Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 23:43
Behavioral task
behavioral1
Sample
7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe
Resource
win7-20240508-en
windows7-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
22 signatures
150 seconds
General
-
Target
7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe
-
Size
91KB
-
MD5
9c09e2f30c0290b6718fea7ea74fd0b9
-
SHA1
48ed169778adfc6c299fa125353a67d833a6d753
-
SHA256
7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085
-
SHA512
88e39d8d4fe30b1a8a85a800ed316da93d0fe026a92b173d33811321bcf7ac41fd87ebecc33163c9abc4f389587cb353289279ca2f5ac4df1970e815526699bc
-
SSDEEP
1536:yOcjUpkWb2TTgKwunOcjUpkWb2TTgKwuq:yOcjWJu7tnOcjWJu7tq
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" CSRSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" CSRSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" SERVICES.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" SERVICES.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" WINLOGON.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" 4k51k4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" WINLOGON.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" 4k51k4.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 4k51k4.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" IExplorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" WINLOGON.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" CSRSS.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SERVICES.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" LSASS.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SMSS.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" LSASS.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SMSS.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4k51k4.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" IExplorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" WINLOGON.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" CSRSS.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SERVICES.EXE -
Disables RegEdit via registry modification 16 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 4k51k4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 4k51k4.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" IExplorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SERVICES.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" LSASS.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" LSASS.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" CSRSS.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SMSS.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SMSS.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" WINLOGON.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" WINLOGON.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" CSRSS.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" IExplorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SERVICES.EXE -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 56 IoCs
pid Process 2828 4k51k4.exe 2624 IExplorer.exe 1440 WINLOGON.EXE 2164 CSRSS.EXE 764 SERVICES.EXE 1184 LSASS.EXE 864 SMSS.EXE 336 4k51k4.exe 2412 4k51k4.exe 2404 IExplorer.exe 748 4k51k4.exe 1652 WINLOGON.EXE 2384 IExplorer.exe 1948 IExplorer.exe 888 4k51k4.exe 3004 4k51k4.exe 1088 4k51k4.exe 2724 CSRSS.EXE 2956 WINLOGON.EXE 2684 IExplorer.exe 2628 IExplorer.exe 2576 WINLOGON.EXE 2708 IExplorer.exe 3024 CSRSS.EXE 1932 WINLOGON.EXE 2740 SERVICES.EXE 1916 4k51k4.exe 2908 CSRSS.EXE 2516 WINLOGON.EXE 1920 CSRSS.EXE 2880 LSASS.EXE 1056 SERVICES.EXE 1940 CSRSS.EXE 1944 IExplorer.exe 2496 LSASS.EXE 3012 WINLOGON.EXE 2008 SERVICES.EXE 2952 SERVICES.EXE 484 SMSS.EXE 2964 LSASS.EXE 2960 LSASS.EXE 320 CSRSS.EXE 928 SMSS.EXE 2860 SERVICES.EXE 1472 SMSS.EXE 1040 WINLOGON.EXE 2376 SMSS.EXE 1980 LSASS.EXE 1532 SERVICES.EXE 2436 SMSS.EXE 2160 LSASS.EXE 1140 SMSS.EXE 1080 CSRSS.EXE 2116 SERVICES.EXE 1564 LSASS.EXE 2936 SMSS.EXE -
Loads dropped DLL 64 IoCs
pid Process 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 2828 4k51k4.exe 2828 4k51k4.exe 2624 IExplorer.exe 2828 4k51k4.exe 2828 4k51k4.exe 2624 IExplorer.exe 1440 WINLOGON.EXE 1440 WINLOGON.EXE 2828 4k51k4.exe 2828 4k51k4.exe 2624 IExplorer.exe 2624 IExplorer.exe 1184 LSASS.EXE 1184 LSASS.EXE 2164 CSRSS.EXE 2164 CSRSS.EXE 764 SERVICES.EXE 764 SERVICES.EXE 1440 WINLOGON.EXE 2828 4k51k4.exe 2828 4k51k4.exe 1440 WINLOGON.EXE 1440 WINLOGON.EXE 1184 LSASS.EXE 764 SERVICES.EXE 1184 LSASS.EXE 764 SERVICES.EXE 2624 IExplorer.exe 2624 IExplorer.exe 2828 4k51k4.exe 2828 4k51k4.exe 764 SERVICES.EXE 764 SERVICES.EXE 1184 LSASS.EXE 1184 LSASS.EXE 1440 WINLOGON.EXE 1440 WINLOGON.EXE 1440 WINLOGON.EXE 1440 WINLOGON.EXE 864 SMSS.EXE 864 SMSS.EXE 2164 CSRSS.EXE 2164 CSRSS.EXE 764 SERVICES.EXE 1440 WINLOGON.EXE 2624 IExplorer.exe 1440 WINLOGON.EXE 2624 IExplorer.exe 764 SERVICES.EXE 2624 IExplorer.exe 764 SERVICES.EXE 2624 IExplorer.exe -
Modifies system executable filetype association 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" WINLOGON.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command SMSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 4k51k4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 4k51k4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" CSRSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command SERVICES.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 4k51k4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command WINLOGON.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" CSRSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 4k51k4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command WINLOGON.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" WINLOGON.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command CSRSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" CSRSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command CSRSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 4k51k4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 4k51k4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" WINLOGON.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command WINLOGON.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" SERVICES.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 4k51k4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command WINLOGON.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" SMSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 4k51k4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" WINLOGON.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command SERVICES.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" SMSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 4k51k4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 4k51k4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" CSRSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command CSRSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" SERVICES.EXE -
resource yara_rule behavioral1/memory/2984-0-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/files/0x0007000000014415-8.dat upx behavioral1/memory/2984-109-0x0000000001CB0000-0x0000000001CD3000-memory.dmp upx behavioral1/files/0x0007000000014f41-113.dat upx behavioral1/files/0x0006000000015424-117.dat upx behavioral1/files/0x000600000001562a-129.dat upx behavioral1/memory/1440-138-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/files/0x0006000000015678-140.dat upx behavioral1/files/0x0006000000015682-151.dat upx behavioral1/memory/2984-155-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/764-159-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/files/0x0006000000015c6f-160.dat upx behavioral1/memory/2828-167-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/files/0x0006000000015c7f-170.dat upx behavioral1/memory/2624-177-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2984-181-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/files/0x0009000000014345-188.dat upx behavioral1/files/0x0006000000015122-214.dat upx behavioral1/memory/336-244-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2164-254-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2412-253-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2404-247-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/files/0x0006000000015406-265.dat upx behavioral1/files/0x000600000001552d-301.dat upx behavioral1/files/0x0006000000015406-299.dat upx behavioral1/files/0x0006000000015122-296.dat upx behavioral1/files/0x0009000000014345-319.dat upx behavioral1/files/0x0009000000014345-295.dat upx behavioral1/memory/864-318-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/files/0x000600000001552d-267.dat upx behavioral1/files/0x0006000000015122-262.dat upx behavioral1/files/0x0009000000014345-261.dat upx behavioral1/memory/1184-289-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/764-286-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2404-258-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/748-341-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1440-242-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1652-382-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2724-409-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2708-422-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2684-427-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/3004-407-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2516-452-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1932-431-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2576-406-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1056-461-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2516-440-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/3012-479-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2496-493-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2908-487-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1920-485-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2008-491-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2908-478-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2496-475-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/3024-450-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1916-464-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2740-459-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2576-402-0x0000000000220000-0x0000000000230000-memory.dmp upx behavioral1/memory/1948-398-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2956-395-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2384-392-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/888-389-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1088-386-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2880-495-0x0000000000400000-0x0000000000423000-memory.dmp upx -
Adds Run key to start application 2 TTPs 40 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" WINLOGON.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" SERVICES.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" SERVICES.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\4k51k4 = "C:\\Windows\\4k51k4.exe" LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" 4k51k4.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" WINLOGON.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" LSASS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\4k51k4 = "C:\\Windows\\4k51k4.exe" SMSS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\4k51k4 = "C:\\Windows\\4k51k4.exe" 4k51k4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" CSRSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" WINLOGON.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" SERVICES.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" IExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\4k51k4 = "C:\\Windows\\4k51k4.exe" CSRSS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\4k51k4 = "C:\\Windows\\4k51k4.exe" SERVICES.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" SERVICES.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" 4k51k4.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" IExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" 4k51k4.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\4k51k4 = "C:\\Windows\\4k51k4.exe" IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" WINLOGON.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" CSRSS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" CSRSS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" LSASS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\4k51k4 = "C:\\Windows\\4k51k4.exe" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\4k51k4 = "C:\\Windows\\4k51k4.exe" WINLOGON.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" CSRSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" LSASS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" SMSS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" 4k51k4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" IExplorer.exe -
Drops desktop.ini file(s) 7 IoCs
description ioc Process File created C:\desktop.ini 4k51k4.exe File opened for modification F:\desktop.ini SERVICES.EXE File opened for modification F:\desktop.ini 4k51k4.exe File created F:\desktop.ini 4k51k4.exe File opened for modification C:\desktop.ini 4k51k4.exe File opened for modification C:\desktop.ini SERVICES.EXE File created C:\desktop.ini SERVICES.EXE -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 4k51k4.exe File opened (read-only) \??\M: IExplorer.exe File opened (read-only) \??\Q: LSASS.EXE File opened (read-only) \??\U: WINLOGON.EXE File opened (read-only) \??\I: IExplorer.exe File opened (read-only) \??\I: CSRSS.EXE File opened (read-only) \??\P: CSRSS.EXE File opened (read-only) \??\U: CSRSS.EXE File opened (read-only) \??\R: SMSS.EXE File opened (read-only) \??\Y: IExplorer.exe File opened (read-only) \??\W: CSRSS.EXE File opened (read-only) \??\J: SERVICES.EXE File opened (read-only) \??\L: WINLOGON.EXE File opened (read-only) \??\S: CSRSS.EXE File opened (read-only) \??\V: CSRSS.EXE File opened (read-only) \??\G: SMSS.EXE File opened (read-only) \??\P: SMSS.EXE File opened (read-only) \??\B: SERVICES.EXE File opened (read-only) \??\Y: WINLOGON.EXE File opened (read-only) \??\U: IExplorer.exe File opened (read-only) \??\P: SERVICES.EXE File opened (read-only) \??\U: SERVICES.EXE File opened (read-only) \??\H: IExplorer.exe File opened (read-only) \??\L: LSASS.EXE File opened (read-only) \??\W: LSASS.EXE File opened (read-only) \??\S: SERVICES.EXE File opened (read-only) \??\Y: SERVICES.EXE File opened (read-only) \??\Z: CSRSS.EXE File opened (read-only) \??\Q: SMSS.EXE File opened (read-only) \??\W: 4k51k4.exe File opened (read-only) \??\B: IExplorer.exe File opened (read-only) \??\S: IExplorer.exe File opened (read-only) \??\T: IExplorer.exe File opened (read-only) \??\G: CSRSS.EXE File opened (read-only) \??\I: 4k51k4.exe File opened (read-only) \??\L: 4k51k4.exe File opened (read-only) \??\L: SERVICES.EXE File opened (read-only) \??\N: SERVICES.EXE File opened (read-only) \??\E: IExplorer.exe File opened (read-only) \??\N: CSRSS.EXE File opened (read-only) \??\Z: 4k51k4.exe File opened (read-only) \??\O: SERVICES.EXE File opened (read-only) \??\V: SERVICES.EXE File opened (read-only) \??\K: WINLOGON.EXE File opened (read-only) \??\N: LSASS.EXE File opened (read-only) \??\T: LSASS.EXE File opened (read-only) \??\U: LSASS.EXE File opened (read-only) \??\B: SMSS.EXE File opened (read-only) \??\V: SMSS.EXE File opened (read-only) \??\N: 4k51k4.exe File opened (read-only) \??\G: SERVICES.EXE File opened (read-only) \??\T: SERVICES.EXE File opened (read-only) \??\G: WINLOGON.EXE File opened (read-only) \??\H: WINLOGON.EXE File opened (read-only) \??\M: WINLOGON.EXE File opened (read-only) \??\V: WINLOGON.EXE File opened (read-only) \??\B: CSRSS.EXE File opened (read-only) \??\G: LSASS.EXE File opened (read-only) \??\S: 4k51k4.exe File opened (read-only) \??\J: WINLOGON.EXE File opened (read-only) \??\S: WINLOGON.EXE File opened (read-only) \??\Z: WINLOGON.EXE File opened (read-only) \??\E: SMSS.EXE File opened (read-only) \??\U: SMSS.EXE -
Drops file in System32 directory 50 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File created C:\Windows\SysWOW64\IExplorer.exe 4k51k4.exe File created C:\Windows\SysWOW64\IExplorer.exe SERVICES.EXE File opened for modification C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File created C:\Windows\SysWOW64\IExplorer.exe SMSS.EXE File created C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\MrHelloween.scr SMSS.EXE File opened for modification C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File created C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File created C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File created C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe 4k51k4.exe File created C:\Windows\SysWOW64\IExplorer.exe CSRSS.EXE File created C:\Windows\SysWOW64\IExplorer.exe LSASS.EXE File created C:\Windows\SysWOW64\MrHelloween.scr 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe File created C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\MrHelloween.scr 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe File created C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\shell.exe WINLOGON.EXE File opened for modification C:\Windows\SysWOW64\IExplorer.exe CSRSS.EXE File opened for modification C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File created C:\Windows\SysWOW64\IExplorer.exe IExplorer.exe File opened for modification C:\Windows\SysWOW64\shell.exe LSASS.EXE File opened for modification C:\Windows\SysWOW64\shell.exe 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe File created C:\Windows\SysWOW64\IExplorer.exe 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe SMSS.EXE File opened for modification C:\Windows\SysWOW64\shell.exe IExplorer.exe File created C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe WINLOGON.EXE File opened for modification C:\Windows\SysWOW64\IExplorer.exe SERVICES.EXE File opened for modification C:\Windows\SysWOW64\IExplorer.exe LSASS.EXE File opened for modification C:\Windows\SysWOW64\shell.exe SMSS.EXE File opened for modification C:\Windows\SysWOW64\shell.exe CSRSS.EXE File created C:\Windows\SysWOW64\shell.exe 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe File created C:\Windows\SysWOW64\IExplorer.exe WINLOGON.EXE File opened for modification C:\Windows\SysWOW64\MrHelloween.scr LSASS.EXE File opened for modification C:\Windows\SysWOW64\IExplorer.exe IExplorer.exe File opened for modification C:\Windows\SysWOW64\MrHelloween.scr SERVICES.EXE File opened for modification C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\shell.exe 4k51k4.exe File opened for modification C:\Windows\SysWOW64\MrHelloween.scr CSRSS.EXE File created C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\shell.exe SERVICES.EXE File opened for modification C:\Windows\SysWOW64\MrHelloween.scr 4k51k4.exe File opened for modification C:\Windows\SysWOW64\MrHelloween.scr IExplorer.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\MrHelloween.scr WINLOGON.EXE -
Drops file in Windows directory 32 IoCs
description ioc Process File created C:\Windows\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\4k51k4.exe 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe File created C:\Windows\4k51k4.exe LSASS.EXE File opened for modification C:\Windows\msvbvm60.dll IExplorer.exe File created C:\Windows\4k51k4.exe SMSS.EXE File created C:\Windows\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\4k51k4.exe CSRSS.EXE File opened for modification C:\Windows\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\4k51k4.exe 4k51k4.exe File created C:\Windows\4k51k4.exe IExplorer.exe File created C:\Windows\4k51k4.exe SERVICES.EXE File created C:\Windows\msvbvm60.dll IExplorer.exe File created C:\Windows\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\4k51k4.exe IExplorer.exe File opened for modification C:\Windows\4k51k4.exe WINLOGON.EXE File opened for modification C:\Windows\msvbvm60.dll IExplorer.exe File created C:\Windows\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\msvbvm60.dll IExplorer.exe File created C:\Windows\4k51k4.exe 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe File created C:\Windows\4k51k4.exe WINLOGON.EXE File opened for modification C:\Windows\4k51k4.exe SMSS.EXE File opened for modification C:\Windows\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\msvbvm60.dll IExplorer.exe File created C:\Windows\msvbvm60.dll IExplorer.exe File created C:\Windows\4k51k4.exe 4k51k4.exe File created C:\Windows\msvbvm60.dll IExplorer.exe File created C:\Windows\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\4k51k4.exe LSASS.EXE File opened for modification C:\Windows\4k51k4.exe SERVICES.EXE File opened for modification C:\Windows\msvbvm60.dll IExplorer.exe File created C:\Windows\4k51k4.exe CSRSS.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 32 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" CSRSS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\MRHELL~1.SCR" LSASS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\MRHELL~1.SCR" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ SMSS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ CSRSS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" SERVICES.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" LSASS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" WINLOGON.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ WINLOGON.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ 4k51k4.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\MRHELL~1.SCR" 4k51k4.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" SERVICES.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ LSASS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" SMSS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\MRHELL~1.SCR" WINLOGON.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ SERVICES.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" LSASS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" SMSS.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ IExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\MRHELL~1.SCR" IExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" IExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" IExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" WINLOGON.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\MRHELL~1.SCR" SMSS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 4k51k4.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\MRHELL~1.SCR" CSRSS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" CSRSS.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\MRHELL~1.SCR" SERVICES.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" 4k51k4.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile SMSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" WINLOGON.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command CSRSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command CSRSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" WINLOGON.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 4k51k4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" CSRSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 4k51k4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command WINLOGON.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" WINLOGON.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" CSRSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 4k51k4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" WINLOGON.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command CSRSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 4k51k4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 4k51k4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" SERVICES.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 4k51k4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" SMSS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" SMSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command CSRSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command LSASS.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile WINLOGON.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" WINLOGON.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe -
Suspicious behavior: GetForegroundWindowSpam 7 IoCs
pid Process 2828 4k51k4.exe 2164 CSRSS.EXE 1440 WINLOGON.EXE 764 SERVICES.EXE 2624 IExplorer.exe 1184 LSASS.EXE 864 SMSS.EXE -
Suspicious use of SetWindowsHookEx 57 IoCs
pid Process 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 2828 4k51k4.exe 2624 IExplorer.exe 1440 WINLOGON.EXE 2164 CSRSS.EXE 764 SERVICES.EXE 1184 LSASS.EXE 864 SMSS.EXE 336 4k51k4.exe 2412 4k51k4.exe 2404 IExplorer.exe 748 4k51k4.exe 1652 WINLOGON.EXE 2384 IExplorer.exe 3004 4k51k4.exe 888 4k51k4.exe 1088 4k51k4.exe 1948 IExplorer.exe 2956 WINLOGON.EXE 2724 CSRSS.EXE 2576 WINLOGON.EXE 2628 IExplorer.exe 2708 IExplorer.exe 2684 IExplorer.exe 1932 WINLOGON.EXE 2740 SERVICES.EXE 2516 WINLOGON.EXE 3024 CSRSS.EXE 1916 4k51k4.exe 1056 SERVICES.EXE 2880 LSASS.EXE 1920 CSRSS.EXE 2908 CSRSS.EXE 2496 LSASS.EXE 3012 WINLOGON.EXE 1944 IExplorer.exe 1940 CSRSS.EXE 2008 SERVICES.EXE 2952 SERVICES.EXE 484 SMSS.EXE 2964 LSASS.EXE 2960 LSASS.EXE 320 CSRSS.EXE 928 SMSS.EXE 2860 SERVICES.EXE 1472 SMSS.EXE 1040 WINLOGON.EXE 1532 SERVICES.EXE 1980 LSASS.EXE 2376 SMSS.EXE 2160 LSASS.EXE 1140 SMSS.EXE 1080 CSRSS.EXE 2436 SMSS.EXE 2116 SERVICES.EXE 1564 LSASS.EXE 2936 SMSS.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2984 wrote to memory of 2828 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 28 PID 2984 wrote to memory of 2828 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 28 PID 2984 wrote to memory of 2828 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 28 PID 2984 wrote to memory of 2828 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 28 PID 2984 wrote to memory of 2624 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 29 PID 2984 wrote to memory of 2624 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 29 PID 2984 wrote to memory of 2624 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 29 PID 2984 wrote to memory of 2624 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 29 PID 2984 wrote to memory of 1440 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 30 PID 2984 wrote to memory of 1440 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 30 PID 2984 wrote to memory of 1440 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 30 PID 2984 wrote to memory of 1440 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 30 PID 2984 wrote to memory of 2164 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 31 PID 2984 wrote to memory of 2164 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 31 PID 2984 wrote to memory of 2164 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 31 PID 2984 wrote to memory of 2164 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 31 PID 2984 wrote to memory of 764 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 32 PID 2984 wrote to memory of 764 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 32 PID 2984 wrote to memory of 764 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 32 PID 2984 wrote to memory of 764 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 32 PID 2984 wrote to memory of 1184 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 33 PID 2984 wrote to memory of 1184 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 33 PID 2984 wrote to memory of 1184 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 33 PID 2984 wrote to memory of 1184 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 33 PID 2984 wrote to memory of 864 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 34 PID 2984 wrote to memory of 864 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 34 PID 2984 wrote to memory of 864 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 34 PID 2984 wrote to memory of 864 2984 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe 34 PID 2828 wrote to memory of 336 2828 4k51k4.exe 35 PID 2828 wrote to memory of 336 2828 4k51k4.exe 35 PID 2828 wrote to memory of 336 2828 4k51k4.exe 35 PID 2828 wrote to memory of 336 2828 4k51k4.exe 35 PID 2624 wrote to memory of 2412 2624 IExplorer.exe 36 PID 2624 wrote to memory of 2412 2624 IExplorer.exe 36 PID 2624 wrote to memory of 2412 2624 IExplorer.exe 36 PID 2624 wrote to memory of 2412 2624 IExplorer.exe 36 PID 2828 wrote to memory of 2404 2828 4k51k4.exe 37 PID 2828 wrote to memory of 2404 2828 4k51k4.exe 37 PID 2828 wrote to memory of 2404 2828 4k51k4.exe 37 PID 2828 wrote to memory of 2404 2828 4k51k4.exe 37 PID 2828 wrote to memory of 1652 2828 4k51k4.exe 39 PID 2828 wrote to memory of 1652 2828 4k51k4.exe 39 PID 2828 wrote to memory of 1652 2828 4k51k4.exe 39 PID 2828 wrote to memory of 1652 2828 4k51k4.exe 39 PID 1440 wrote to memory of 748 1440 WINLOGON.EXE 40 PID 1440 wrote to memory of 748 1440 WINLOGON.EXE 40 PID 1440 wrote to memory of 748 1440 WINLOGON.EXE 40 PID 1440 wrote to memory of 748 1440 WINLOGON.EXE 40 PID 2624 wrote to memory of 2384 2624 IExplorer.exe 38 PID 2624 wrote to memory of 2384 2624 IExplorer.exe 38 PID 2624 wrote to memory of 2384 2624 IExplorer.exe 38 PID 2624 wrote to memory of 2384 2624 IExplorer.exe 38 PID 1440 wrote to memory of 1948 1440 WINLOGON.EXE 41 PID 1440 wrote to memory of 1948 1440 WINLOGON.EXE 41 PID 1440 wrote to memory of 1948 1440 WINLOGON.EXE 41 PID 1440 wrote to memory of 1948 1440 WINLOGON.EXE 41 PID 2164 wrote to memory of 888 2164 CSRSS.EXE 42 PID 2164 wrote to memory of 888 2164 CSRSS.EXE 42 PID 2164 wrote to memory of 888 2164 CSRSS.EXE 42 PID 2164 wrote to memory of 888 2164 CSRSS.EXE 42 PID 764 wrote to memory of 3004 764 SERVICES.EXE 43 PID 764 wrote to memory of 3004 764 SERVICES.EXE 43 PID 764 wrote to memory of 3004 764 SERVICES.EXE 43 PID 764 wrote to memory of 3004 764 SERVICES.EXE 43 -
System policy modification 1 TTPs 40 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" IExplorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" WINLOGON.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System LSASS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer SMSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System CSRSS.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" CSRSS.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System SMSS.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" SMSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 4k51k4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System IExplorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" SERVICES.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" CSRSS.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer IExplorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer WINLOGON.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" WINLOGON.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" WINLOGON.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" LSASS.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" LSASS.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" SMSS.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" 4k51k4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer CSRSS.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" CSRSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer SERVICES.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer LSASS.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SMSS.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 4k51k4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 4k51k4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System WINLOGON.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SERVICES.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 4k51k4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System SERVICES.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" LSASS.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe"C:\Users\Admin\AppData\Local\Temp\7ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2984 -
C:\Windows\4k51k4.exeC:\Windows\4k51k4.exe2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2828 -
C:\Windows\4k51k4.exeC:\Windows\4k51k4.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:336
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2404
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1652
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2724
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2740
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2880
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:928
-
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2624 -
C:\Windows\4k51k4.exeC:\Windows\4k51k4.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2412
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2384
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2956
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2908
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2952
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2960
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2376
-
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1440 -
C:\Windows\4k51k4.exeC:\Windows\4k51k4.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:748
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1948
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2576
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3024
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1056
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2496
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:484
-
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2164 -
C:\Windows\4k51k4.exeC:\Windows\4k51k4.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:888
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2684
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3012
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:320
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1532
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2160
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1140
-
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:764 -
C:\Windows\4k51k4.exeC:\Windows\4k51k4.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3004
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2708
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2516
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1920
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2008
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2964
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1472
-
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1184 -
C:\Windows\4k51k4.exeC:\Windows\4k51k4.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1088
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2628
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1932
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1940
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2860
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1980
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2436
-
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:864 -
C:\Windows\4k51k4.exeC:\Windows\4k51k4.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1916
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1944
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1040
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1080
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2116
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1564
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2936
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5c25f175512c55bc3bb1f0dfd840721ba
SHA1d62052356aad808c960f28a50f26be3a914c9267
SHA256def594fdc3bd8d977e00defe1ffe798bd0ef07ceb506c9a0dd314a374356264f
SHA512ed2aa2cf93f9c956e753d66a67a742163ca4af47e5ad5ceab4f3de3bc5f5aa56b1948ed618e4c2a6968826abacaff8d79450f9bc75e37b035c3499133cba997a
-
Filesize
91KB
MD5c34c7e1008f34b2c43d1f3a0f83a7d1f
SHA136a33ca1a3514474473112132fddf88dbcb5b3cc
SHA256dc3ee684106fc7cc114bdef71672b7e62c92103d492f261d87311905d25c97b3
SHA512eb8c3f356640d7667e1d27d8297f496af522841a6bfb249e2da80f763fad3db220a8cc3c4f53c32185df4e5090b8044828f23f1f940f1e765b71b27ec276ad7c
-
Filesize
91KB
MD5ce378980fbd8b61e45e81083f4070ccb
SHA1a3f18ddb1dd9b243442e9eb2ee6cedc6d7d44309
SHA256f0cb29be9754f8fdeeb8b71ba1fed2e351666275b7c487119b7d6b6fc0af5f1f
SHA512e5cf6d86b4221de9f0c50942d052abd32d348a5ca0eb95354083a8551c3cc9cc41413ec6fe96e0ba6fa2ff79b68ddd5f1169dbcc55ed3c503f52cc53d7db4e3d
-
Filesize
91KB
MD5b4cad15c8cea05b9e6b0f2aaf9e28b9a
SHA1f0834d1b0e9bef01d348afbaea9a5feb4bcafd7d
SHA256db9f8876f018ef9fdf7038351c3c1a85f9ff23b2c4185e0b5e97ebbb3d547a1b
SHA51268d8fe5840a2dd6c07115054969185c4df0457fed21f295786875dcaa0ddf7be54e79772dd5c9ce676f586917c62a565a009e06c68cc85bf9de20576d6f4828c
-
Filesize
442B
MD5001424d7974b9a3995af292f6fcfe171
SHA1f8201d49d594d712c8450679c856c2e8307d2337
SHA256660ecfcd91ba19959d0c348724da95d7fd6dd57359898e6e3bcce600ff3c797d
SHA51266ec4330b9a9961a2926516ec96d71e3311f67a61e6ac3070303453d26fa4fdc9524296f583c0e2179414f1a0d795cedbd094a83f5ecd3f1faa0cccfe4276657
-
Filesize
91KB
MD59c09e2f30c0290b6718fea7ea74fd0b9
SHA148ed169778adfc6c299fa125353a67d833a6d753
SHA2567ce86218a3bc1096d15b49f6bc5abdd49c27c344f4133bfd21a00d8ebdb66085
SHA51288e39d8d4fe30b1a8a85a800ed316da93d0fe026a92b173d33811321bcf7ac41fd87ebecc33163c9abc4f389587cb353289279ca2f5ac4df1970e815526699bc
-
Filesize
91KB
MD598894d7acdddf283ca18b1d11e4e1ee8
SHA1aa4626051456015b87fc0dcd86995d2f09973b5e
SHA256fc7e6db021a672dda85695d416aabce43266a51e5d5357b612a6d26ed6ed9905
SHA512c0aac03746b4712b39203fde8b15ceabb00d82a11cc7867e838c3fc8c0cc7f478273fc53d800310dca8e06b7ad9e2673c02da2d6f0d7942fe4dbba209d992913
-
Filesize
91KB
MD58bf9162b71abd6310aeaf8e7e617bc18
SHA13309eda10fe73a829ed192726fd5e80dee44fe23
SHA25610199952291d34d9395ab346b463bcaedfd6d1d562bfb0cddbfc90f212ce8ff8
SHA51207d92885bea8141b85808eb29e9b61d9e2df9aeae8f7f1d2ac5f61e81c1d6f384a7ed9a1c982968ddc8e69a5fbe9242a1e56ecc9ab9c71ac7a46e11af3b21d7f
-
Filesize
91KB
MD5734af80c72fad747674e45a59bdc27a4
SHA13baa2e1670f51c2880129353b1391d90eb26771e
SHA2563605a7ed9914a588c5bf66f67bee71739db821bfa290d3b3a8aab44d5191be60
SHA512f7f482b8f97a079860654530ec498007facf891bfc2981f96b59483da6aefb402b10b19c7dc19862832d9258e3409b6002196be4c286c77c3592c912903f72ee
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
91KB
MD598917d55ac8214ffb0d6029d973bff8b
SHA18fccabc447f44ff7c41291f1bdc4212a4c4b228e
SHA2566df4a97e95417f18bef6402bf618759bb2af4b434ec69c5b857163385d3ca233
SHA51227fbff8193bc92ef0ad0b6250de6bb282acb072eac995042d1ef788ca206967415101648d0f2faf35f600ec7e5c97a1e44ff787ffb919d1b07875bead9a04a68
-
Filesize
91KB
MD595ae7d534aad8c10f97e9181ace9efb1
SHA18882b0d226e456dde828a87f334a38c3d56ff697
SHA256f91b0a56527b0a166b12c420001effc219ece7bca73bce1aa037d7a0006ea613
SHA512e40c7d00d54cc8a0791804e65f6234573eaa066b10d24255b76ebde7e6d85c15f46bda0242c0def5cfde91435fb8e96d64a22abe706597996e225c2a3e52a11f
-
Filesize
91KB
MD5e2b7955b6275bb0fa0cd0727953c95ce
SHA1e34d5614c0d8702d934362229b50c8e7e1601a8c
SHA256c3ba4e77e3a27e14ba1cbbbc8801a457f399da39fccf928663614339bfb49bca
SHA51230bff5c7057b2b678a176b9b50ed3f0b3ea9695963e1a7898b0ca5dd7b73b40fbcb9fffab7b2d7b171d2d0e70d6e2e21493bce0ddb570944dba40c88088289e2
-
Filesize
91KB
MD544ee00601248825c36434d93b8d46ee9
SHA1d1c251d2264b1fef072a1740c3a7ae8cdc32f894
SHA2564f289406162f395778cba9e8453c149f92792b5ac6688c8d6ef449e3825ffdd7
SHA51206587a0d85c6b9a415aa0d0440c16642961d3aefd74f37c98c26a17c3886bf06a0caece8d3158918b81bfb20dc07a44ed9164dff7ed14ea3a1d5f0f41ac69cdc
-
Filesize
91KB
MD5db7e836a229df17da983dd0f50395b27
SHA1e2ee1fc625f8e3e3fc5d3731e620c2dc9a6fd30d
SHA2564fac07dc7f34fee063d72591063707ad24f41ca813065084e11397473b686f36
SHA512abefb5d3cbc855701c640688cdd9addaa2f736e3adb82a5cbe591d4876c79284a35e122bb849afbeb4ed42ff0024e12bb20bfe7df6ac7f24cbca5278df146c01
-
Filesize
640B
MD55d142e7978321fde49abd9a068b64d97
SHA170020fcf7f3d6dafb6c8cd7a55395196a487bef4
SHA256fe222b08327bbfb35cbd627c0526ba7b5755b02ce0a95823a4c0bf58e601d061
SHA5122351284652a9a1b35006baf4727a85199406e464ac33cb4701a6182e1076aaff022c227dbe4ad6e916eba15ebad08b10719a8e86d5a0f89844a163a7d4a7bbf9
-
Filesize
221B
MD5eac89efdcfea825026dfab7138c6bea4
SHA18f72066ea7dd029348abda8efcffbd5df407d9ab
SHA256a0dd10de1158a4d05ea916c190bf95dc4c53ae3851c47ab8449a9ce96943334f
SHA51253be6131110d45808a26f442cf3da2244a9380e5f5747e0498bd8fcf54dec9cf4a230c413b0e54b5caaf9eb222f78f3932733f2479cb6b591613af41dc3e2f98
-
Filesize
91KB
MD55e3c6e27dfc036b4555b2c0eeec25c6b
SHA18199cb448c783321989061120d1c45cb61d34135
SHA256ddd113f06681eff3053cff7b83ce8989ba153af8c3b801ed942549622b24b594
SHA512b1afff080587be2dc1f0aae1a1b167746318ecf755654286275bb148738621cf0d589dbec08b57819e76beeabf480bd48c7dd4c4c5f3c553e8b1eacfb2c8ff55
-
Filesize
91KB
MD515e1eff45734aea49ca12da96c29f2ac
SHA13bcd877d38ac1c1ada1508335c0c036060bcfb69
SHA256c92150d523fecc16ea253495bcfc2ce6d911c2bf6acc93f95857f9fc1fda417e
SHA512e226cc5a2ea7f46b06050392ba9c3f8e103ffe086c1084041b3ded57ae1d85517932724733f26a6d39ac1eaca2f1a1fdba2e65b9abfd02a36c7808d645241aab
-
Filesize
91KB
MD5eb1d4df2e49c41b0a43f4564aa824647
SHA1de4afbd4dc91c79b574eb0da05c8aaf7065ec073
SHA256b45555a8e7cb17413b7d8e161253dfb3ee1e0f3c470e0955f2bb2ce4fa920df8
SHA5127a18dcaf7fdfeefa92837fc1994772cfd4f7bb26919ba52ea8f745b42ff725a9acaf5ccef021ecffb682fde74120bf5c0f6bd929f7e868e50cfa6b73d75204fd
-
Filesize
91KB
MD52d23739480ec9a07b1cbe567c0fd6926
SHA1778fa724cebc6f3a5f9e770c0c60b7e26218d77b
SHA256f7dc250070355349be8cf997ad2ed0431f55dd5e1a8985e29103f95db6541b0a
SHA512fa21e2171859b974eca9a030eddc556e1dbabdde6fc5c0c6b3367bc6ba01aff439ecae1a770408d2b57d867e504a777e88f5614729462780ef84c69e8d990ef6
-
Filesize
91KB
MD512290203fbc7e07f7b4eec816504091b
SHA1a6148bb3e077c4b16d53991802f5e41c9c76312e
SHA2565b34382b07f729a1b68242a90d08f5f012260fa438ce94d4807fc1d901e05722
SHA51279e355856021b32399cab116d5dd497805dab1aff98d9c31e363b9cedfdc0f383ec47fb5b2232616e2fa3f4a104d82bdc97b973db2ab20848d0331192bc4f66e
-
Filesize
91KB
MD5875592a763daaa29afd21c6e2005f985
SHA182ed605bf8c46e95aeccc80224b0cfa454be6aec
SHA2566c480b23cce4fd6a8b5896cf675959a1cd8c3f540565ace2d57ec262a4352318
SHA5128c54750a0a6d1c5de8c986e4652804382f8a5d2bb21ec9653f34dcee3146762fd348bfff2f582a1a92fffcab7912ed3365e82a237e86ffe42c8b35843aebe061