

Download

memory/1960-98-0x000007FEECEE0000-0x000007FEED87D000-memory.dmp

Download

memory/1960-107-0x0000000002C50000-0x0000000002CD0000-memory.dmp

Download

memory/2348-111-0x00000000028F0000-0x0000000002970000-memory.dmp

Download

memory/2348-110-0x000007FEECEE0000-0x000007FEED87D000-memory.dmp

Download

memory/2904-19-0x000000001AA70000-0x000000001AA7C000-memory.dmp

Download

memory/2904-16-0x00000000023C0000-0x00000000023C8000-memory.dmp

Download

memory/2904-26-0x000000001AAD0000-0x000000001AADE000-memory.dmp

Download

memory/2904-25-0x000000001AAC0000-0x000000001AACA000-memory.dmp

Download

memory/2904-24-0x000000001AAB0000-0x000000001AABC000-memory.dmp

Download

memory/2904-23-0x000000001AAF0000-0x000000001AAF8000-memory.dmp

Download

memory/2904-22-0x000000001AAA0000-0x000000001AAAC000-memory.dmp

Download

memory/2904-21-0x000000001AA90000-0x000000001AA9C000-memory.dmp

Download

memory/2904-20-0x000000001AA80000-0x000000001AA88000-memory.dmp

Download

memory/2904-0-0x0000000000C60000-0x0000000000F8E000-memory.dmp

Download

memory/2904-30-0x000000001AB20000-0x000000001AB28000-memory.dmp

Download

memory/2904-91-0x000007FEF5660000-0x000007FEF604C000-memory.dmp

Download

memory/2904-28-0x000000001AB00000-0x000000001AB0E000-memory.dmp

Download

memory/2904-29-0x000000001AB10000-0x000000001AB18000-memory.dmp

Download

memory/2904-32-0x000000001AF10000-0x000000001AF1C000-memory.dmp

Download

memory/2904-18-0x00000000024E0000-0x00000000024F2000-memory.dmp

Download

memory/2904-17-0x00000000024D0000-0x00000000024D8000-memory.dmp

Download

memory/2904-27-0x000000001AAE0000-0x000000001AAE8000-memory.dmp

Download

memory/2904-15-0x00000000023B0000-0x00000000023BC000-memory.dmp

Download

memory/2904-14-0x000000001AA20000-0x000000001AA76000-memory.dmp

Download

memory/2904-13-0x00000000023A0000-0x00000000023AA000-memory.dmp

Download

memory/2904-12-0x0000000002390000-0x00000000023A0000-memory.dmp

Download

memory/2904-11-0x0000000000C50000-0x0000000000C58000-memory.dmp

Download

memory/2904-31-0x000000001AB30000-0x000000001AB3A000-memory.dmp

Download

memory/2904-10-0x0000000000C40000-0x0000000000C4C000-memory.dmp

Download

memory/2904-9-0x0000000000C30000-0x0000000000C42000-memory.dmp

Download

memory/2904-8-0x0000000000B90000-0x0000000000BA6000-memory.dmp

Download

memory/2904-7-0x0000000000B60000-0x0000000000B68000-memory.dmp

Download

memory/2904-6-0x0000000000B40000-0x0000000000B5C000-memory.dmp

Download

memory/2904-5-0x0000000000B30000-0x0000000000B38000-memory.dmp

Download

memory/2904-4-0x0000000000B20000-0x0000000000B2E000-memory.dmp

Download

memory/2904-3-0x00000000005A0000-0x00000000005AE000-memory.dmp

Download

memory/2904-2-0x000000001B400000-0x000000001B480000-memory.dmp

Download

memory/2904-1-0x000007FEF5660000-0x000007FEF604C000-memory.dmp

Download