5bc197699e3178aaa6ecb8e69d95417475bcd13305d50011f944a25170c251e9

Analysis

max time kernel
112s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4198a5a515d9a1a35a04fac9b05d77c0N.exe
Size

91KB
MD5

4198a5a515d9a1a35a04fac9b05d77c0
SHA1

c53c2370944447c37c4efb6df3a1597410e44835
SHA256

5bc197699e3178aaa6ecb8e69d95417475bcd13305d50011f944a25170c251e9
SHA512

58d52b219f51312d933c06455dbed6482144a99e710eacf0ad9b2412767b8e9aa88ec7a06ad0a3b71ceb6bad4d3902a80fbe019f6ae9339143ea5da2cb58cdca
SSDEEP

1536:XRsjdLaslqdBXvTUL0Hnouy8Vj1RsjdLaslqdBXvTUL0Hnouy8Vje:XOJKqsout91OJKqsout9e

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	4198a5a515d9a1a35a04fac9b05d77c0N.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	4198a5a515d9a1a35a04fac9b05d77c0N.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	4198a5a515d9a1a35a04fac9b05d77c0N.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	4198a5a515d9a1a35a04fac9b05d77c0N.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 12 IoCs

pid	Process
2324	xk.exe
332	IExplorer.exe
2024	WINLOGON.EXE
2672	CSRSS.EXE
2560	SERVICES.EXE
2200	xk.exe
2284	IExplorer.exe
2516	WINLOGON.EXE
2128	CSRSS.EXE
2512	SERVICES.EXE
1772	LSASS.EXE
1684	SMSS.EXE

Loads dropped DLL 20 IoCs

pid	Process
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	4198a5a515d9a1a35a04fac9b05d77c0N.exe

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2884-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000018b89-8.dat	upx
behavioral1/files/0x0007000000018bd4-109.dat	upx
behavioral1/memory/2324-113-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0009000000018b54-114.dat	upx
behavioral1/memory/2884-121-0x0000000000540000-0x000000000056F000-memory.dmp	upx
behavioral1/memory/332-126-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x00040000000192ad-127.dat	upx
behavioral1/memory/2024-139-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0004000000019380-140.dat	upx
behavioral1/memory/2884-147-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2672-148-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2672-152-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0004000000019438-155.dat	upx
behavioral1/memory/2560-162-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2560-182-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2884-214-0x0000000000540000-0x000000000056F000-memory.dmp	upx
behavioral1/memory/2284-226-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2200-225-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2516-244-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2128-255-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0004000000019461-267.dat	upx
behavioral1/files/0x0004000000019485-276.dat	upx
behavioral1/memory/1772-275-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2512-264-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1684-286-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2284-233-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2884-436-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	4198a5a515d9a1a35a04fac9b05d77c0N.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	F:\desktop.ini	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File created	F:\desktop.ini	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened for modification	C:\desktop.ini	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File created	C:\desktop.ini	4198a5a515d9a1a35a04fac9b05d77c0N.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\E:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\G:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\I:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\J:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\K:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\N:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\O:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\V:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\Y:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\B:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\M:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\S:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\T:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\U:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\H:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\L:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\P:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\Q:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\R:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\W:	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened (read-only)	\??\X:	4198a5a515d9a1a35a04fac9b05d77c0N.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE
File created	C:\Windows\SysWOW64\shell.exe	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File created	C:\Windows\SysWOW64\Mig2.scr	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\shell.exe	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE
File opened for modification	C:\Windows\xk.exe	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File created	C:\Windows\xk.exe	4198a5a515d9a1a35a04fac9b05d77c0N.exe
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OUTLOOK.EXE

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	4198a5a515d9a1a35a04fac9b05d77c0N.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E8-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DA-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D87E7E17-6897-11CE-A6C0-00AA00608FAA}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DA-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F7-0000-0000-C000-000000000046}\ = "OlkInfoBarEvents"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067356-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063040-0000-0000-C000-000000000046}\ = "_Folders"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E6-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FB-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063089-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063078-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F7-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067352-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063009-0000-0000-C000-000000000046}\ = "Panes"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063098-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EF-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063023-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DA-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E3-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C5-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063085-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063062-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303F-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063021-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FB-0000-0000-C000-000000000046}\ = "_FromRssFeedRuleCondition"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E2-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063073-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307C-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300F-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067367-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063071-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307C-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EF-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F9-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C7-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063079-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303F-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A1-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F2-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E7-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309C-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063107-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063077-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309A-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067353-0000-0000-C000-000000000046}\ = "OlkFrameHeaderEvents"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D0-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D1-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063089-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063008-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063044-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F0-0000-0000-C000-000000000046}\ = "_NavigationGroup"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063035-0000-0000-C000-000000000046}\ = "_TaskItem"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063095-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A8-0000-0000-C000-000000000046}\ = "ItemProperties"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A7-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006305B-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063097-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063022-0000-0000-C000-000000000046}\ = "_JournalItem"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063087-0000-0000-C000-000000000046}\ = "Selection"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303A-0000-0000-C000-000000000046}\ = "ItemEvents"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B0-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063020-0000-0000-C000-000000000046}\ = "_DocumentItem"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F4-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D87E7E17-6897-11CE-A6C0-00AA00608FAA}\TypeLib	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2100	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2100	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2100	OUTLOOK.EXE
2100	OUTLOOK.EXE
2100	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2100	OUTLOOK.EXE
2100	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe
2324	xk.exe
332	IExplorer.exe
2024	WINLOGON.EXE
2672	CSRSS.EXE
2560	SERVICES.EXE
2200	xk.exe
2284	IExplorer.exe
2516	WINLOGON.EXE
2128	CSRSS.EXE
2512	SERVICES.EXE
1772	LSASS.EXE
1684	SMSS.EXE
2100	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2324	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	29
PID 2884 wrote to memory of 2324	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	29
PID 2884 wrote to memory of 2324	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	29
PID 2884 wrote to memory of 2324	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	29
PID 2884 wrote to memory of 332	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	30
PID 2884 wrote to memory of 332	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	30
PID 2884 wrote to memory of 332	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	30
PID 2884 wrote to memory of 332	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	30
PID 2884 wrote to memory of 2024	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	31
PID 2884 wrote to memory of 2024	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	31
PID 2884 wrote to memory of 2024	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	31
PID 2884 wrote to memory of 2024	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	31
PID 2884 wrote to memory of 2672	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	32
PID 2884 wrote to memory of 2672	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	32
PID 2884 wrote to memory of 2672	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	32
PID 2884 wrote to memory of 2672	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	32
PID 2884 wrote to memory of 2560	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	33
PID 2884 wrote to memory of 2560	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	33
PID 2884 wrote to memory of 2560	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	33
PID 2884 wrote to memory of 2560	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	33
PID 2884 wrote to memory of 2200	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	34
PID 2884 wrote to memory of 2200	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	34
PID 2884 wrote to memory of 2200	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	34
PID 2884 wrote to memory of 2200	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	34
PID 2884 wrote to memory of 2284	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	35
PID 2884 wrote to memory of 2284	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	35
PID 2884 wrote to memory of 2284	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	35
PID 2884 wrote to memory of 2284	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	35
PID 2884 wrote to memory of 2516	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	36
PID 2884 wrote to memory of 2516	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	36
PID 2884 wrote to memory of 2516	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	36
PID 2884 wrote to memory of 2516	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	36
PID 2884 wrote to memory of 2128	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	37
PID 2884 wrote to memory of 2128	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	37
PID 2884 wrote to memory of 2128	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	37
PID 2884 wrote to memory of 2128	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	37
PID 2884 wrote to memory of 2512	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	38
PID 2884 wrote to memory of 2512	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	38
PID 2884 wrote to memory of 2512	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	38
PID 2884 wrote to memory of 2512	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	38
PID 2884 wrote to memory of 1772	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	39
PID 2884 wrote to memory of 1772	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	39
PID 2884 wrote to memory of 1772	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	39
PID 2884 wrote to memory of 1772	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	39
PID 2884 wrote to memory of 1684	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	40
PID 2884 wrote to memory of 1684	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	40
PID 2884 wrote to memory of 1684	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	40
PID 2884 wrote to memory of 1684	2884	4198a5a515d9a1a35a04fac9b05d77c0N.exe	40

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	4198a5a515d9a1a35a04fac9b05d77c0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	4198a5a515d9a1a35a04fac9b05d77c0N.exe

C:\Users\Admin\AppData\Local\Temp\4198a5a515d9a1a35a04fac9b05d77c0N.exe
"C:\Users\Admin\AppData\Local\Temp\4198a5a515d9a1a35a04fac9b05d77c0N.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2884
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2324
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:332
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2024
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2672
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2560
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2200
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2284
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2516
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2128
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2512
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1772
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1684

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

Filesize
1KB

MD5
48dd6cae43ce26b992c35799fcd76898

SHA1
8e600544df0250da7d634599ce6ee50da11c0355

SHA256
7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

SHA512
c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

Download Submit
C:\Users\Admin\AppData\Local\services.exe

Filesize
91KB

MD5
4198a5a515d9a1a35a04fac9b05d77c0

SHA1
c53c2370944447c37c4efb6df3a1597410e44835

SHA256
5bc197699e3178aaa6ecb8e69d95417475bcd13305d50011f944a25170c251e9

SHA512
58d52b219f51312d933c06455dbed6482144a99e710eacf0ad9b2412767b8e9aa88ec7a06ad0a3b71ceb6bad4d3902a80fbe019f6ae9339143ea5da2cb58cdca

Download Submit
C:\Windows\xk.exe

Filesize
91KB

MD5
c8d0e6c463d4464e794fd2f78fb78692

SHA1
a791c07d72ddcc659e44414deb0e323ca36bae51

SHA256
688feae64c1ab5e5c94c34238125994a797e6f62a3095825c810900cd7f8daa3

SHA512
45bc8d933801f179533de81896cafe46e0cf5076f6d0f5f577ebc48b3dba03f9d3cc2f35a4dffc381bdd03d63227d5ef66ac9dc831f0ed132b5e75adb91de936

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
91KB

MD5
a29c08f40ad1768f6355731c6e938067

SHA1
aad9d743ad5c23c44a4b5d003138801c7470899c

SHA256
7a4e3fc436156a8c5087524e165f638e182dd22253003d7315a5d606f98376e0

SHA512
edca26063d7ea418e6beb5f69a753dd4b5b3de5ec82e2c748465f6bd5037fc7c783d5e0cf1dd98c8035f4a65c433405efc7321207f97848865dcece0bc3c09bd

Download Submit
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
91KB

MD5
1c0bf8e3981da3fb7745c8077577d30a

SHA1
e4ad5b2c7a8309323aefaa7dd40f756a5c4a7b71

SHA256
9bc0397df0fcf89442d2a15c8b581aede19c78d154e601cf3e8e9416dd281344

SHA512
6f7f818f7baeaed69bb2759abe4c20ccb01891c8e2f4edfb01c7c1cbf211d2645d849740afae08ecbcc9164192ca055e27d513faf83e2c36f01ab27c9a79211e

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
91KB

MD5
9f73da11ea51ad107b81614cf708ba0e

SHA1
3110b6ae186770edc00b6147f51a69a82a8d87af

SHA256
d1026b2837d0fb7597cfabc392f65933ba23028288fce73f4318e18df0121628

SHA512
8c2e50de89733f712e50ea7f5ffb379621d26e2acb1071a5361ff3a8261e91a3d18ea7cb85f4dd51aa84f7bd67fab83a7fec9e99b034795ac41211f01ce8bdb6

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
91KB

MD5
b09d05d6fb6aa8b09936fa25658807bd

SHA1
7cb7b13b7f016158eecb5f794d2e2fcf69a43cd0

SHA256
6b92403cf0282fe67a6e4b823cc66e6530bbe9846be27dd48874c0501e63c3de

SHA512
3c351b7148bd91119eb566709e69469698ca7386ba7c0fcb29ea8f0ee1b23be88ef383257f99c76a08f20024a40f7713c4011fade1df00cb9c030866de626c5f

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
91KB

MD5
8bd7532a1b7dd0f9f0bae318d1707d31

SHA1
79f94842856eed9bc815e2adcc49180694c91d3f

SHA256
d71dd86cec10d45dd4e04c865dec605beff62ca33ecf4a1cb9912406c2197cac

SHA512
3259a192df74a98c493125336d598ad3394bf0101f22e92ab2d83ad6e67804553e6590d3be7f5e7cfe73c8408b7bedad8081a5f052881955fc8b953a51fa6a0e

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
a6accb724733a9b8bfca421bfd04345a

SHA1
1fade6638218e1f55a3512aefc18e81c3ff0fea0

SHA256
9c85ee72fd3f437c68cb4564cede8cbc4a266456aff8b4a7a5cc4a98a8bede87

SHA512
1d48695901f0efa9a5f3fe62efde3cb31d1979d1a046498ee636736f1e2058cd58e7551af6d54933cb8b36911599d50d6e6e5dc32cd55fb96b78575ce4ba6370

Download Submit
memory/332-126-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1684-286-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1772-275-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2024-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2100-311-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2128-255-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2200-225-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2284-233-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2284-226-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2324-113-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2512-264-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2516-244-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2560-162-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2560-182-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2672-152-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2672-148-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2884-147-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2884-133-0x0000000000540000-0x000000000056F000-memory.dmp

Filesize
188KB

Download
memory/2884-213-0x0000000000540000-0x000000000056F000-memory.dmp

Filesize
188KB

Download
memory/2884-161-0x0000000000540000-0x000000000056F000-memory.dmp

Filesize
188KB

Download
memory/2884-160-0x0000000000540000-0x000000000056F000-memory.dmp

Filesize
188KB

Download
memory/2884-260-0x0000000000540000-0x000000000056F000-memory.dmp

Filesize
188KB

Download
memory/2884-227-0x0000000000540000-0x000000000056F000-memory.dmp

Filesize
188KB

Download
memory/2884-214-0x0000000000540000-0x000000000056F000-memory.dmp

Filesize
188KB

Download
memory/2884-283-0x0000000000540000-0x000000000056F000-memory.dmp

Filesize
188KB

Download
memory/2884-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2884-134-0x0000000000540000-0x000000000056F000-memory.dmp

Filesize
188KB

Download
memory/2884-121-0x0000000000540000-0x000000000056F000-memory.dmp

Filesize
188KB

Download
memory/2884-122-0x0000000000540000-0x000000000056F000-memory.dmp

Filesize
188KB

Download
memory/2884-108-0x0000000000540000-0x000000000056F000-memory.dmp

Filesize
188KB

Download
memory/2884-110-0x0000000000540000-0x000000000056F000-memory.dmp

Filesize
188KB

Download
memory/2884-436-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2884-437-0x0000000000540000-0x000000000056F000-memory.dmp

Filesize
188KB

Download