Overview

overview

10

Static

static

3

ed20ab7529...18.exe

windows7-x64

10

ed20ab7529...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    20/09/2024, 07:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed20ab7529bfbc3acc36961a2aeedbbe_JaffaCakes118.exe

  • Size

    196KB

  • MD5

    ed20ab7529bfbc3acc36961a2aeedbbe

  • SHA1

    da455cac68b180fd9af7b28f272a65a6b828764a

  • SHA256

    8d4f9938192f1c00817343c150f9042e6463e34c90c1f58c4c5aeafd9e4fe995

  • SHA512

    7e18e93977079c7658f681b70c4cf593edc6d49691ef0732af86393fda8cae86b19ec7d27275bb3172f514366288de0a28fee11937437c1b5cad77c902347f5a

  • SSDEEP

    3072:ZGBT753Q+RgWgMlIx1ZiXjb6aEF6D0NM9voeLNZ3mEl0:Y753RgWg4aAXjb6aEFfooeLNZo

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 36 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 15 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 15 IoCs
    evasion
  • Disables RegEdit via registry modification 18 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 18 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 54 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 12 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 64 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 54 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 18 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 36 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed20ab7529bfbc3acc36961a2aeedbbe_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ed20ab7529bfbc3acc36961a2aeedbbe_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3032
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2624
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1968
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:704
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2172
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Modifies WinLogon
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2104
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 372
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1516
          • C:\Windows\SysWOW64\Shell.exe
            "C:\Windows\system32\Shell.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:284
          • C:\Windows\SysWOW64\Shell.exe
            "C:\Windows\system32\Shell.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of SetWindowsHookEx
            PID:1512
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2304
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2200
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2708
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 380
          4⤵
          • Program crash
          PID:2344
          • C:\Windows\SysWOW64\Shell.exe
            "C:\Windows\system32\Shell.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of SetWindowsHookEx
            PID:2116
          • C:\Windows\SysWOW64\Shell.exe
            "C:\Windows\system32\Shell.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of SetWindowsHookEx
            PID:1988
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2872
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Modifies WinLogon
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2696
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 372
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2856
          • C:\Windows\SysWOW64\Shell.exe
            "C:\Windows\system32\Shell.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2760
          • C:\Windows\SysWOW64\Shell.exe
            "C:\Windows\system32\Shell.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of SetWindowsHookEx
            PID:1604
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1984
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2112
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:1528
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2148
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2060
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:912
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 372
          4⤵
          • Program crash
          PID:2472
          • C:\Windows\SysWOW64\Shell.exe
            "C:\Windows\system32\Shell.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1272
          • C:\Windows\SysWOW64\Shell.exe
            "C:\Windows\system32\Shell.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:700
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:928
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:1252
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1652
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          PID:236
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1672
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:888
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:332
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          PID:820
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Drops file in System32 directory
          PID:1912
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2916
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1964
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
            PID:2652
          • C:\Windows\Tiwi.exe
            C:\Windows\Tiwi.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:716
          • C:\Windows\SysWOW64\IExplorer.exe
            C:\Windows\system32\IExplorer.exe
            4⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            PID:1500
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:980
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:984
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
            4⤵
              PID:988
            • C:\Windows\Tiwi.exe
              C:\Windows\Tiwi.exe
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1612
            • C:\Windows\SysWOW64\IExplorer.exe
              C:\Windows\system32\IExplorer.exe
              4⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2288
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
              4⤵
              • Modifies WinLogon for persistence
              • Modifies visibility of file extensions in Explorer
              • Modifies visiblity of hidden/system files in Explorer
              • Disables RegEdit via registry modification
              • Disables cmd.exe use via registry modification
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Modifies WinLogon
              • System Location Discovery: System Language Discovery
              • Modifies Control Panel
              • Modifies Internet Explorer settings
              • Modifies Internet Explorer start page
              • Modifies registry class
              • System policy modification
              PID:2396
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 372
                5⤵
                • Program crash
                PID:868
                • C:\Windows\SysWOW64\Shell.exe
                  "C:\Windows\system32\Shell.exe"
                  6⤵
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  PID:1516
                • C:\Windows\SysWOW64\Shell.exe
                  "C:\Windows\system32\Shell.exe"
                  6⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  PID:2692
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:912
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
              4⤵
                PID:1884
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:908
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1440
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2800
            • C:\Windows\Tiwi.exe
              C:\Windows\Tiwi.exe
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1464
            • C:\Windows\SysWOW64\IExplorer.exe
              C:\Windows\system32\IExplorer.exe
              3⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1648
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2228
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1568
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
              3⤵
              • Modifies WinLogon for persistence
              • Modifies visibility of file extensions in Explorer
              • Modifies visiblity of hidden/system files in Explorer
              • Disables RegEdit via registry modification
              • Disables cmd.exe use via registry modification
              • Executes dropped EXE
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Modifies WinLogon
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Modifies Control Panel
              • Modifies Internet Explorer settings
              • Modifies Internet Explorer start page
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:560
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 372
                4⤵
                • Program crash
                PID:1604
                • C:\Windows\SysWOW64\Shell.exe
                  "C:\Windows\system32\Shell.exe"
                  5⤵
                  • Modifies WinLogon for persistence
                  • Modifies visibility of file extensions in Explorer
                  • Modifies visiblity of hidden/system files in Explorer
                  • Disables RegEdit via registry modification
                  • Disables cmd.exe use via registry modification
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • Modifies WinLogon
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Modifies Control Panel
                  • Modifies Internet Explorer settings
                  • Modifies Internet Explorer start page
                  • Modifies registry class
                  • Suspicious behavior: GetForegroundWindowSpam
                  • System policy modification
                  PID:2656
                  • C:\Windows\Tiwi.exe
                    C:\Windows\Tiwi.exe
                    6⤵
                      PID:1156
                    • C:\Windows\SysWOW64\IExplorer.exe
                      C:\Windows\system32\IExplorer.exe
                      6⤵
                      • Drops file in System32 directory
                      • Drops file in Windows directory
                      PID:1584
                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
                      6⤵
                        PID:3048
                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
                        6⤵
                          PID:1656
                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
                          6⤵
                          • System Location Discovery: System Language Discovery
                          PID:1268
                  • C:\Windows\Tiwi.exe
                    C:\Windows\Tiwi.exe
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2672
                  • C:\Windows\SysWOW64\IExplorer.exe
                    C:\Windows\system32\IExplorer.exe
                    3⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1600
                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2224
                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
                    3⤵
                    • Modifies WinLogon for persistence
                    • Modifies visibility of file extensions in Explorer
                    • Modifies visiblity of hidden/system files in Explorer
                    • Disables RegEdit via registry modification
                    • Disables cmd.exe use via registry modification
                    • Executes dropped EXE
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • Modifies WinLogon
                    • Drops file in Windows directory
                    • Modifies Control Panel
                    • Modifies Internet Explorer settings
                    • Modifies Internet Explorer start page
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:692
                    • C:\Windows\Tiwi.exe
                      C:\Windows\Tiwi.exe
                      4⤵
                        PID:112
                      • C:\Windows\SysWOW64\IExplorer.exe
                        C:\Windows\system32\IExplorer.exe
                        4⤵
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:2404
                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
                        4⤵
                        • Modifies WinLogon for persistence
                        • Modifies visibility of file extensions in Explorer
                        • Modifies visiblity of hidden/system files in Explorer
                        • Disables RegEdit via registry modification
                        • Disables cmd.exe use via registry modification
                        • Modifies system executable filetype association
                        • Adds Run key to start application
                        • Modifies WinLogon
                        • Modifies Control Panel
                        • Modifies Internet Explorer settings
                        • Modifies Internet Explorer start page
                        • Modifies registry class
                        • System policy modification
                        PID:2136
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 356
                          5⤵
                          • Program crash
                          PID:1992
                          • C:\Windows\SysWOW64\Shell.exe
                            "C:\Windows\system32\Shell.exe"
                            6⤵
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:1508
                          • C:\Windows\SysWOW64\Shell.exe
                            "C:\Windows\system32\Shell.exe"
                            6⤵
                            • Drops file in System32 directory
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:2028
                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
                        4⤵
                          PID:2148
                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:896
                        • C:\Windows\Tiwi.exe
                          C:\Windows\Tiwi.exe
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:2328
                        • C:\Windows\SysWOW64\IExplorer.exe
                          C:\Windows\system32\IExplorer.exe
                          4⤵
                          • Drops file in Windows directory
                          PID:2168
                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
                          4⤵
                            PID:2716
                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:2988
                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:2864
                          • C:\Windows\Tiwi.exe
                            C:\Windows\Tiwi.exe
                            4⤵
                              PID:2932
                            • C:\Windows\SysWOW64\IExplorer.exe
                              C:\Windows\system32\IExplorer.exe
                              4⤵
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:1828
                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
                              4⤵
                              • Modifies WinLogon for persistence
                              • Modifies visibility of file extensions in Explorer
                              • Modifies visiblity of hidden/system files in Explorer
                              • Disables RegEdit via registry modification
                              • Disables cmd.exe use via registry modification
                              • Modifies system executable filetype association
                              • Adds Run key to start application
                              • Enumerates connected drives
                              • Modifies WinLogon
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              • Modifies Control Panel
                              • Modifies Internet Explorer settings
                              • Modifies Internet Explorer start page
                              • Modifies registry class
                              • Suspicious behavior: GetForegroundWindowSpam
                              • System policy modification
                              PID:3060
                              • C:\Windows\Tiwi.exe
                                C:\Windows\Tiwi.exe
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:1412
                              • C:\Windows\SysWOW64\IExplorer.exe
                                C:\Windows\system32\IExplorer.exe
                                5⤵
                                • Drops file in System32 directory
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:1152
                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
                                5⤵
                                  PID:2072
                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
                                  5⤵
                                    PID:2848
                                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
                                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
                                    5⤵
                                      PID:2792
                                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
                                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
                                    4⤵
                                      PID:2912
                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
                                      4⤵
                                        PID:1420
                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2596
                                    • C:\Windows\Tiwi.exe
                                      C:\Windows\Tiwi.exe
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2376
                                    • C:\Windows\SysWOW64\IExplorer.exe
                                      C:\Windows\system32\IExplorer.exe
                                      3⤵
                                      • Drops file in System32 directory
                                      • Drops file in Windows directory
                                      PID:348
                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1956
                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3004
                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
                                      3⤵
                                        PID:2036
                                      • C:\Windows\Tiwi.exe
                                        C:\Windows\Tiwi.exe
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2720
                                      • C:\Windows\SysWOW64\IExplorer.exe
                                        C:\Windows\system32\IExplorer.exe
                                        3⤵
                                        • Drops file in System32 directory
                                        • Drops file in Windows directory
                                        PID:2956
                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2980
                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2176
                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2632
                                      • C:\Windows\Tiwi.exe
                                        C:\Windows\Tiwi.exe
                                        3⤵
                                          PID:2652
                                        • C:\Windows\SysWOW64\IExplorer.exe
                                          C:\Windows\system32\IExplorer.exe
                                          3⤵
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          PID:2872
                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
                                          3⤵
                                            PID:632
                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
                                            3⤵
                                              PID:2112
                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
                                              3⤵
                                                PID:704
                                            • C:\Windows\SysWOW64\IExplorer.exe
                                              C:\Windows\system32\IExplorer.exe
                                              2⤵
                                              • Modifies WinLogon for persistence
                                              • Modifies visibility of file extensions in Explorer
                                              • Modifies visiblity of hidden/system files in Explorer
                                              • Disables RegEdit via registry modification
                                              • Disables cmd.exe use via registry modification
                                              • Executes dropped EXE
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Modifies WinLogon
                                              • Drops file in System32 directory
                                              • Drops file in Windows directory
                                              • Modifies Control Panel
                                              • Modifies Internet Explorer settings
                                              • Modifies Internet Explorer start page
                                              • Modifies registry class
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              • System policy modification
                                              PID:536
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 380
                                                3⤵
                                                • Loads dropped DLL
                                                • Program crash
                                                PID:1368
                                                • C:\Windows\SysWOW64\Shell.exe
                                                  "C:\Windows\system32\Shell.exe"
                                                  4⤵
                                                  • Executes dropped EXE
                                                  • Drops file in System32 directory
                                                  • Drops file in Windows directory
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2096
                                                • C:\Windows\SysWOW64\Shell.exe
                                                  "C:\Windows\system32\Shell.exe"
                                                  4⤵
                                                  • Executes dropped EXE
                                                  • Drops file in System32 directory
                                                  • Drops file in Windows directory
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2036
                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
                                              2⤵
                                              • Modifies WinLogon for persistence
                                              • Disables RegEdit via registry modification
                                              • Disables cmd.exe use via registry modification
                                              • Executes dropped EXE
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Modifies WinLogon
                                              • System Location Discovery: System Language Discovery
                                              • Modifies Control Panel
                                              • Modifies Internet Explorer settings
                                              • Modifies Internet Explorer start page
                                              • Modifies registry class
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              • System policy modification
                                              PID:1732
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 356
                                                3⤵
                                                • Loads dropped DLL
                                                • Program crash
                                                PID:2812
                                                • C:\Windows\SysWOW64\Shell.exe
                                                  "C:\Windows\system32\Shell.exe"
                                                  4⤵
                                                  • Modifies WinLogon for persistence
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Modifies visiblity of hidden/system files in Explorer
                                                  • Disables RegEdit via registry modification
                                                  • Disables cmd.exe use via registry modification
                                                  • Executes dropped EXE
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • Modifies WinLogon
                                                  • Drops file in System32 directory
                                                  • Drops file in Windows directory
                                                  • Modifies Control Panel
                                                  • Modifies Internet Explorer settings
                                                  • Modifies Internet Explorer start page
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  • System policy modification
                                                  PID:3068
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 400
                                                    5⤵
                                                    • Loads dropped DLL
                                                    • Program crash
                                                    PID:2860
                                                    • C:\Windows\SysWOW64\Shell.exe
                                                      "C:\Windows\system32\Shell.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • Drops file in Windows directory
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2596
                                                    • C:\Windows\SysWOW64\Shell.exe
                                                      "C:\Windows\system32\Shell.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • Drops file in Windows directory
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2844
                                                • C:\Windows\SysWOW64\Shell.exe
                                                  "C:\Windows\system32\Shell.exe"
                                                  4⤵
                                                  • Modifies WinLogon for persistence
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Modifies visiblity of hidden/system files in Explorer
                                                  • Disables RegEdit via registry modification
                                                  • Disables cmd.exe use via registry modification
                                                  • Executes dropped EXE
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • Modifies WinLogon
                                                  • Drops file in System32 directory
                                                  • Drops file in Windows directory
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies Control Panel
                                                  • Modifies Internet Explorer settings
                                                  • Modifies Internet Explorer start page
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  • System policy modification
                                                  PID:2196
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 408
                                                    5⤵
                                                    • Program crash
                                                    PID:3024
                                                    • C:\Windows\SysWOW64\Shell.exe
                                                      "C:\Windows\system32\Shell.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • Drops file in Windows directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2380
                                                    • C:\Windows\SysWOW64\Shell.exe
                                                      "C:\Windows\system32\Shell.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • Drops file in Windows directory
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1336
                                            • C:\Windows\Tiwi.exe
                                              C:\Windows\Tiwi.exe
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2276
                                            • C:\Windows\SysWOW64\IExplorer.exe
                                              C:\Windows\system32\IExplorer.exe
                                              2⤵
                                              • Executes dropped EXE
                                              • Drops file in Windows directory
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1016
                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2336
                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1652
                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
                                              2⤵
                                              • Modifies WinLogon for persistence
                                              • Modifies visibility of file extensions in Explorer
                                              • Modifies visiblity of hidden/system files in Explorer
                                              • Disables RegEdit via registry modification
                                              • Disables cmd.exe use via registry modification
                                              • Executes dropped EXE
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Modifies WinLogon
                                              • System Location Discovery: System Language Discovery
                                              • Modifies Control Panel
                                              • Modifies Internet Explorer settings
                                              • Modifies Internet Explorer start page
                                              • Modifies registry class
                                              • Suspicious use of SetWindowsHookEx
                                              • System policy modification
                                              PID:2464
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 372
                                                3⤵
                                                • Program crash
                                                PID:3060
                                                • C:\Windows\SysWOW64\Shell.exe
                                                  "C:\Windows\system32\Shell.exe"
                                                  4⤵
                                                  • Executes dropped EXE
                                                  • Drops file in System32 directory
                                                  • Drops file in Windows directory
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1976
                                                • C:\Windows\SysWOW64\Shell.exe
                                                  "C:\Windows\system32\Shell.exe"
                                                  4⤵
                                                  • Executes dropped EXE
                                                  • Drops file in System32 directory
                                                  • Drops file in Windows directory
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2824
                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2228
                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2384

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Reconnaissance

                                          Resource Development

                                          Initial Access

                                          Replication Through Removable Media

                                          1
                                          T1091

                                          Execution

                                          Persistence

                                          Boot or Logon Autostart Execution

                                          3
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Winlogon Helper DLL

                                          2
                                          T1547.004

                                          Event Triggered Execution

                                          1
                                          T1546

                                          Change Default File Association

                                          1
                                          T1546.001

                                          Privilege Escalation

                                          Boot or Logon Autostart Execution

                                          3
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Winlogon Helper DLL

                                          2
                                          T1547.004

                                          Event Triggered Execution

                                          1
                                          T1546

                                          Change Default File Association

                                          1
                                          T1546.001

                                          Defense Evasion

                                          Hide Artifacts

                                          2
                                          T1564

                                          Hidden Files and Directories

                                          2
                                          T1564.001

                                          Modify Registry

                                          9
                                          T1112

                                          Credential Access

                                          Discovery

                                          Peripheral Device Discovery

                                          1
                                          T1120

                                          Query Registry

                                          1
                                          T1012

                                          System Information Discovery

                                          2
                                          T1082

                                          System Location Discovery

                                          1
                                          T1614

                                          System Language Discovery

                                          1
                                          T1614.001

                                          Lateral Movement

                                          Replication Through Removable Media

                                          1
                                          T1091

                                          Collection

                                          Command and Control

                                          Exfiltration

                                          Impact

                                          Inhibit System Recovery

                                          1
                                          T1490

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
                                            Filesize

                                            45KB

                                            MD5

                                            f17ee1f66cb94df3a89eec0b92667ca7

                                            SHA1

                                            b0792bc18136142161cb7be69455f9bf90f1286e

                                            SHA256

                                            be6dc2ecf6c37a9c63f7342db74b1fa107fbbc17deb1c1da718d4ab84d78dc25

                                            SHA512

                                            c9396d77dd6324522a888571c15135b271eac59c4318f1fd13de2e1a5417685cf339b9d7d7098ecd34147dc79b99871e25d3fa8ac7e0bd26d8276e0fbec2d367

                                            Download Submit

                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
                                            Filesize

                                            196KB

                                            MD5

                                            3ab93964731facc07f3dec88069eef26

                                            SHA1

                                            3fbfb3e5a3e22f6d76c81e1596c9f4896536d27e

                                            SHA256

                                            a84e7cb17ef050fb184e8ea87cc797e853f1cccd2204e6deea3cc5975885d8e0

                                            SHA512

                                            5759b8d72f36ee3444bc622052d962fabb85cd7a834e2f80e7663190f247b885abdc521da30ce7ea20f82475a394d088d31fd6ac10f91cc5b0254bb8ab74006d

                                            Download Submit

                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
                                            Filesize

                                            196KB

                                            MD5

                                            d37f8becdcab2c29cdc6175605e26a73

                                            SHA1

                                            ef1934bd858ec7f8a0986c1ed00177541973c850

                                            SHA256

                                            546143054a330aae55f1aadf03542786e290ba8819d243b4692213312efea596

                                            SHA512

                                            acd46781ee42156de9d7dfeca7f790e2ffe65bff5bdc51a357621ddf6e22a187da4782eb31507aeca035655202c22e17b4186382440711c1110b2c7f0bdf96eb

                                            Download Submit

                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
                                            Filesize

                                            45KB

                                            MD5

                                            c27a17018339fab95894f7fbb6cda682

                                            SHA1

                                            ca0f2a237de80838373566d645cf987536a30a81

                                            SHA256

                                            13c244c16c1dca616100d775ea7a0e7db5ef7dc53cd8e5d6b3b971620ac55632

                                            SHA512

                                            00f25a41659ec6145081f6cb8402480c28ee87fa57f6b5e11d9ca919820281888c8ab2cbb29f176c7cf366d3cc1f108b837b571f5d100e096934178afb5f4cb8

                                            Download Submit

                                          • C:\Windows\SysWOW64\shell.exe
                                            Filesize

                                            196KB

                                            MD5

                                            ed20ab7529bfbc3acc36961a2aeedbbe

                                            SHA1

                                            da455cac68b180fd9af7b28f272a65a6b828764a

                                            SHA256

                                            8d4f9938192f1c00817343c150f9042e6463e34c90c1f58c4c5aeafd9e4fe995

                                            SHA512

                                            7e18e93977079c7658f681b70c4cf593edc6d49691ef0732af86393fda8cae86b19ec7d27275bb3172f514366288de0a28fee11937437c1b5cad77c902347f5a

                                            Download Submit

                                          • C:\Windows\msvbvm60.dll
                                            Filesize

                                            1.3MB

                                            MD5

                                            5343a19c618bc515ceb1695586c6c137

                                            SHA1

                                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                            SHA256

                                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                            SHA512

                                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                            Download Submit

                                          • C:\Windows\tiwi.exe
                                            Filesize

                                            196KB

                                            MD5

                                            d6fbb13e9429005172962c997665026d

                                            SHA1

                                            6580955cfe90f89c43649a8edd3ce1cb3b475964

                                            SHA256

                                            f2be2bcc3817543aaca46c7ee6589b5e037f5a41c7e34a72fe6ce7a90b5b76d5

                                            SHA512

                                            3095f9d6d7f5631e2d4ae50098969c93eb168f0d54d920dd3b770ed9ababe01aa09b029d2691bb73e18eb90403dc52cd9b97bca87c976001f1eed7e14a283314

                                            Download Submit

                                          • C:\present.txt
                                            Filesize

                                            729B

                                            MD5

                                            8e3c734e8dd87d639fb51500d42694b5

                                            SHA1

                                            f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

                                            SHA256

                                            574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

                                            SHA512

                                            06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

                                            Download Submit

                                          • C:\tiwi.exe
                                            Filesize

                                            196KB

                                            MD5

                                            5930623b57708443ea2cb576d053b663

                                            SHA1

                                            5ff4f21bf27c6d66e1867c4488c10a0b91b0e478

                                            SHA256

                                            2ee4bd1df48394cc067ce15442e22495841c916b7be387ab4dfad0a75b3b31c2

                                            SHA512

                                            8818c8d973b18a968994e7ef7e4c076c7f96160a7f55b42b227835de3640dcb190e8f31c23e5f5f468b4774ddaa87f26bfde09d61a3d7962d39ef959cbc969fd

                                            Download Submit

                                          • C:\tiwi.exe
                                            Filesize

                                            192KB

                                            MD5

                                            7f0bc63ccd8b4bf22924cf2f666c94bb

                                            SHA1

                                            6e2649f1ec590866f130de3e1d100d961186e413

                                            SHA256

                                            e4d52bdfef66dddaf07ae4c34633be9b54341945761bcd1d5917d2c8704436ce

                                            SHA512

                                            c53d24c285adafc4faaa061e6b65c56be54723a6f846ad20c59b8a0c97c1a87fc48e088677f97e64bbae16751098368c3de67c071ab1d320eca1ff0ea90b2456

                                            Download Submit

                                          • F:\autorun.inf
                                            Filesize

                                            39B

                                            MD5

                                            415c421ba7ae46e77bdee3a681ecc156

                                            SHA1

                                            b0db5782b7688716d6fc83f7e650ffe1143201b7

                                            SHA256

                                            e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

                                            SHA512

                                            dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

                                            Download Submit

                                          • \Users\Admin\AppData\Local\WINDOWS\winlogon.exe
                                            Filesize

                                            196KB

                                            MD5

                                            c5f89225dec3344b6c5aa34d7f9aa9e1

                                            SHA1

                                            47111763e53971c99f74501b6796f47b59d88ed1

                                            SHA256

                                            f0936e2f58bac97cec325ed7b0ac5e3621d2b7dcbeb1938066ebcb9299f1d5f4

                                            SHA512

                                            299c6774e9ce39c17fc35f7f8214540054f80b8edf8948f1b2ffd1294aaac5f62eab4e85adad2c739560a2d04e7e72348a805444fa21007dfc9852ba8fe23e76

                                            Download Submit

                                          • \Windows\SysWOW64\IExplorer.exe
                                            Filesize

                                            196KB

                                            MD5

                                            2917fe6c40c6bad8def857927166e6e5

                                            SHA1

                                            31785ed749dba0f73bee2ff8f5e2452b744f55cd

                                            SHA256

                                            d3cfda957c0b0b2e7e535c74a893f8783ceb91d4f4c64fc09d6bf1c5270e0ffe

                                            SHA512

                                            aafb40c753380d50024af58c0753fd034c26d14d86d0a1f4e2b8db8f905f5c9faae56b39ff320424468260775e79c3388ce600f3294c86fcad1ab0879d5b62df

                                            Download Submit

                                          • \Windows\SysWOW64\shell.exe
                                            Filesize

                                            196KB

                                            MD5

                                            02efbf7d1ded589959c8cd34e9827010

                                            SHA1

                                            7554bfb72ae69c243da2d83388d774c4f2ecdbcb

                                            SHA256

                                            4f8333f0e43e270124425c29fba0df89c041caa3d175117b616de62681d09663

                                            SHA512

                                            401e5c4d1ccb10bbfd7623b5e59fc4da56bf2c2001b34a7bdf71f1bdd1db5ebb82c4a2c39abbf5f1546b4ed7b7c3a5bec2a1ae31fdf200b32934412f6e33805e

                                            Download Submit

                                          • memory/536-108-0x0000000000400000-0x000000000042A000-memory.dmp

                                            Filesize

                                            168KB

                                            Download

                                          • memory/908-434-0x0000000000230000-0x0000000000240000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/912-404-0x0000000000400000-0x000000000042A000-memory.dmp

                                            Filesize

                                            168KB

                                            Download

                                          • memory/928-424-0x0000000072940000-0x0000000072A93000-memory.dmp

                                            Filesize

                                            1.3MB

                                            Download

                                          • memory/1252-429-0x0000000000400000-0x000000000042A000-memory.dmp

                                            Filesize

                                            168KB

                                            Download

                                          • memory/1464-484-0x0000000072940000-0x0000000072A93000-memory.dmp

                                            Filesize

                                            1.3MB

                                            Download

                                          • memory/1652-461-0x0000000072940000-0x0000000072A93000-memory.dmp

                                            Filesize

                                            1.3MB

                                            Download

                                          • memory/1732-120-0x0000000000400000-0x000000000042A000-memory.dmp

                                            Filesize

                                            168KB

                                            Download

                                          • memory/1968-172-0x0000000072940000-0x0000000072A93000-memory.dmp

                                            Filesize

                                            1.3MB

                                            Download

                                          • memory/2104-176-0x0000000000400000-0x000000000042A000-memory.dmp

                                            Filesize

                                            168KB

                                            Download

                                          • memory/2112-383-0x0000000072940000-0x0000000072A93000-memory.dmp

                                            Filesize

                                            1.3MB

                                            Download

                                          • memory/2200-315-0x0000000072940000-0x0000000072A93000-memory.dmp

                                            Filesize

                                            1.3MB

                                            Download

                                          • memory/2276-240-0x0000000072940000-0x0000000072A93000-memory.dmp

                                            Filesize

                                            1.3MB

                                            Download

                                          • memory/2464-264-0x0000000000400000-0x000000000042A000-memory.dmp

                                            Filesize

                                            168KB

                                            Download

                                          • memory/2624-98-0x0000000000400000-0x000000000042A000-memory.dmp

                                            Filesize

                                            168KB

                                            Download

                                          • memory/2696-330-0x0000000000400000-0x000000000042A000-memory.dmp

                                            Filesize

                                            168KB

                                            Download

                                          • memory/2708-320-0x0000000000400000-0x000000000042A000-memory.dmp

                                            Filesize

                                            168KB

                                            Download

                                          • memory/3032-0-0x0000000000400000-0x000000000042A000-memory.dmp

                                            Filesize

                                            168KB

                                            Download

                                          • memory/3068-126-0x0000000000400000-0x000000000042A000-memory.dmp

                                            Filesize

                                            168KB

                                            Download