575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706

Analysis

max time kernel
150s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Size

57KB
MD5

097e08d1be1ee38c8cf38f26f8328c70
SHA1

b5318a8eac94220f8b4222d5a2f2025a48fccfca
SHA256

575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706
SHA512

9427a56de073d428baeb2daaf7ed7453ec9b62df30881dd2e8e3cfcf55cbc1c09157bcbfe35a800a43d97dbbbbd46ff6b9744696ce806e06ff48b52c1236d6bb
SSDEEP

768:Nh5sxVPFXfgaDjof4ZgHqLNhldu8pGTUTY26TsGrn5wFbUzMsPzB5GXwekfp:NHsxFJfgaDjofVKn1pGwTJOlw1UrKwl

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

Tiwi.exeIExplorer.exewinlogon.exeimoet.execute.exe575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

winlogon.exeimoet.execute.exe575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exeTiwi.exeIExplorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	IExplorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exeTiwi.exeIExplorer.exewinlogon.exeimoet.execute.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cute.exe

Disables RegEdit via registry modification 6 IoCs

evasion

Processes:

imoet.execute.exe575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exeTiwi.exeIExplorer.exewinlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 6 IoCs

evasion

Processes:

575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exeTiwi.exeIExplorer.exewinlogon.exeimoet.execute.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 30 IoCs

Processes:

Tiwi.exeIExplorer.exewinlogon.exeimoet.execute.exeTiwi.exeIExplorer.exewinlogon.exeimoet.execute.exeTiwi.exeIExplorer.exewinlogon.exeTiwi.exeTiwi.exeTiwi.exeimoet.exeIExplorer.exeIExplorer.exeIExplorer.execute.exewinlogon.exewinlogon.exewinlogon.exeimoet.exeimoet.exeimoet.execute.execute.execute.exe

pid	process
2248	Tiwi.exe
5012	IExplorer.exe
3124	winlogon.exe
4648	imoet.exe
4964	cute.exe
4772	Tiwi.exe
1120	IExplorer.exe
1424	winlogon.exe
4120	imoet.exe
1984	cute.exe
2504	Tiwi.exe
4472	IExplorer.exe
2152	winlogon.exe
3360	Tiwi.exe
1384	Tiwi.exe
3100	Tiwi.exe
5092	imoet.exe
4240	IExplorer.exe
3996	IExplorer.exe
4228	IExplorer.exe
4360	cute.exe
3836	winlogon.exe
1104	winlogon.exe
2872	winlogon.exe
2652	imoet.exe
984	imoet.exe
2164	imoet.exe
972	cute.exe
4340	cute.exe
4528	cute.exe

Loads dropped DLL 5 IoCs

Processes:

Tiwi.exeTiwi.exeTiwi.exeTiwi.exeTiwi.exe

pid process

4772 Tiwi.exe
2504 Tiwi.exe
3360 Tiwi.exe
3100 Tiwi.exe
1384 Tiwi.exe

pid	process
4772	Tiwi.exe
2504	Tiwi.exe
3360	Tiwi.exe
3100	Tiwi.exe
1384	Tiwi.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exeTiwi.exewinlogon.exeIExplorer.exeimoet.execute.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2120-0-0x0000000000400000-0x0000000000433000-memory.dmp	upx
C:\Windows\SysWOW64\shell.exe	upx
C:\Windows\tiwi.exe	upx
behavioral2/memory/2248-96-0x0000000000400000-0x0000000000433000-memory.dmp	upx
C:\Windows\SysWOW64\IExplorer.exe	upx
behavioral2/memory/5012-103-0x0000000000400000-0x0000000000433000-memory.dmp	upx
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe	upx
behavioral2/memory/3124-111-0x0000000000400000-0x0000000000433000-memory.dmp	upx
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe	upx
behavioral2/memory/4648-117-0x0000000000400000-0x0000000000433000-memory.dmp	upx
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe	upx
behavioral2/memory/4964-123-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2120-127-0x0000000000400000-0x0000000000433000-memory.dmp	upx
C:\Windows\SysWOW64\shell.exe	upx
behavioral2/memory/4772-157-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4772-162-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1120-166-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1424-171-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4120-173-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4120-187-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2248-210-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1984-222-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2504-212-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/5012-249-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4472-250-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2504-252-0x0000000000400000-0x0000000000433000-memory.dmp	upx
C:\Windows\SysWOW64\shell.exe	upx
C:\Windows\SysWOW64\tiwi.scr	upx
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif	upx
behavioral2/memory/2152-280-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4648-305-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/3124-279-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4472-276-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4964-321-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2152-323-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/5092-330-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/3996-333-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/3100-337-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/3360-341-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/5092-340-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1384-336-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4360-347-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/3996-353-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4240-354-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4228-356-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4360-363-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/3836-365-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1104-368-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2872-370-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2652-378-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/972-379-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/984-381-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2164-383-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4528-391-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4340-395-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/972-394-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2248-396-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/5012-397-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4648-399-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4964-400-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/3124-398-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exeTiwi.exewinlogon.exeimoet.execute.exeIExplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	imoet.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

winlogon.execute.exeTiwi.exeIExplorer.exeimoet.exe

description	ioc	process
File opened (read-only)	\??\I:	winlogon.exe
File opened (read-only)	\??\R:	cute.exe
File opened (read-only)	\??\Y:	winlogon.exe
File opened (read-only)	\??\M:	cute.exe
File opened (read-only)	\??\V:	Tiwi.exe
File opened (read-only)	\??\J:	IExplorer.exe
File opened (read-only)	\??\W:	winlogon.exe
File opened (read-only)	\??\B:	Tiwi.exe
File opened (read-only)	\??\L:	Tiwi.exe
File opened (read-only)	\??\V:	winlogon.exe
File opened (read-only)	\??\T:	IExplorer.exe
File opened (read-only)	\??\H:	winlogon.exe
File opened (read-only)	\??\N:	winlogon.exe
File opened (read-only)	\??\L:	imoet.exe
File opened (read-only)	\??\R:	imoet.exe
File opened (read-only)	\??\I:	Tiwi.exe
File opened (read-only)	\??\I:	IExplorer.exe
File opened (read-only)	\??\P:	IExplorer.exe
File opened (read-only)	\??\Y:	cute.exe
File opened (read-only)	\??\I:	imoet.exe
File opened (read-only)	\??\S:	imoet.exe
File opened (read-only)	\??\E:	cute.exe
File opened (read-only)	\??\X:	winlogon.exe
File opened (read-only)	\??\Z:	winlogon.exe
File opened (read-only)	\??\I:	cute.exe
File opened (read-only)	\??\U:	Tiwi.exe
File opened (read-only)	\??\N:	IExplorer.exe
File opened (read-only)	\??\O:	winlogon.exe
File opened (read-only)	\??\H:	Tiwi.exe
File opened (read-only)	\??\M:	Tiwi.exe
File opened (read-only)	\??\Q:	imoet.exe
File opened (read-only)	\??\Q:	cute.exe
File opened (read-only)	\??\X:	Tiwi.exe
File opened (read-only)	\??\Q:	IExplorer.exe
File opened (read-only)	\??\H:	imoet.exe
File opened (read-only)	\??\E:	imoet.exe
File opened (read-only)	\??\R:	IExplorer.exe
File opened (read-only)	\??\K:	cute.exe
File opened (read-only)	\??\S:	winlogon.exe
File opened (read-only)	\??\U:	cute.exe
File opened (read-only)	\??\W:	cute.exe
File opened (read-only)	\??\G:	Tiwi.exe
File opened (read-only)	\??\K:	Tiwi.exe
File opened (read-only)	\??\B:	winlogon.exe
File opened (read-only)	\??\W:	IExplorer.exe
File opened (read-only)	\??\B:	cute.exe
File opened (read-only)	\??\X:	IExplorer.exe
File opened (read-only)	\??\S:	cute.exe
File opened (read-only)	\??\E:	Tiwi.exe
File opened (read-only)	\??\T:	Tiwi.exe
File opened (read-only)	\??\H:	IExplorer.exe
File opened (read-only)	\??\L:	IExplorer.exe
File opened (read-only)	\??\M:	imoet.exe
File opened (read-only)	\??\Z:	imoet.exe
File opened (read-only)	\??\J:	Tiwi.exe
File opened (read-only)	\??\O:	imoet.exe
File opened (read-only)	\??\L:	winlogon.exe
File opened (read-only)	\??\P:	imoet.exe
File opened (read-only)	\??\Q:	Tiwi.exe
File opened (read-only)	\??\S:	IExplorer.exe
File opened (read-only)	\??\R:	winlogon.exe
File opened (read-only)	\??\X:	imoet.exe
File opened (read-only)	\??\G:	cute.exe
File opened (read-only)	\??\P:	cute.exe

Modifies WinLogon 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

IExplorer.exewinlogon.exe575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exeTiwi.exeimoet.execute.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	cute.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

Tiwi.exe

description	ioc	process
File created	C:\autorun.inf	Tiwi.exe
File opened for modification	C:\autorun.inf	Tiwi.exe
File created	F:\autorun.inf	Tiwi.exe
File opened for modification	F:\autorun.inf	Tiwi.exe

Drops file in System32 directory 38 IoCs

Processes:

IExplorer.execute.exe575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exeTiwi.exeIExplorer.exewinlogon.exeIExplorer.exeimoet.exeIExplorer.exeIExplorer.exeIExplorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File created	C:\Windows\SysWOW64\shell.exe	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	Tiwi.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	cute.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	cute.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File created	C:\Windows\SysWOW64\tiwi.scr	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	imoet.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe

Drops file in Windows directory 24 IoCs

Processes:

Tiwi.exeIExplorer.exewinlogon.exeimoet.exe575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exeIExplorer.exeIExplorer.exeIExplorer.exeIExplorer.exeIExplorer.execute.exe

description	ioc	process
File created	C:\Windows\tiwi.exe	Tiwi.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	winlogon.exe
File opened for modification	C:\Windows\tiwi.exe	imoet.exe
File created	C:\Windows\tiwi.exe	imoet.exe
File created	C:\Windows\tiwi.exe	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	winlogon.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	cute.exe
File created	C:\Windows\tiwi.exe	cute.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	Tiwi.exe
File opened for modification	C:\Windows\tiwi.exe	IExplorer.exe
File created	C:\Windows\tiwi.exe	IExplorer.exe

Modifies Control Panel 54 IoCs

evasion

Processes:

winlogon.exeTiwi.exeIExplorer.exeimoet.execute.exe575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\s1159 = "Tiwi"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Mouse\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\s1159 = "Tiwi"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Mouse\SwapMouseButtons = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Mouse\SwapMouseButtons = "1"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\s1159 = "Tiwi"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Mouse\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\s1159 = "Tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\s2359 = "Tiwi"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Mouse\SwapMouseButtons = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\s2359 = "Tiwi"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Mouse\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Mouse\SwapMouseButtons = "1"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Mouse\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\s1159 = "Tiwi"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Mouse\SwapMouseButtons = "1"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\s2359 = "Tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\s1159 = "Tiwi"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Mouse\	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\s2359 = "Tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\s2359 = "Tiwi"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Mouse\SwapMouseButtons = "1"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\s2359 = "Tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Mouse\	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\	cute.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

Processes:

575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exeimoet.exeTiwi.exeIExplorer.execute.exewinlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main\	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	cute.exe

Modifies Internet Explorer start page 1 TTPs 6 IoCs

stealer

Modify Registry

T1112

Processes:

575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exeTiwi.exeIExplorer.exewinlogon.exeimoet.execute.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	cute.exe

Modifies registry class 64 IoCs

Processes:

575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exeTiwi.exeIExplorer.execute.exewinlogon.exeimoet.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	IExplorer.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

Notepad.exe

pid process

2928 Notepad.exe

pid	process
2928	Notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe

pid	process
2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

Processes:

Tiwi.exeimoet.exewinlogon.exeIExplorer.execute.exe

pid process

2248 Tiwi.exe
4648 imoet.exe
3124 winlogon.exe
5012 IExplorer.exe
4964 cute.exe

Suspicious use of SetWindowsHookEx 31 IoCs

Processes:

575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exeTiwi.exeIExplorer.exewinlogon.exeimoet.execute.exeTiwi.exeIExplorer.exewinlogon.exeimoet.execute.exeTiwi.exeIExplorer.exewinlogon.exeTiwi.exeTiwi.exeTiwi.exeimoet.exeIExplorer.exeIExplorer.exeIExplorer.execute.exewinlogon.exewinlogon.exewinlogon.exeimoet.exeimoet.exeimoet.execute.execute.execute.exe

pid	process
2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
2248	Tiwi.exe
5012	IExplorer.exe
3124	winlogon.exe
4648	imoet.exe
4964	cute.exe
4772	Tiwi.exe
1120	IExplorer.exe
1424	winlogon.exe
4120	imoet.exe
1984	cute.exe
2504	Tiwi.exe
4472	IExplorer.exe
2152	winlogon.exe
3100	Tiwi.exe
1384	Tiwi.exe
3360	Tiwi.exe
5092	imoet.exe
3996	IExplorer.exe
4240	IExplorer.exe
4228	IExplorer.exe
4360	cute.exe
3836	winlogon.exe
1104	winlogon.exe
2872	winlogon.exe
2652	imoet.exe
984	imoet.exe
2164	imoet.exe
4528	cute.exe
4340	cute.exe
972	cute.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exeTiwi.exeIExplorer.exewinlogon.execute.exeimoet.exe

description	pid	process	target process
PID 2120 wrote to memory of 2248	2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe	Tiwi.exe
PID 2120 wrote to memory of 2248	2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe	Tiwi.exe
PID 2120 wrote to memory of 2248	2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe	Tiwi.exe
PID 2248 wrote to memory of 2928	2248	Tiwi.exe	Notepad.exe
PID 2248 wrote to memory of 2928	2248	Tiwi.exe	Notepad.exe
PID 2120 wrote to memory of 5012	2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe	IExplorer.exe
PID 2120 wrote to memory of 5012	2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe	IExplorer.exe
PID 2120 wrote to memory of 5012	2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe	IExplorer.exe
PID 2120 wrote to memory of 3124	2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe	winlogon.exe
PID 2120 wrote to memory of 3124	2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe	winlogon.exe
PID 2120 wrote to memory of 3124	2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe	winlogon.exe
PID 2120 wrote to memory of 4648	2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe	imoet.exe
PID 2120 wrote to memory of 4648	2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe	imoet.exe
PID 2120 wrote to memory of 4648	2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe	imoet.exe
PID 2120 wrote to memory of 4964	2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe	cute.exe
PID 2120 wrote to memory of 4964	2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe	cute.exe
PID 2120 wrote to memory of 4964	2120	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe	cute.exe
PID 2248 wrote to memory of 4772	2248	Tiwi.exe	Tiwi.exe
PID 2248 wrote to memory of 4772	2248	Tiwi.exe	Tiwi.exe
PID 2248 wrote to memory of 4772	2248	Tiwi.exe	Tiwi.exe
PID 2248 wrote to memory of 1120	2248	Tiwi.exe	IExplorer.exe
PID 2248 wrote to memory of 1120	2248	Tiwi.exe	IExplorer.exe
PID 2248 wrote to memory of 1120	2248	Tiwi.exe	IExplorer.exe
PID 2248 wrote to memory of 1424	2248	Tiwi.exe	winlogon.exe
PID 2248 wrote to memory of 1424	2248	Tiwi.exe	winlogon.exe
PID 2248 wrote to memory of 1424	2248	Tiwi.exe	winlogon.exe
PID 2248 wrote to memory of 4120	2248	Tiwi.exe	imoet.exe
PID 2248 wrote to memory of 4120	2248	Tiwi.exe	imoet.exe
PID 2248 wrote to memory of 4120	2248	Tiwi.exe	imoet.exe
PID 2248 wrote to memory of 1984	2248	Tiwi.exe	cute.exe
PID 2248 wrote to memory of 1984	2248	Tiwi.exe	cute.exe
PID 2248 wrote to memory of 1984	2248	Tiwi.exe	cute.exe
PID 5012 wrote to memory of 2504	5012	IExplorer.exe	Tiwi.exe
PID 5012 wrote to memory of 2504	5012	IExplorer.exe	Tiwi.exe
PID 5012 wrote to memory of 2504	5012	IExplorer.exe	Tiwi.exe
PID 5012 wrote to memory of 4472	5012	IExplorer.exe	IExplorer.exe
PID 5012 wrote to memory of 4472	5012	IExplorer.exe	IExplorer.exe
PID 5012 wrote to memory of 4472	5012	IExplorer.exe	IExplorer.exe
PID 5012 wrote to memory of 2152	5012	IExplorer.exe	winlogon.exe
PID 5012 wrote to memory of 2152	5012	IExplorer.exe	winlogon.exe
PID 5012 wrote to memory of 2152	5012	IExplorer.exe	winlogon.exe
PID 3124 wrote to memory of 3360	3124	winlogon.exe	Tiwi.exe
PID 3124 wrote to memory of 3360	3124	winlogon.exe	Tiwi.exe
PID 3124 wrote to memory of 3360	3124	winlogon.exe	Tiwi.exe
PID 4964 wrote to memory of 1384	4964	cute.exe	Tiwi.exe
PID 4964 wrote to memory of 1384	4964	cute.exe	Tiwi.exe
PID 4964 wrote to memory of 1384	4964	cute.exe	Tiwi.exe
PID 4648 wrote to memory of 3100	4648	imoet.exe	Tiwi.exe
PID 4648 wrote to memory of 3100	4648	imoet.exe	Tiwi.exe
PID 4648 wrote to memory of 3100	4648	imoet.exe	Tiwi.exe
PID 5012 wrote to memory of 5092	5012	IExplorer.exe	imoet.exe
PID 5012 wrote to memory of 5092	5012	IExplorer.exe	imoet.exe
PID 5012 wrote to memory of 5092	5012	IExplorer.exe	imoet.exe
PID 4964 wrote to memory of 4240	4964	cute.exe	IExplorer.exe
PID 4964 wrote to memory of 4240	4964	cute.exe	IExplorer.exe
PID 4964 wrote to memory of 4240	4964	cute.exe	IExplorer.exe
PID 4648 wrote to memory of 3996	4648	imoet.exe	IExplorer.exe
PID 4648 wrote to memory of 3996	4648	imoet.exe	IExplorer.exe
PID 4648 wrote to memory of 3996	4648	imoet.exe	IExplorer.exe
PID 3124 wrote to memory of 4228	3124	winlogon.exe	IExplorer.exe
PID 3124 wrote to memory of 4228	3124	winlogon.exe	IExplorer.exe
PID 3124 wrote to memory of 4228	3124	winlogon.exe	IExplorer.exe
PID 5012 wrote to memory of 4360	5012	IExplorer.exe	cute.exe
PID 5012 wrote to memory of 4360	5012	IExplorer.exe	cute.exe

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

Processes:

Tiwi.exewinlogon.exeimoet.exe575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exeIExplorer.execute.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe

C:\Users\Admin\AppData\Local\Temp\575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe
"C:\Users\Admin\AppData\Local\Temp\575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2120

C:\Windows\Tiwi.exe
C:\Windows\Tiwi.exe
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2248

C:\Windows\Notepad.exe
Notepad.exe C:\Present.txt
3⤵
- Opens file in notepad (likely ransom note)
PID:2928

C:\Windows\Tiwi.exe
C:\Windows\Tiwi.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4772

C:\Windows\SysWOW64\IExplorer.exe
C:\Windows\system32\IExplorer.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1120

C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1424

C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4120

C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1984

C:\Windows\SysWOW64\IExplorer.exe
C:\Windows\system32\IExplorer.exe
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5012

C:\Windows\Tiwi.exe
C:\Windows\Tiwi.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2504

C:\Windows\SysWOW64\IExplorer.exe
C:\Windows\system32\IExplorer.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4472

C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2152

C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5092

C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4360

C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3124

C:\Windows\Tiwi.exe
C:\Windows\Tiwi.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3360

C:\Windows\SysWOW64\IExplorer.exe
C:\Windows\system32\IExplorer.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4228

C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2872

C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2164

C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4528

C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4648

C:\Windows\Tiwi.exe
C:\Windows\Tiwi.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3100

C:\Windows\SysWOW64\IExplorer.exe
C:\Windows\system32\IExplorer.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3996

C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3836

C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2652

C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:972

C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4964

C:\Windows\Tiwi.exe
C:\Windows\Tiwi.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1384

C:\Windows\SysWOW64\IExplorer.exe
C:\Windows\system32\IExplorer.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4240

C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1104

C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:984

C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
57KB

MD5
ea859346e04c1bf712483ffe7eec791d

SHA1
dc84b87d80cb15df1605b74328af2b366b384fb7

SHA256
72699723e3176ce46c6b44deb34497b7681d42e372d4154c2b9de4b3af46d07e

SHA512
0b765a6997a4a5564e312a6629a787bcd8f1e43f31a6ce7b0e9bb79b15ff0dd0a0c2d37f2b3118e35dfe5bbddd45d271d5b87d30bdc1efb5f1172501dc19e563

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe

Filesize
45KB

MD5
2f2fd3eb61897f92f95b1410416bf84b

SHA1
546f362c934a3fa5eeaf5504c0a55d28a7d9f36e

SHA256
795cecd6f36ca5162a403a0983498c31ef8a07f904ba025073d1a597e6ec0b25

SHA512
39d9a1ed17239fbe424c74a8e943c8a6857e52c9f2b75211cc6b9aec60f21711a1688f034209a05bac6d10a65cfb0f14c98e57d468040e8b198e946bdc283031

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
57KB

MD5
8a30d5f6ba87e6eb675f201643ea75f5

SHA1
a80b5d9eedc85e1bbbbd1284069193c5b94194b3

SHA256
9d3ee370497007f38893a3fccfbcc7c338856d7855438d1a500e68ae11ba5cf8

SHA512
d5ef44804c7258a738b9d879975f589a7a58100182c5065c39f16e41b2669ec6024447289f10d556c0a4ae1dd8375e9433b67eca45b7f37375fe19383b2956fd

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
57KB

MD5
13419db2b84d2b235fd10b09a7950f86

SHA1
27530ce64b66d2f0ee415bdfcf863be519d9a01c

SHA256
6fc672ca67c0f646d612f95e709fd9d874ed398d8ded174417300ff38bf2c9de

SHA512
fd52fd44cae6dcd7844ee58c01d748a904efec926f405b78564e12ae8f3c4aeae35b87a7cc3c0aca8d16b54e44e8425c163b95169f855f282fdefdf7d6e1aec7

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
e96c08505dff59909a09f7ad2bcb7cc0

SHA1
292bca6bf29ee293b5e9c795155bfb0b6c7732be

SHA256
07d50eed84c976219ccf9a2e945f8d16970d0000d933c6118656f699edfe39b7

SHA512
4485acd7bf8a71c2e77df7c53529f82f5a18eafa11e05d91578cbf8302a25b7f933701fb5963bda6aea7dc8404a2b1ad5e29450251f88f74e193e30f4f289607

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
2dffd527da42c68f50ed83dfb6fe7ff6

SHA1
29dcc7ef10498c1f8aa1a8798992f5515af8f655

SHA256
beac727ed1149edd294e2f739f17fafdefc0c5a09b3348c8ce9e2dcd71c48c15

SHA512
c97fa41211d8a0789c61f6c2d0979702d84d17126bf5c468663c055ec5a534f2dba10a6628e80279af8a64f7dac86b7be8976d445d48dacb8cb188e1015c4e1b

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
25152ca31d2e4f205c6fe2332e09558d

SHA1
8255b2d01e1ada8f7fcd84726ae491195ca1e781

SHA256
b6d000cc3e0d52b8c277f914094a0f6bf43cf9d7e25786702f0af5e0b72b274b

SHA512
ff44ed23ec7c49d6b0f99dfcabd752174b3c9d9a2fd8b8fa5f5d8d21490b6397a31e0d7c5153dbe251180df9a2fcbf11586d1db3aa18dd553e7a488ef05113e7

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
57KB

MD5
a893fb1bfa595f4e58ed9f5192a08f01

SHA1
6fd6583d9956f9ba2314a220ded8b1ba9fcddff8

SHA256
be839cc38481eebf7bd2b88fb497099ae9120ecd857b52284c0de0dffd6fa3c9

SHA512
bc9df04086bf31858b48c2dd03949623c26177c1af20f3e1854cf097e962a56528c2c6ff41246f690a210403df360cb8130d53121ee605eb48351c23cfd066f3

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
57KB

MD5
755c82eb6269fc4004cc8f7f933b3021

SHA1
a89a1cbba351b45c912b2170847c17d934df448a

SHA256
e63389f55aae1c62ac9baa2c9aa2168ce88ac3efb913cd34569f47dac96785db

SHA512
7d6c33fdeb02be8fc775a1e004f7ff3871e3cd9ad189a614af909ecd2c7bfc65ebc320e3d0779c9fbaa5ea5829654da1c212c30fcf70ed46109b26bc64faf663

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
57KB

MD5
7e2e326ad3211ed8b7b6f1b2bdfeb59f

SHA1
5c22e666e9c6c3138144d802e896f8ef9663ced8

SHA256
e25d5b62b089d6f4155609f58003ef0d5f1f9b6114ed51369abd9f39f78a1ff1

SHA512
d155d9d9d30fc34dd210b751f0e802a554a4729b31ff05ceb51a605fbe9643b89edf27fb2654d4ce2e1abd96471bb90713ef8a459506b9573b962e778800c5d5

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
57KB

MD5
77649a6dc026fbd94fb403f5842f0249

SHA1
035978163bdd17f57856fce0e13773855b17114c

SHA256
0edbddbb65df507d2f8ec4819a303f1c4751eee25b56c726bd8f6abb039352f3

SHA512
2d9b0b7b3fe4e568174098492367dff0bb0a4ba6978ec59ed8441c0784c1cde12b180c4cf7143b19473c46b143b2d8f47ed02eda6bf4564be644f3958e6b36de

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
57KB

MD5
097e08d1be1ee38c8cf38f26f8328c70

SHA1
b5318a8eac94220f8b4222d5a2f2025a48fccfca

SHA256
575482a06b926609c5494f0c33d28dcb4a22ca4f88223faf425e1513496dd706

SHA512
9427a56de073d428baeb2daaf7ed7453ec9b62df30881dd2e8e3cfcf55cbc1c09157bcbfe35a800a43d97dbbbbd46ff6b9744696ce806e06ff48b52c1236d6bb

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
57KB

MD5
d9ce17bcf4896ec15720d7c97a4f9fce

SHA1
069810919f5b127a8760cbb74cf5698bd5ece10b

SHA256
27452cbce30f660e1f7266ebf07ac873019b72982883d3d0f9cc6000c4e4d762

SHA512
1b6e8f337e1242128974048323141b155b5e517db9327350b31c709396f084861e6fae1b4d0aa7095ad06a56865fafcd2b86c9fda083d6ba1eb6511880561138

Download Submit
C:\Windows\tiwi.exe

Filesize
57KB

MD5
bade66d9732bbe86965d624f271eaa07

SHA1
d4a4f3efe28ecd7ccb2aca2c7b3ebab297be1961

SHA256
680237033a78350914762918e26bf4bf88329a38995ab478ccfc4aa131cb9ce7

SHA512
5133c7351eb956ad484b9bcf8e102fcb8c1a0bf177f7c61825d3e3222670f702fd8adde3c5c6e175f2b6b145f33121f12ca67e4acfce05103437122592dfa7c2

Download Submit
C:\tiwi.exe

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
F:\autorun.inf

Filesize
39B

MD5
415c421ba7ae46e77bdee3a681ecc156

SHA1
b0db5782b7688716d6fc83f7e650ffe1143201b7

SHA256
e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

SHA512
dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

Download Submit
memory/972-379-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/972-394-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/984-381-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1104-368-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1120-166-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1384-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1424-171-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1984-222-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2120-127-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2120-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2152-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2152-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2164-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2248-210-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2248-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2248-396-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2504-212-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2504-252-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2652-378-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2872-370-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3100-337-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3124-398-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3124-111-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3124-279-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3360-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3836-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3996-333-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3996-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4120-187-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4120-173-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4228-356-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4240-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4360-363-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4360-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4472-250-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4472-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4528-391-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4648-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4648-399-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4648-117-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4772-157-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4772-162-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4964-321-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4964-123-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4964-400-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5012-397-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5012-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5012-103-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5092-330-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5092-340-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download