27080635d1991d91b96301df10aed3a4de691b92bbbfd8edfba5c7067ae695be

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe
Size

160KB
MD5

5d5be7dd142dc8db0ca31fa92a11679d
SHA1

e94fbbe3a30ada943bdf659ae3866ad63c1477c6
SHA256

27080635d1991d91b96301df10aed3a4de691b92bbbfd8edfba5c7067ae695be
SHA512

d25dedb40bb5395aae14ff3564710fb176eb7d2742f7998d81bd229a48ff193f65a723278b6f9459e037a9b2b4c96788642587666d92d75f3adb1d59befdcdcb
SSDEEP

1536:MEBNxaGXzoe8MBZXLXSaDgN6VqttfQ84dFj5OeZedavR5O8wtpCnRKVgbAxr4a6:MeyGXpDrVt8aAda0SBd

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

UAC bypass 3 TTPs 5 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1"	svchost.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	svchost.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ifw2000.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kis8.0.0.506latam.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npscheck.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpf.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwtool16.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwntdwmo.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sbserv.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avupgsvc.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\espwatch.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumphive.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hacktracersetup.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navsched.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcdsetup.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csinject.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ecmd.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nav80try.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perswf.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsaa.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav32.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav8win32eng.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luall.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\periscope.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swnetsup.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mdll.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msinfo32.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonalm2601.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symproxysvc.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpm.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-stopw.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpdos32.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530wtbyb.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netscanpro.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvlaunch.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wimmun32.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tauscan.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vfsetup.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wimmun32.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pf2.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\callmsi.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ss3edit.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpf9x206.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpinst.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shn.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monsysnt.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nai_vs_stat.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ifw2000.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\platin.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldpromenu.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Safari.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navdx.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmb32.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_findviru.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHttpSrv.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostsChk.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smc.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\azonealarm.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npf40_tw_98_nt_me_2k.exe	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Netscape.exe	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
456	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NVIDIA Media Center Library = "C:\\Users\\Admin\\Admin1\\winlogon.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NVIDIA Media Center Library = "C:\\Users\\Admin\\Admin1\\winlogon.exe"	svchost.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 456 set thread context of 2024	456	winlogon.exe	90
PID 456 set thread context of 4632	456	winlogon.exe	91
PID 456 set thread context of 4476	456	winlogon.exe	97
PID 456 set thread context of 4136	456	winlogon.exe	100
PID 456 set thread context of 1732	456	winlogon.exe	103
PID 456 set thread context of 3516	456	winlogon.exe	106
PID 456 set thread context of 2428	456	winlogon.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
4220	2024	WerFault.exe	90
1200	4476	WerFault.exe	97
3036	4136	WerFault.exe	100
1700	1732	WerFault.exe	103
2632	3516	WerFault.exe	106

Modifies Internet Explorer settings 1 TTPs 50 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://2-6-p-2-1-7-4-1-7.-2-z-m-n-x-6-3-6-3-9-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info/y-l-m-6-4-i-d-e-1-7-x-m-p-t-6-6-h-m-3-1-6-9-d-4-6-d-9-4-l-x-1-9-q-3-7-3-a-0-4-8-x-a-3-1-r-x-g-y-3-l-l-3-x-2-8-4-0-a-y-r-o-1-u-p-5-l-1-d-p-b-0-e-5-p-l-0-3-3-6-9-7-t-q-7-j-z-9-d-4-i-r-2-j-x-4-b-0-0-t-h-4-o-1-3-1-s-j-h-w-4-1-9-7-r-2-s-e-i-6-x-z-h-3-h-1-3-3-6-f-3-w-0-v-u-1-t-e-p-3-2-4-g-z-d-6-l-l-j-6-5-i-x-z-e-e-e-1-6-t-4-4-5-7-r-z-0-0-4-6-o-p-1-l-1-l-t-7-h-n-a-0-x-1-4-6-2-4-c-6-g-w-9-8-0-q-k-1-o-j-8-0-t-m-e-z-4-7-c-c-m-u-9-5-q-4-7-2-r-l-3-8-2-9-2-u-0-u-5-q-p-1-1-4-5-e-"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Software\Microsoft\Internet Explorer\Main	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://2-v-4-5-.a-6-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info/2-3-7-2-8-h-6-o-d-s-6-3-5-x-9-5-9-m-i-m-5-6-1-4-7-w-n-1-4-h-t-2-s-2-1-b-9-8-g-5-d-4-l-g-1-u-4-t-7-2-x-0-k-o-6-x-4-8-2-u-0-a-y-b-i-w-4-3-0-e-0-5-8-v-t-u-k-4-8-1-u-7-p-2-3-h-4-5-8-u-6-f-k-6-0-0-j-3-a-5-3-l-3-9-6-g-v-1-3-b-h-x-3-3-5-3-5-1-v-s-4-7-9-6-p-3-3-q-0-0-a-s-1-w-4-y-"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://2-6-p-2-1-7-4-1-7.-2-z-m-n-x-6-3-6-3-9-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info/y-l-m-6-4-i-d-e-1-7-x-m-p-t-6-6-h-m-3-1-6-9-d-4-6-d-9-4-l-x-1-9-q-3-7-3-a-0-4-8-x-a-3-1-r-x-g-y-3-l-l-3-x-2-8-4-0-a-y-r-o-1-u-p-5-l-1-d-p-b-0-e-5-p-l-0-3-3-6-9-7-t-q-7-j-z-9-d-4-i-r-2-j-x-4-b-0-0-t-h-4-o-1-3-1-s-j-h-w-4-1-9-7-r-2-s-e-i-6-x-z-h-3-h-1-3-3-6-f-3-w-0-v-u-1-t-e-p-3-2-4-g-z-d-6-l-l-j-6-5-i-x-z-e-e-e-1-6-t-4-4-5-7-r-z-0-0-4-6-o-p-1-l-1-l-t-7-h-n-a-0-x-1-4-6-2-4-c-6-g-w-9-8-0-q-k-1-o-j-8-0-t-m-e-z-4-7-c-c-m-u-9-5-q-4-7-2-r-l-3-8-2-9-2-u-0-u-5-q-p-1-1-4-5-e-"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://4-a-q-2-3.-w-o-1-b-s-c-8-9-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info/5-6-a-0-1-1-6-3-1-i-3-7-f-z-n-j-9-e-s-2-x-6-q-0-1-l-9-0-u-d-4-o-6-5-w-0-6-j-3-2-a-2-v-1-4-6-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://h-u-0.-9-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info/1-d-5-3-g-g-l-6-h-f-y-1-o-2-5-l-y-n-4-q-d-8-b-l-4-h-5-0-9-e-2-3-2-d-1-s-y-g-5-1-c-7-2-e-r-4-5-b-b-2-2-3-6-o-h-5-j-x-o-3-8-k-z-i-n-2-1-k-k-1-z-3-g-0-0-2-p-g-0-9-5-i-5-q-d-3-0-4-7-3-1-7-w-2-2-6-2-7-u-8-8-2-d-n-y-h-4-5-6-t-g-h-r-9-o-7-7-j-q-4-8-y-o-4-0-a-m-q-u-9-h-d-q-v-1-x-l-7-8-"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page = "http://s-f-b-3-1-0-s-9-n-9-4-o-r-4-6-n-0-e-g-.q-6-8-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info/7-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://a-y-3-2-y-8-b-g-4-0-u-h-v-9-1-m-5-b-x-k-5-o-7-l-t-v-5-.m-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info/9-i-p-1-0-5-z-4-7-9-b-9-1-4-d-8-9-h-w-0-8-e-u-8-i-3-q-u-5-4-d-4-x-5-2-u-b-1-6-8-9-3-r-9-1-4-1-p-1-p-3-l-0-y-m-k-b-k-9-5-0-1-x-h-8-0-1-a-y-0-y-5-8-0-1-q-5-x-h-p-l-h-2-o-d-c-w-2-5-w-1-f-a-i-9-m-c-z-5-d-w-5-a-5-4-i-s-h-q-x-7-b-d-6-8-7-4-x-2-q-y-9-6-x-s-2-n-h-8-s-v-k-c-7-2-i-2-k-6-d-5-7-9-2-n-v-3-e-e-6-u-u-o-0-o-9-k-c-8-z-4-4-1-0-9-b-s-a-3-o-e-l-5-7-0-l-u-e-0-d-5-5-7-0-r-j-2-5-3-f-f-t-z-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://4-g-p-i-t-b-u-e-2-b-2-0-6-h-2-u.-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info/w-n-9-k-g-m-f-9-s-p-3-e-6-v-1-1-m-6-4-r-s-j-7-8-t-8-p-4-j-y-b-j-e-8-h-3-0-7-1-1-7-2-i-j-3-0-j-7-6-e-t-8-b-5-4-h-m-u-7-4-i-e-j-8-v-6-b-w-5-9-1-9-t-4-h-f-1-j-3-1-4-2-5-8-f-9-m-m-h-j-b-f-6-6-5-e-1-e-l-2-9-m-s-p-9-4-4-0-5-9-i-m-8-h-c-t-k-6-0-t-4-8-6-0-p-4-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Local Page = "http://0-1-w-4-2-.q-g-4-d-3-1-k-8-4-1-p-3-z-3-5-0-4-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info/w-3-2-1-s-j-0-i-3-7-x-3-n-j-s-0-3-b-q-0-g-6-6-7-x-7-2-d-n-1-m-8-j-2-8-3-h-9-u-r-1-5-w-v-6-p-5-1-f-5-7-y-0-7-0-0-m-p-4-j-f-3-7-9-2-h-1-9-y-6-4-0-z-l-9-8-4-z-x-g-p-d-r-3-1-0-5-o-0-6-a-2-s-y-r-e-q-6-1-g-z-6-e-q-9-u-4-p-2-t-9-7-6-f-n-6-t-9-e-j-x-h-d-y-g-a-k-w-y-n-k-n-r-3-i-7-2-7-s-3-d-2-x-7-s-9-p-9-0-l-3-u-2-q-0-w-d-x-f-2-h-f-9-9-2-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://c.-g-p-x-6-0-2-e-9-q-u-j-4-0-9-g-j-3-n-b-b-6-j-1-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info/o-u-l-h-h-9-6-3-4-9-2-2-k-2-r-w-t-a-7-w-u-8-g-s-y-0-n-v-4-3-7-2-6-1-s-1-7-m-9-1-x-9-4-d-f-4-m-3-8-0-k-3-r-r-6-a-8-4-1-n-g-5-u-n-7-3-v-t-e-1-n-o-k-2-6-h-b-3-t-9-9-8-a-r-7-q-5-a-9-g-8-7-2-p-j-0-0-4-0-k-8-b-7-s-e-1-x-b-g-c-7-9-n-9-x-e-d-b-2-y-m-7-8-6-q-5-u-0-v-9-r-i-0-n-y-z-m-8-q-q-9-x-q-5-p-i-2-c-e-d-y-b-r-2-j-4-t-8-h-v-j-w-w-7-0-t-2-5-p-r-b-i-n-c-t-0-5-3-4-r-c-1-x-q-7-9-7-o-v-5-c-p-8-5-y-a-z-b-z-q-7-7-3-j-1-8-3-6-q-h-n-1-e-3-4-w-0-0-0-0-b-9-n-p-n-2-1-2-1-r-i-5-d-m-8-z-c-5-r-6-a-3-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://8-y-8-3-.c-3-9-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info/f-a-2-e-5-0-i-f-4-3-4-7-1-3-4-7-t-x-7-c-6-6-6-m-t-7-a-h-i-w-4-9-2-g-i-k-r-w-6-8-3-0-1-x-3-8-1-h-3-y-0-3-2-k-3-5-u-0-x-v-6-1-s-e-4-r-9-3-y-1-y-9-n-4-3-3-8-4-c-w-f-g-y-4-f-7-3-f-1-1-5-s-3-5-h-p-b-4-g-1-6-b-p-t-0-w-4-2-7-3-i-6-o-d-u-6-r-w-7-t-9-j-1-f-p-k-h-4-g-z-6-1-y-y-u-n-j-4-p-9-k-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://z-b-y-1-v-i-c-i-7-9-w-6-2-j-7-c.-q-b-7-3-8-2-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info/6-x-q-0-i-q-s-9-0-o-2-p-z-2-n-5-n-i-3-5-d-7-r-9-j-k-0-2-t-7-0-9-1-1-8-5-1-i-6-e-6-1-h-2-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page = "http://6-h-9-.u-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info/o-r-d-t-2-1-r-5-z-v-v-v-0-5-s-2-4-y-4-f-6-3-t-h-v-5-4-7-l-4-9-a-9-3-7-3-z-4-7-f-0-4-g-o-c-y-8-7-6-0-3-u-x-t-0-w-n-p-m-8-7-0-6-z-5-9-5-y-f-d-8-u-9-9-4-2-1-s-5-2-f-b-5-4-s-r-5-o-1-6-l-f-e-c-9-1-o-n-7-s-e-3-2-6-8-q-6-g-5-1-c-0-i-g-l-3-k-h-3-5-v-9-n-8-b-9-f-q-3-3-7-x-d-l-1-9-9-6-2-s-4-l-6-3-2-x-1-w-1-w-7-f-9-7-a-f-6-u-6-v-9-v-s-u-3-5-s-z-6-g-2-y-2-9-5-n-2-f-8-f-3-6-d-s-7-2-e-k-b-8-5-9-x-b-x-6-9-b-i-z-0-s-b-1-9-7-0-6-6-4-a-p-0-w-o-h-3-s-2-7-6-5-1-f-f-3-5-6-k-d-e-e-l-2-x-r-a-g-2-1-5-v-s-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page = "http://s-6-.6-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info/i-m-u-2-8-9-6-y-w-8-c-n-g-j-o-3-g-a-2-d-1-9-5-k-n-d-4-9-b-j-4-5-8-3-k-1-9-p-5-o-8-j-w-y-9-t-j-i-2-8-w-0-4-2-l-d-9-8-7-2-0-8-u-m-i-6-1-5-p-h-5-0-8-8-t-n-g-w-h-t-g-d-6-6-j-x-5-x-o-5-3-7-6-c-4-9-9-5-1-9-x-3-9-q-c-4-z-o-2-w-q-w-5-c-z-f-1-a-f-y-m-6-3-u-d-l-5-2-0-2-s-3-1-0-8-q-8-4-x-f-3-c-r-9-4-b-9-a-z-w-o-m-0-e-1-6-u-c-5-r-8-9-d-1-q-r-7-g-2-0-6-8-q-t-5-2-1-2-8-3-1-7-w-7-4-4-9-n-8-i-4-3-4-1-p-m-5-j-6-u-7-6-5-o-4-0-6-y-w-w-9-3-9-8-k-c-a-v-0-7-5-3-7-r-i-8-3-7-2-l-8-l-k-j-v-7-c-3-e-3-9-2-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://w-9-s-q-b.-j-z-4-9-9-w-4-1-0-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info/7-i-b-3-1-0-x-8-2-3-6-2-h-d-z-t-o-q-6-9-4-1-9-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://1-g-.8-4-h-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info/0-m-0-4-j-h-f-6-m-2-3-c-1-9-1-9-7-2-2-e-3-0-8-8-5-v-i-6-k-8-4-o-7-8-g-j-x-p-2-y-7-h-1-8-r-b-0-x-w-4-h-5-8-z-6-p-x-t-1-3-s-6-3-m-7-z-6-g-9-g-j-2-7-1-6-q-h-5-4-8-3-5-q-z-y-4-p-4-d-r-z-f-2-x-8-5-g-1-5-i-r-m-6-t-u-1-2-6-f-7-7-0-3-8-o-7-9-5-8-6-n-v-x-l-c-9-3-9-3-7-0-8-k-o-5-t-0-5-1-1-r-7-a-8-1-"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Software\Microsoft\Internet Explorer\Main	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Software\Microsoft\Internet Explorer\Main	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Local Page = "http://5.-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info/6-c-q-8-4-0-0-h-4-h-4-r-e-p-8-8-9-c-x-g-e-5-q-e-o-9-y-4-e-z-z-r-n-n-8-c-2-f-7-x-5-u-9-6-s-v-0-u-5-y-e-4-b-6-c-4-7-4-3-h-c-6-6-h-k-x-7-f-w-3-n-8-h-j-v-m-6-1-7-e-h-y-3-5-x-w-t-2-o-0-2-f-n-p-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Local Page = "http://1.-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info/2-1-i-f-5-v-j-q-e-4-y-8-v-7-b-5-a-l-r-u-2-9-9-m-4-0-9-d-z-z-d-1-l-k-q-4-6-5-z-w-1-a-o-p-1-8-b-8-8-o-z-k-3-d-2-v-i-9-k-2-p-9-5-p-4-l-5-n-4-f-m-3-m-l-3-0-6-x-5-4-r-q-0-8-h-3-5-5-7-y-1-2-5-c-6-m-6-6-3-n-c-0-d-4-n-a-p-q-6-d-s-6-7-9-e-m-f-u-d-y-a-f-m-3-d-n-n-b-2-c-2-7-9-e-2-2-5-0-5-m-3-7-8-s-i-s-5-l-l-7-g-f-3-a-q-9-5-m-n-6-3-2-q-n-d-y-9-a-r-7-4-w-a-1-h-v-q-e-k-a-2-4-2-q-9-p-8-g-0-h-8-j-k-1-6-0-a-q-r-d-h-h-5-c-x-l-1-2-z-6-a-m-t-c-1-4-c-2-k-4-8-e-w-o-5-f-m-m-u-4-5-7-p-a-d-i-g-y-7-h-n-3-r-a-i-0-m-"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Software\Microsoft\Internet Explorer\Main	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://2-7-k-e-2-5-m-6-7-u-1-.o-1-i-6-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info/3-l-k-6-9-9-6-3-f-x-w-0-8-f-r-g-q-2-z-4-v-o-p-m-7-q-6-j-l-9-9-3-8-8-v-v-5-6-j-4-k-n-9-9-m-x-x-k-2-8-6-a-5-5-s-2-j-0-t-s-3-4-3-3-d-t-3-9-x-x-l-0-z-t-t-v-3-g-0-d-u-d-p-6-9-2-j-6-n-e-7-2-6-t-v-x-m-m-f-2-b-0-e-h-2-w-l-z-o-5-4-q-o-3-z-7-l-8-t-y-l-3-6-c-4-c-6-k-f-3-6-0-3-2-u-5-k-c-2-6-m-9-2-f-u-v-c-h-1-u-1-i-3-t-z-6-a-s-a-c-n-l-a-5-0-8-5-1-7-t-o-1-3-v-7-c-s-s-2-t-3-d-8-b-6-6-u-0-6-v-f-2-6-d-l-z-i-c-7-1-k-9-5-5-j-i-f-5-q-h-5-2-h-g-9-k-3-3-l-6-6-u-5-0-9-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://h-u-0.-9-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info/1-d-5-3-g-g-l-6-h-f-y-1-o-2-5-l-y-n-4-q-d-8-b-l-4-h-5-0-9-e-2-3-2-d-1-s-y-g-5-1-c-7-2-e-r-4-5-b-b-2-2-3-6-o-h-5-j-x-o-3-8-k-z-i-n-2-1-k-k-1-z-3-g-0-0-2-p-g-0-9-5-i-5-q-d-3-0-4-7-3-1-7-w-2-2-6-2-7-u-8-8-2-d-n-y-h-4-5-6-t-g-h-r-9-o-7-7-j-q-4-8-y-o-4-0-a-m-q-u-9-h-d-q-v-1-x-l-7-8-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://b-b-5-.z-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info/2-y-6-h-s-p-h-d-b-4-4-3-r-8-t-1-s-w-y-1-4-b-c-1-7-3-1-4-b-u-7-5-d-3-h-k-1-b-p-1-u-h-p-5-f-d-5-1-0-0-7-3-j-4-9-p-6-v-r-8-6-7-d-f-1-x-4-2-6-z-a-s-t-8-3-8-9-j-5-c-t-5-2-3-5-k-x-s-7-1-v-s-q-8-s-0-m-x-2-a-6-o-r-x-1-l-0-7-2-8-v-j-x-6-p-l-3-f-3-q-k-5-9-1-f-h-u-2-m-o-1-9-g-d-y-1-e-g-s-h-1-8-7-d-u-4-c-v-x-c-l-q-9-h-h-l-q-4-q-1-j-1-3-i-u-x-z-n-1-5-7-x-c-r-n-6-7-3-a-t-m-2-4-a-n-6-0-8-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://2-6-p-2-1-7-4-1-7.-2-z-m-n-x-6-3-6-3-9-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info/y-l-m-6-4-i-d-e-1-7-x-m-p-t-6-6-h-m-3-1-6-9-d-4-6-d-9-4-l-x-1-9-q-3-7-3-a-0-4-8-x-a-3-1-r-x-g-y-3-l-l-3-x-2-8-4-0-a-y-r-o-1-u-p-5-l-1-d-p-b-0-e-5-p-l-0-3-3-6-9-7-t-q-7-j-z-9-d-4-i-r-2-j-x-4-b-0-0-t-h-4-o-1-3-1-s-j-h-w-4-1-9-7-r-2-s-e-i-6-x-z-h-3-h-1-3-3-6-f-3-w-0-v-u-1-t-e-p-3-2-4-g-z-d-6-l-l-j-6-5-i-x-z-e-e-e-1-6-t-4-4-5-7-r-z-0-0-4-6-o-p-1-l-1-l-t-7-h-n-a-0-x-1-4-6-2-4-c-6-g-w-9-8-0-q-k-1-o-j-8-0-t-m-e-z-4-7-c-c-m-u-9-5-q-4-7-2-r-l-3-8-2-9-2-u-0-u-5-q-p-1-1-4-5-e-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://r-4-3-4-p-q-9-s-g.-u-9-t-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info/3-l-k-6-9-9-6-3-f-x-w-0-8-f-r-g-q-2-z-4-v-o-p-m-7-q-6-j-l-9-9-3-8-8-v-v-5-6-j-4-k-n-9-9-m-x-x-k-2-8-6-a-5-5-s-2-j-0-t-s-3-4-3-3-d-t-3-9-x-x-l-0-z-t-t-v-3-g-0-d-u-d-p-6-9-2-j-6-n-e-7-2-6-t-v-x-m-m-f-2-b-0-e-h-2-w-l-z-o-5-4-q-o-3-z-7-l-8-t-y-l-3-6-c-4-c-6-k-f-3-6-0-3-2-u-5-k-c-2-6-m-9-2-f-u-v-c-h-1-u-1-i-3-t-z-6-a-s-a-c-n-l-a-5-0-8-5-1-7-t-o-1-3-v-7-c-s-s-2-t-3-d-8-b-6-6-u-0-6-v-f-2-6-d-l-z-i-c-7-1-k-9-5-5-j-i-f-5-q-h-5-2-h-g-9-k-3-3-l-6-6-u-5-0-9-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://r-4-y-u-d.-g-7-8-j-0-0-3-m-5-3-s-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info/n-t-7-7-3-x-6-7-1-9-h-o-b-4-0-6-u-5-d-w-3-c-l-d-j-2-q-0-8-0-x-e-g-8-k-u-4-u-r-1-0-l-3-0-5-b-g-4-4-3-m-w-k-8-k-9-6-2-i-t-u-i-d-6-z-y-m-i-6-z-6-v-x-n-u-o-c-o-4-c-h-3-j-5-r-0-l-d-e-a-q-7-9-6-l-0-y-j-f-7-b-t-7-1-0-5-9-4-0-2-z-x-4-t-0-1-3-9-t-c-d-t-u-e-r-1-1-v-k-i-v-d-a-3-3-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://h-u-0.-9-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info/1-d-5-3-g-g-l-6-h-f-y-1-o-2-5-l-y-n-4-q-d-8-b-l-4-h-5-0-9-e-2-3-2-d-1-s-y-g-5-1-c-7-2-e-r-4-5-b-b-2-2-3-6-o-h-5-j-x-o-3-8-k-z-i-n-2-1-k-k-1-z-3-g-0-0-2-p-g-0-9-5-i-5-q-d-3-0-4-7-3-1-7-w-2-2-6-2-7-u-8-8-2-d-n-y-h-4-5-6-t-g-h-r-9-o-7-7-j-q-4-8-y-o-4-0-a-m-q-u-9-h-d-q-v-1-x-l-7-8-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://9-3-f-7-h-h-3-1-l-4-4-g-i-a-9-b-e-7-4-3-8-e-7-0-7.-e-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info/2-h-z-7-x-2-p-9-8-r-r-q-1-d-g-i-a-0-7-l-0-w-3-8-2-0-p-3-7-0-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page = "http://2-q-c-q-1.-8-4-8-h-6-s-1-s-r-6-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info/g-g-8-q-b-2-n-7-y-t-l-l-l-e-r-9-4-6-9-6-3-u-6-j-8-u-v-z-5-3-l-0-u-z-x-0-c-n-5-3-w-5-2-9-3-b-5-y-9-x-y-0-x-d-k-8-k-u-q-t-n-1-1-0-5-f-a-y-2-n-e-d-a-i-c-5-n-g-1-r-w-6-1-z-7-3-x-p-2-y-r-7-9-2-6-0-6-1-k-5-9-5-q-m-6-3-j-l-1-9-p-m-2-h-u-7-2-s-j-0-7-m-f-b-9-c-c-g-3-z-j-b-2-t-1-5-z-9-g-w-6-m-e-q-m-9-c-6-5-k-0-i-0-q-m-0-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Local Page = "http://r-5-9-5-t-k-y-w-m-x-4-m-2-1-d-6-5-3.-q-8-z-y-j-j-f-p-u-8-2-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info/2-c-6-8-0-m-n-1-3-1-m-1-x-d-8-h-q-3-2-a-9-8-1-1-m-4-2-m-f-9-e-g-3-a-u-q-s-q-8-i-0-i-k-w-9-8-j-3-r-5-9-7-4-i-2-5-l-k-5-g-2-k-d-5-w-6-5-l-o-m-1-b-u-f-n-6-r-f-3-0-2-o-j-r-2-5-i-7-4-2-d-f-2-7-7-r-b-0-2-m-8-2-5-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://2-6-p-2-1-7-4-1-7.-2-z-m-n-x-6-3-6-3-9-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info/y-l-m-6-4-i-d-e-1-7-x-m-p-t-6-6-h-m-3-1-6-9-d-4-6-d-9-4-l-x-1-9-q-3-7-3-a-0-4-8-x-a-3-1-r-x-g-y-3-l-l-3-x-2-8-4-0-a-y-r-o-1-u-p-5-l-1-d-p-b-0-e-5-p-l-0-3-3-6-9-7-t-q-7-j-z-9-d-4-i-r-2-j-x-4-b-0-0-t-h-4-o-1-3-1-s-j-h-w-4-1-9-7-r-2-s-e-i-6-x-z-h-3-h-1-3-3-6-f-3-w-0-v-u-1-t-e-p-3-2-4-g-z-d-6-l-l-j-6-5-i-x-z-e-e-e-1-6-t-4-4-5-7-r-z-0-0-4-6-o-p-1-l-1-l-t-7-h-n-a-0-x-1-4-6-2-4-c-6-g-w-9-8-0-q-k-1-o-j-8-0-t-m-e-z-4-7-c-c-m-u-9-5-q-4-7-2-r-l-3-8-2-9-2-u-0-u-5-q-p-1-1-4-5-e-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://w.-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info/f-2-3-0-a-3-5-4-m-e-e-0-q-9-7-a-5-h-8-4-j-7-p-5-3-3-g-f-8-1-5-6-1-3-j-6-v-6-e-3-3-6-n-4-5-2-4-x-8-5-e-i-1-9-5-q-3-a-2-j-4-i-7-2-i-x-6-w-f-v-w-u-1-o-6-4-m-4-7-j-4-3-y-8-6-g-5-k-j-2-1-2-3-6-7-r-b-0-k-v-j-f-x-a-y-d-y-2-8-w-y-6-u-y-3-h-b-7-c-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://7-j.-z-q-d-7-7-1-3-6-4-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info/t-x-2-q-2-c-7-7-4-r-1-4-p-1-v-6-4-t-2-q-2-3-6-f-d-l-z-t-k-4-b-7-h-g-s-5-h-6-i-r-8-x-i-f-o-2-t-q-a-4-7-z-0-z-0-5-2-0-4-l-8-r-f-t-l-h-v-k-h-l-2-5-3-y-r-x-9-6-s-q-i-9-0-i-v-a-d-z-7-p-h-f-8-3-m-8-4-3-8-3-4-7-y-n-3-0-n-8-1-6-8-v-6-5-3-9-x-6-9-6-v-h-r-h-s-6-1-2-6-q-z-6-9-8-5-9-a-k-0-1-h-m-5-5-2-5-9-b-5-g-w-8-7-4-y-y-s-0-4-2-f-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://g-.4-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info/m-3-a-v-4-z-4-v-i-s-3-9-1-1-0-4-f-k-5-5-9-8-f-7-9-i-8-4-2-t-8-g-t-q-7-q-w-5-9-k-9-7-y-g-8-3-y-1-2-2-3-7-i-3-h-4-j-e-c-a-9-f-v-u-5-6-s-w-3-p-6-s-e-z-8-o-o-6-0-b-w-y-4-6-8-n-r-9-m-4-6-s-8-v-2-t-1-5-0-8-0-3-u-9-2-s-f-1-6-d-s-5-k-r-b-g-x-l-p-5-n-g-w-u-f-v-1-3-s-q-0-7-3-b-p-5-j-f-h-h-k-2-d-w-1-7-m-z-o-n-j-o-u-y-x-4-i-n-b-x-p-1-y-8-4-0-j-5-8-s-i-e-z-b-5-2-f-2-y-a-d-8-1-1-n-7-0-c-4-0-c-6-z-3-a-3-6-4-i-g-8-m-5-0-6-9-f-8-9-s-6-q-x-8-i-p-9-a-n-v-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://s-3-j-8-2-7-7-7-9-0-.y-0-0-c-r-1-i-g-5-h-7-3-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info/r-s-m-1-h-k-6-7-m-5-7-5-5-9-5-p-f-7-8-y-2-i-4-6-8-3-0-1-1-c-4-l-6-t-1-1-0-f-t-p-e-l-7-4-c-8-s-1-d-1-y-n-r-k-a-f-n-9-d-g-4-5-s-4-6-1-v-u-2-e-x-j-w-g-8-4-e-4-0-c-1-0-3-7-6-7-8-7-h-o-4-s-3-v-f-9-s-c-8-h-c-m-3-2-8-1-4-w-a-z-u-t-k-q-0-0-n-q-0-p-4-4-g-6-f-d-2-3-g-x-4-w-y-4-4-5-g-o-o-9-9-r-1-3-g-f-5-5-4-2-c-y-2-w-v-4-1-u-1-7-l-8-x-v-0-g-l-5-4-5-6-z-0-u-5-2-w-z-z-n-s-v-b-b-w-b-4-2-5-z-z-n-o-b-k-3-n-f-4-"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page = "http://u.-6-e-r-7-h-z-s-f-n-s-o-4-f-s-7-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info/5-p-9-j-9-n-7-0-k-q-5-p-k-8-g-0-8-e-9-3-3-x-y-i-0-j-1-0-7-i-o-0-6-o-r-2-w-e-1-3-6-j-c-1-d-s-8-a-9-7-3-7-i-4-l-7-9-7-6-5-3-c-5-5-3-8-3-f-m-s-2-u-w-5-d-s-1-m-8-0-6-u-x-f-e-z-8-1-b-r-8-f-4-9-0-f-6-6-3-3-d-i-4-4-k-3-a-o-8-4-k-4-g-n-v-b-e-7-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://3-0-5.-2-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info/6-e-4-j-s-8-9-v-3-3-9-r-8-6-5-0-2-2-a-w-i-5-n-4-5-v-2-z-8-2-0-7-k-p-e-e-5-u-k-7-p-2-8-y-4-4-2-5-9-6-l-0-h-w-2-k-6-9-3-3-s-s-4-0-0-5-3-2-s-0-3-f-s-1-3-a-5-1-4-0-6-r-l-o-7-p-n-z-v-g-1-7-0-1-q-m-t-2-g-7-5-u-d-4-a-k-o-2-h-8-o-a-4-6-i-s-9-y-7-4-2-z-y-2-2-7-t-l-7-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://t-m-w-d-q-o-9-y-7-3-2-1.-b-5-t-f-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info/g-0-7-n-2-l-4-0-g-s-7-b-9-8-4-8-5-8-1-g-9-k-5-x-8-2-b-s-p-6-i-n-e-9-s-i-4-d-u-d-t-2-7-d-k-u-0-4-d-p-x-o-6-w-6-5-a-8-h-1-4-q-1-5-l-1-2-r-o-w-6-9-6-o-h-3-u-l-2-5-1-7-h-n-2-m-j-e-t-n-g-7-k-4-7-d-j-v-5-v-u-y-i-x-h-a-r-y-j-x-h-f-0-5-n-3-e-5-a-z-h-j-1-u-r-f-h-4-d-3-8-a-l-5-a-e-v-u-d-c-3-5-3-t-8-3-x-4-q-h-w-2-w-q-1-6-5-f-0-8-a-v-i-m-t-z-0-9-n-e-8-1-d-n-8-4-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://w-b-j-1-3-w.-1-t-6-d-5-e-n-j-9-2-6-1-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info/k-6-5-u-t-s-7-z-w-9-5-4-i-o-8-k-n-0-7-v-d-y-6-9-8-2-j-p-i-7-b-x-4-w-a-5-g-9-1-6-n-v-4-t-4-e-k-w-1-1-7-n-v-8-4-n-t-9-b-j-l-y-h-8-e-v-0-f-6-5-z-e-3-5-o-0-0-0-y-h-4-0-4-e-5-d-x-1-0-p-d-2-1-6-6-8-7-t-0-z-2-q-m-w-p-g-1-4-3-5-7-y-8-b-2-c-5-0-c-9-8-4-u-j-r-z-4-f-m-y-f-c-e-m-9-z-5-h-3-3-s-x-a-c-l-l-i-n-b-x-i-4-5-7-g-c-3-3-u-e-o-p-7-x-w-j-5-7-n-8-q-z-g-3-b-y-5-4-x-7-j-8-9-p-2-6-8-6-i-8-b-9-i-a-z-o-4-m-6-4-q-g-1-5-2-"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Local Page = "http://1-f-q-t-7-n-2-n-9-f-2-q-p-7-u-9-u-a.-p-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info/i-c-6-o-r-3-3-j-y-0-3-4-5-s-g-c-4-r-d-v-f-6-i-x-7-5-q-r-a-4-9-i-a-6-s-e-t-6-o-g-4-9-p-7-3-8-a-6-u-a-6-c-b-c-3-9-u-j-o-e-j-6-8-5-5-w-f-1-9-d-9-4-l-s-u-m-v-e-5-r-0-2-r-8-e-8-6-4-h-b-5-f-5-3-5-l-e-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://8-6-y-y-1-.e-x-7-0-3-8-v-f-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info/6-u-e-x-n-d-q-b-o-c-r-l-3-l-0-8-0-0-2-5-r-7-g-7-0-1-v-b-e-0-z-b-g-a-6-8-x-r-"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Software\Microsoft\Internet Explorer\Main	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://r-4-3-4-p-q-9-s-g.-u-9-t-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info/3-l-k-6-9-9-6-3-f-x-w-0-8-f-r-g-q-2-z-4-v-o-p-m-7-q-6-j-l-9-9-3-8-8-v-v-5-6-j-4-k-n-9-9-m-x-x-k-2-8-6-a-5-5-s-2-j-0-t-s-3-4-3-3-d-t-3-9-x-x-l-0-z-t-t-v-3-g-0-d-u-d-p-6-9-2-j-6-n-e-7-2-6-t-v-x-m-m-f-2-b-0-e-h-2-w-l-z-o-5-4-q-o-3-z-7-l-8-t-y-l-3-6-c-4-c-6-k-f-3-6-0-3-2-u-5-k-c-2-6-m-9-2-f-u-v-c-h-1-u-1-i-3-t-z-6-a-s-a-c-n-l-a-5-0-8-5-1-7-t-o-1-3-v-7-c-s-s-2-t-3-d-8-b-6-6-u-0-6-v-f-2-6-d-l-z-i-c-7-1-k-9-5-5-j-i-f-5-q-h-5-2-h-g-9-k-3-3-l-6-6-u-5-0-9-"	svchost.exe

Modifies Internet Explorer start page 1 TTPs 10 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://9-6-3-x-9-4-9-6-7-h-3-c-1-6-9-7-o-6-v-0.-f-q-e-6-0-3-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info/q-5-2-j-g-6-q-1-8-x-7-g-9-9-s-8-4-4-1-2-x-4-0-m-4-z-5-6-v-q-2-r-f-u-z-t-q-j-0-5-4-2-x-h-6-6-l-5-v-v-9-f-2-p-v-a-5-5-0-t-2-w-s-9-9-5-3-h-m-d-v-h-r-c-3-n-i-4-2-4-4-9-n-4-1-9-2-x-n-8-y-1-7-i-i-n-1-b-r-2-a-e-3-3-y-8-2-g-g-5-h-8-s-9-1-f-8-u-l-i-6-c-4-g-q-2-3-7-z-5-1-8-n-7-8-f-k-r-8-7-6-j-8-y-t-b-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://7-l-u-e-3-m-7-6-i-s-.8-6-2-3-v-5-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info/s-8-u-6-3-d-s-4-9-q-e-0-x-6-n-1-m-u-1-p-3-v-9-0-9-8-e-f-d-x-2-6-4-o-c-8-7-f-w-o-0-w-y-9-f-k-3-s-h-1-a-b-m-i-p-3-8-t-8-x-y-1-w-y-8-5-1-p-e-1-5-0-i-4-a-4-0-c-f-u-w-w-7-b-r-7-w-g-1-1-w-1-3-i-6-w-2-c-1-z-u-1-y-3-e-s-6-r-7-9-k-6-o-h-5-w-2-4-z-9-c-h-o-k-u-v-v-s-7-l-j-2-8-5-i-p-7-v-z-x-4-d-e-o-5-q-7-t-l-5-2-u-y-k-e-s-i-8-s-7-7-8-0-v-7-4-9-0-j-0-k-j-3-9-t-t-e-1-5-z-m-i-w-z-x-7-9-k-3-6-5-1-n-o-l-u-n-2-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://6-2-3-c-u-w.-v-g-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info/b-5-s-f-g-h-g-0-x-7-8-6-q-1-r-h-g-y-1-2-0-e-6-d-l-n-r-7-j-s-u-d-9-3-7-k-7-e-d-0-6-5-9-5-6-e-x-v-4-k-d-t-7-7-o-7-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://5-2-.4-7-h-o-r-1-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info/j-h-r-m-k-7-m-6-8-0-l-1-s-t-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://t-y-1-r-p-8-0-w-.8-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info/k-9-w-q-d-x-7-8-y-7-4-1-x-3-i-w-8-5-u-7-t-3-m-8-h-y-g-t-3-g-1-9-n-6-4-7-6-l-r-l-1-9-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://y-9-3.-u-2-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info/q-0-7-g-s-a-x-m-f-j-2-7-1-w-6-3-k-h-m-4-y-6-c-1-q-8-g-2-g-0-s-j-q-2-p-1-j-8-c-r-h-y-t-i-x-0-c-9-w-6-1-l-p-2-9-3-s-i-s-g-o-u-w-3-5-g-h-u-b-r-q-l-4-v-e-h-t-y-b-7-j-8-x-i-j-9-2-2-9-g-e-s-0-h-6-4-7-2-0-l-a-u-8-b-8-3-u-v-9-6-6-8-2-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://i-o-9-n-z-0-5-7.-6-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info/9-p-q-m-n-b-1-u-7-3-8-8-d-7-5-j-b-v-0-v-9-v-p-r-0-n-m-9-7-j-3-7-c-2-9-7-k-"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://w-7-z-8-8-x-9-s-1-f-l-.k-q-1-6-3-p-7-6-a-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info/v-3-y-p-1-a-9-6-3-8-d-d-4-5-u-8-a-x-9-y-r-o-8-o-n-3-7-3-9-7-1-7-7-l-i-7-8-8-a-j-8-p-6-z-2-z-c-y-g-5-9-0-1-k-2-0-p-d-6-1-r-7-4-5-8-6-p-w-5-u-2-6-0-m-q-x-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://h-9-l-o-0-3-6-0-p.-3-3-v-7-1-7-g-4-d-2-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info/1-f-n-t-b-i-5-6-3-r-6-e-4-o-x-9-0-b-5-k-d-j-s-s-b-m-u-8-5-m-0-1-k-2-2-0-2-7-5-3-4-x-x-x-e-m-v-x-q-h-g-p-5-b-w-p-u-4-8-4-7-1-9-3-y-t-"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://q-4-6-9-6-r-9-b-9-u-9-0-x-5-d-a-h-2-3-1-w-4-8.-y-c-d-7-s-g-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info/i-3-3-6-9-1-6-9-l-7-4-w-d-7-a-k-j-6-c-7-g-2-g-4-b-3-q-n-7-x-2-1-r-6-n-7-5-9-0-k-r-5-o-f-s-9-0-8-7-f-7-9-l-v-8-0-v-0-g-i-4-q-m-8-c-9-6-7-3-7-y-5-a-u-t-b-4-8-q-m-h-t-4-h-9-q-e-i-w-3-0-s-j-g-m-0-8-j-0-8-5-c-q-6-v-6-g-5-6-7-0-r-i-o-p-w-w-z-j-"	svchost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4548	5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe
Token: SeDebugPrivilege	4548	5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe
Token: SeDebugPrivilege	456	winlogon.exe
Token: SeBackupPrivilege	2024	svchost.exe
Token: SeBackupPrivilege	4476	svchost.exe
Token: SeBackupPrivilege	4136	svchost.exe
Token: SeBackupPrivilege	3516	svchost.exe
Token: SeBackupPrivilege	2428	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4548	5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe
456	winlogon.exe
2024	svchost.exe
4632	svchost.exe
4476	svchost.exe
4136	svchost.exe
3516	svchost.exe
2428	svchost.exe
2428	svchost.exe
2428	svchost.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 456	4548	5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe	87
PID 4548 wrote to memory of 456	4548	5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe	87
PID 4548 wrote to memory of 456	4548	5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe	87
PID 456 wrote to memory of 2024	456	winlogon.exe	90
PID 456 wrote to memory of 2024	456	winlogon.exe	90
PID 456 wrote to memory of 2024	456	winlogon.exe	90
PID 456 wrote to memory of 2024	456	winlogon.exe	90
PID 456 wrote to memory of 2024	456	winlogon.exe	90
PID 456 wrote to memory of 2024	456	winlogon.exe	90
PID 456 wrote to memory of 2024	456	winlogon.exe	90
PID 456 wrote to memory of 2024	456	winlogon.exe	90
PID 456 wrote to memory of 4632	456	winlogon.exe	91
PID 456 wrote to memory of 4632	456	winlogon.exe	91
PID 456 wrote to memory of 4632	456	winlogon.exe	91
PID 456 wrote to memory of 4632	456	winlogon.exe	91
PID 456 wrote to memory of 4632	456	winlogon.exe	91
PID 456 wrote to memory of 4632	456	winlogon.exe	91
PID 456 wrote to memory of 4632	456	winlogon.exe	91
PID 456 wrote to memory of 4632	456	winlogon.exe	91
PID 456 wrote to memory of 4476	456	winlogon.exe	97
PID 456 wrote to memory of 4476	456	winlogon.exe	97
PID 456 wrote to memory of 4476	456	winlogon.exe	97
PID 456 wrote to memory of 4476	456	winlogon.exe	97
PID 456 wrote to memory of 4476	456	winlogon.exe	97
PID 456 wrote to memory of 4476	456	winlogon.exe	97
PID 456 wrote to memory of 4476	456	winlogon.exe	97
PID 456 wrote to memory of 4476	456	winlogon.exe	97
PID 456 wrote to memory of 4136	456	winlogon.exe	100
PID 456 wrote to memory of 4136	456	winlogon.exe	100
PID 456 wrote to memory of 4136	456	winlogon.exe	100
PID 456 wrote to memory of 4136	456	winlogon.exe	100
PID 456 wrote to memory of 4136	456	winlogon.exe	100
PID 456 wrote to memory of 4136	456	winlogon.exe	100
PID 456 wrote to memory of 4136	456	winlogon.exe	100
PID 456 wrote to memory of 4136	456	winlogon.exe	100
PID 456 wrote to memory of 1732	456	winlogon.exe	103
PID 456 wrote to memory of 1732	456	winlogon.exe	103
PID 456 wrote to memory of 1732	456	winlogon.exe	103
PID 456 wrote to memory of 1732	456	winlogon.exe	103
PID 456 wrote to memory of 1732	456	winlogon.exe	103
PID 456 wrote to memory of 1732	456	winlogon.exe	103
PID 456 wrote to memory of 1732	456	winlogon.exe	103
PID 456 wrote to memory of 1732	456	winlogon.exe	103
PID 456 wrote to memory of 3516	456	winlogon.exe	106
PID 456 wrote to memory of 3516	456	winlogon.exe	106
PID 456 wrote to memory of 3516	456	winlogon.exe	106
PID 456 wrote to memory of 3516	456	winlogon.exe	106
PID 456 wrote to memory of 3516	456	winlogon.exe	106
PID 456 wrote to memory of 3516	456	winlogon.exe	106
PID 456 wrote to memory of 3516	456	winlogon.exe	106
PID 456 wrote to memory of 3516	456	winlogon.exe	106
PID 456 wrote to memory of 2428	456	winlogon.exe	109
PID 456 wrote to memory of 2428	456	winlogon.exe	109
PID 456 wrote to memory of 2428	456	winlogon.exe	109
PID 456 wrote to memory of 2428	456	winlogon.exe	109
PID 456 wrote to memory of 2428	456	winlogon.exe	109
PID 456 wrote to memory of 2428	456	winlogon.exe	109
PID 456 wrote to memory of 2428	456	winlogon.exe	109
PID 456 wrote to memory of 2428	456	winlogon.exe	109

C:\Users\Admin\AppData\Local\Temp\5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\Admin1\winlogon.exe
  "C:\Users\Admin\Admin1\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Windows\SysWOW64\svchost.exe
    0
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Event Triggered Execution: Image File Execution Options Injection
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2024
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 464
      4⤵
      Program crash
      PID:4220
- - C:\Windows\SysWOW64\svchost.exe
    0
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4632
- - C:\Windows\SysWOW64\svchost.exe
    0
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Event Triggered Execution: Image File Execution Options Injection
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4476
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 476
      4⤵
      Program crash
      PID:1200
- - C:\Windows\SysWOW64\svchost.exe
    0
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Event Triggered Execution: Image File Execution Options Injection
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4136
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 468
      4⤵
      Program crash
      PID:3036
- - C:\Windows\SysWOW64\svchost.exe
    0
    3⤵
    PID:1732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 84
      4⤵
      Program crash
      PID:1700
- - C:\Windows\SysWOW64\svchost.exe
    0
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Event Triggered Execution: Image File Execution Options Injection
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3516
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 488
      4⤵
      Program crash
      PID:2632
- - C:\Windows\SysWOW64\svchost.exe
    0
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Drops file in Drivers directory
    - Event Triggered Execution: Image File Execution Options Injection
    - Adds Run key to start application
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2024 -ip 2024
1⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4476 -ip 4476
1⤵
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4136 -ip 4136
1⤵
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1732 -ip 1732
1⤵
PID:784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3516 -ip 3516
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Admin1\winlogon.exe

Filesize
160KB

MD5
5d5be7dd142dc8db0ca31fa92a11679d

SHA1
e94fbbe3a30ada943bdf659ae3866ad63c1477c6

SHA256
27080635d1991d91b96301df10aed3a4de691b92bbbfd8edfba5c7067ae695be

SHA512
d25dedb40bb5395aae14ff3564710fb176eb7d2742f7998d81bd229a48ff193f65a723278b6f9459e037a9b2b4c96788642587666d92d75f3adb1d59befdcdcb

Download Submit
memory/2024-15-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2024-17-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2024-18-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2024-27-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4136-39-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4136-40-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4476-33-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4632-26-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads