8d4b33f016a0358ab33a61a53be27b775979a15719e2168d66bae6a7a598d2e1

Analysis

max time kernel
110s
max time network
147s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
Size

1.9MB
MD5

2084c9d26206ec07c2dc65d1167ee1be
SHA1

ff37b5b781c17b3de200bbc1f68530370b4110a9
SHA256

cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320
SHA512

99740d059fc3cd37fad78ddacd9c149eabb519c7e043cb01cfa92884724bbce326dc9f9d4b716d85b222a6580e1c75ae437680752bf565135a5de9ceee226f44
SSDEEP

24576:Uz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:UOMX0/08SVYTcxMXPxthD

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Process spawned unexpected child process 34 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	288	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1132	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1316	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	604	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1344	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	528	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2604	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	2604	schtasks.exe	30

UAC bypass 3 TTPs 24 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
836	powershell.exe
2740	powershell.exe
2332	powershell.exe
2536	powershell.exe
484	powershell.exe
2800	powershell.exe
2512	powershell.exe
1356	powershell.exe
2708	powershell.exe
1692	powershell.exe
2548	powershell.exe
2680	powershell.exe
1112	powershell.exe
380	powershell.exe
1084	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe

Executes dropped EXE 7 IoCs

pid	Process
2880	winlogon.exe
2972	winlogon.exe
2288	winlogon.exe
2692	winlogon.exe
1532	winlogon.exe
1160	winlogon.exe
2680	winlogon.exe

Checks whether UAC is enabled 1 TTPs 16 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Journal\fr-FR\RCXA607.tmp	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File opened for modification	C:\Program Files\Windows Journal\fr-FR\dwm.exe	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\RCXA395.tmp	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\explorer.exe	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File opened for modification	C:\Program Files\Windows Journal\fr-FR\RCXA608.tmp	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\RCXB31E.tmp	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File created	C:\Program Files\Windows Journal\fr-FR\6cb0b6c459d5d3	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\RCXA404.tmp	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\cc11b995f2a76d	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\RCXB31F.tmp	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\explorer.exe	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\7a0fd90576e088	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File created	C:\Program Files\Windows Journal\fr-FR\dwm.exe	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Panther\explorer.exe	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File created	C:\Windows\Panther\7a0fd90576e088	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File opened for modification	C:\Windows\Panther\RCXAA21.tmp	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File opened for modification	C:\Windows\Panther\RCXAA8F.tmp	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
File opened for modification	C:\Windows\Panther\explorer.exe	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3060	schtasks.exe
2740	schtasks.exe
1132	schtasks.exe
1980	schtasks.exe
604	schtasks.exe
2348	schtasks.exe
2612	schtasks.exe
2720	schtasks.exe
1872	schtasks.exe
1532	schtasks.exe
1520	schtasks.exe
3040	schtasks.exe
2708	schtasks.exe
2916	schtasks.exe
288	schtasks.exe
528	schtasks.exe
2868	schtasks.exe
1492	schtasks.exe
1344	schtasks.exe
2936	schtasks.exe
3016	schtasks.exe
2512	schtasks.exe
3052	schtasks.exe
2544	schtasks.exe
1708	schtasks.exe
784	schtasks.exe
2880	schtasks.exe
2212	schtasks.exe
2224	schtasks.exe
3020	schtasks.exe
2300	schtasks.exe
1744	schtasks.exe
560	schtasks.exe
2716	schtasks.exe
1712	schtasks.exe
1752	schtasks.exe
1688	schtasks.exe
2524	schtasks.exe
2808	schtasks.exe
1316	schtasks.exe
1676	schtasks.exe
2560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
2800	powershell.exe
1112	powershell.exe
1084	powershell.exe
484	powershell.exe
380	powershell.exe
2740	powershell.exe
1692	powershell.exe
2708	powershell.exe
2536	powershell.exe
2680	powershell.exe
2548	powershell.exe
2332	powershell.exe
2512	powershell.exe
1356	powershell.exe
836	powershell.exe
2880	winlogon.exe
2972	winlogon.exe
2288	winlogon.exe
2692	winlogon.exe
1532	winlogon.exe
1160	winlogon.exe
2680	winlogon.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	1112	powershell.exe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	484	powershell.exe
Token: SeDebugPrivilege	380	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	836	powershell.exe
Token: SeDebugPrivilege	2880	winlogon.exe
Token: SeDebugPrivilege	2972	winlogon.exe
Token: SeDebugPrivilege	2288	winlogon.exe
Token: SeDebugPrivilege	2692	winlogon.exe
Token: SeDebugPrivilege	1532	winlogon.exe
Token: SeDebugPrivilege	1160	winlogon.exe
Token: SeDebugPrivilege	2680	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2536	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	73
PID 2472 wrote to memory of 2536	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	73
PID 2472 wrote to memory of 2536	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	73
PID 2472 wrote to memory of 2708	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	74
PID 2472 wrote to memory of 2708	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	74
PID 2472 wrote to memory of 2708	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	74
PID 2472 wrote to memory of 484	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	75
PID 2472 wrote to memory of 484	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	75
PID 2472 wrote to memory of 484	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	75
PID 2472 wrote to memory of 1112	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	76
PID 2472 wrote to memory of 1112	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	76
PID 2472 wrote to memory of 1112	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	76
PID 2472 wrote to memory of 380	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	78
PID 2472 wrote to memory of 380	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	78
PID 2472 wrote to memory of 380	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	78
PID 2472 wrote to memory of 836	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	80
PID 2472 wrote to memory of 836	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	80
PID 2472 wrote to memory of 836	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	80
PID 2472 wrote to memory of 2800	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	82
PID 2472 wrote to memory of 2800	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	82
PID 2472 wrote to memory of 2800	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	82
PID 2472 wrote to memory of 1692	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	84
PID 2472 wrote to memory of 1692	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	84
PID 2472 wrote to memory of 1692	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	84
PID 2472 wrote to memory of 2332	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	85
PID 2472 wrote to memory of 2332	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	85
PID 2472 wrote to memory of 2332	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	85
PID 2472 wrote to memory of 2680	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	86
PID 2472 wrote to memory of 2680	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	86
PID 2472 wrote to memory of 2680	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	86
PID 2472 wrote to memory of 2740	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	87
PID 2472 wrote to memory of 2740	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	87
PID 2472 wrote to memory of 2740	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	87
PID 2472 wrote to memory of 1084	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	88
PID 2472 wrote to memory of 1084	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	88
PID 2472 wrote to memory of 1084	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	88
PID 2472 wrote to memory of 1356	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	89
PID 2472 wrote to memory of 1356	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	89
PID 2472 wrote to memory of 1356	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	89
PID 2472 wrote to memory of 2512	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	90
PID 2472 wrote to memory of 2512	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	90
PID 2472 wrote to memory of 2512	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	90
PID 2472 wrote to memory of 2548	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	91
PID 2472 wrote to memory of 2548	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	91
PID 2472 wrote to memory of 2548	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	91
PID 2472 wrote to memory of 1368	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	103
PID 2472 wrote to memory of 1368	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	103
PID 2472 wrote to memory of 1368	2472	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe	103
PID 1368 wrote to memory of 2756	1368	cmd.exe	105
PID 1368 wrote to memory of 2756	1368	cmd.exe	105
PID 1368 wrote to memory of 2756	1368	cmd.exe	105
PID 1368 wrote to memory of 2880	1368	cmd.exe	107
PID 1368 wrote to memory of 2880	1368	cmd.exe	107
PID 1368 wrote to memory of 2880	1368	cmd.exe	107
PID 2880 wrote to memory of 1520	2880	winlogon.exe	108
PID 2880 wrote to memory of 1520	2880	winlogon.exe	108
PID 2880 wrote to memory of 1520	2880	winlogon.exe	108
PID 2880 wrote to memory of 572	2880	winlogon.exe	109
PID 2880 wrote to memory of 572	2880	winlogon.exe	109
PID 2880 wrote to memory of 572	2880	winlogon.exe	109
PID 1520 wrote to memory of 2972	1520	WScript.exe	110
PID 1520 wrote to memory of 2972	1520	WScript.exe	110
PID 1520 wrote to memory of 2972	1520	WScript.exe	110
PID 2972 wrote to memory of 608	2972	winlogon.exe	111

System policy modification 1 TTPs 24 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe
"C:\Users\Admin\AppData\Local\Temp\cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\My Documents\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jdk1.7.0_80\jre\bin\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Journal\fr-FR\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\Sample Music\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\lsm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0Kfq7VgMDq.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2756
- - C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe
    "C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2880
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9c8d1f6f-8b76-4d5b-8db4-bd143dfd5dd8.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1520
    - - C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2972
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e741c33-4840-477d-bb6f-32ef18f42df5.vbs"
        6⤵
        
        PID:608
        
        C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2288
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7eff2284-335c-4f57-8f2c-f5be4e3ab3de.vbs"
        8⤵
        
        PID:2716
        
        C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe"
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb8484f2-c3a9-4828-a03f-f152f6ad5964.vbs"
        10⤵
        
        PID:2836
        
        C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe"
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1532
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8278051a-5584-4710-b21a-4ed4ad75ad6c.vbs"
        12⤵
        
        PID:680
        
        C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe"
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1160
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\989841bc-c42a-4267-adc3-933c51cb261d.vbs"
        14⤵
        
        PID:1964
        
        C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe"
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\059a2b35-8134-4353-8153-c26b20a3b497.vbs"
        16⤵
        
        PID:1700
        
        C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe"
        17⤵
        
        PID:2804
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\57db56d3-9235-49b6-8af4-7a0ae7f38200.vbs"
        18⤵
        
        PID:2660
        
        C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe"
        19⤵
        
        PID:744
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\966782fd-4ac5-4e25-b8fc-25a613417793.vbs"
        20⤵
        
        PID:1592
        
        C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe"
        21⤵
        
        PID:1148
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\54935423-beee-4c66-be85-92930522be7c.vbs"
        22⤵
        
        PID:344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9c97ae36-05bf-4fa1-8a45-53e8e0502a50.vbs"
        22⤵
        
        PID:1132
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2126bf54-51fd-4cb1-ab5b-86b7970e0bd7.vbs"
        20⤵
        
        PID:3060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0622bdf-721a-4a8c-893d-fabf7c6a54ee.vbs"
        18⤵
        
        PID:1680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ea0e55d-dcb3-4cfd-999b-70992a53c3a5.vbs"
        16⤵
        
        PID:2288
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e8f28ab-c9fd-4e47-bad9-413de9fcf3cd.vbs"
        14⤵
        
        PID:2056
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a09cad8a-2504-41fe-b1ea-6b8b86cbdb29.vbs"
        12⤵
        
        PID:1916
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1fdbdfa6-b11e-45d5-9127-835cad28ee58.vbs"
        10⤵
        
        PID:2568
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\530f0501-803a-4448-b070-aee01421893a.vbs"
        8⤵
        
        PID:1756
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e6c86e5-1f49-4e73-b8ba-90e82fe34ea4.vbs"
        6⤵
        
        PID:2712
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9ed3a8ac-d439-478f-a611-139aa17a792a.vbs"
      4⤵
      PID:572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\OSPPSVC.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\My Documents\explorer.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\explorer.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\My Documents\explorer.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jdk1.7.0_80\jre\bin\explorer.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\jre\bin\explorer.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jdk1.7.0_80\jre\bin\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\fr-FR\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\fr-FR\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Journal\fr-FR\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Windows\Panther\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Panther\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\Panther\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Music\Sample Music\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Music\Sample Music\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Music\Sample Music\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Recent\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Default\Recent\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Recent\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe

Filesize
898KB

MD5
dc6bbe0a061a84f7d66571e8e8118045

SHA1
dfcb19855945fc458c00d95f585f44430342ecdc

SHA256
da0b7a7b5c071a5b1457d94b626611a3c3b138e2502752eb26bfa08403d05118

SHA512
372cea88ffbcdceeb1befe72bfdd960d329e79b74cd9b9c81c451924617adedbf6d1c0c6838f54d3bd7ba029c5970960a7bcc271c3dc1168eafaa3d5b5d7f06c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\bin\explorer.exe

Filesize
1.9MB

MD5
3af08998a77046d848671d911a3d2d1d

SHA1
cc8d205c694e601ee574dce0627203ba8f27a777

SHA256
a9172e31a9342bc19a92c78b79139326aced3d9c7381c0d5ab871c87504d8b6c

SHA512
15d9bebcea9a4781e3cb5b33a4f97e5e87549beaae2d3b5054702174e8c694ffd043ce534370876224652023d28d092dc083dd395e3b75d8b41f0d9af039ebfa

Download Submit
C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\winlogon.exe

Filesize
1.9MB

MD5
2084c9d26206ec07c2dc65d1167ee1be

SHA1
ff37b5b781c17b3de200bbc1f68530370b4110a9

SHA256
cc22848f9c8ba8d38a385083ea8fad7840189caeb94ebf9e1f1b6fda829f0320

SHA512
99740d059fc3cd37fad78ddacd9c149eabb519c7e043cb01cfa92884724bbce326dc9f9d4b716d85b222a6580e1c75ae437680752bf565135a5de9ceee226f44

Download Submit
C:\Users\Admin\AppData\Local\Temp\059a2b35-8134-4353-8153-c26b20a3b497.vbs

Filesize
732B

MD5
036fafceeb9f8e1f3dfb27b49f78bdc3

SHA1
dfe96dba9858f81100e05cfe7d4df536ede27fca

SHA256
ba0218421002d1935c76ef53d63accbb06750ec9988ffae760ae632737c07081

SHA512
d577088e651e8969a532ad299bb3f2e7ab6988dfc9edd9def0d56d72e92bb197752673ab1400a51503face824af1afab47732faee391a6c556bcce130ccfc0d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\0Kfq7VgMDq.bat

Filesize
221B

MD5
c9256968a528e5a29ba800eb434e1da6

SHA1
8653656b693fe1d779435dc345c7a50ac75c1a61

SHA256
0eeb9982f8e8497dec5a68b5795409bdccc38b8a2e69441ee831644a0e3bc194

SHA512
360cf6833867749f0498700d2c1eaa0c5dd91c13fb498a185ac308b5587454165af96f879c103ecc2392909b195aa38895e1c000ab02ae354ade7623a125c7c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\383677fb9da9db087f07deb3b9e7710355c83852.exe

Filesize
384KB

MD5
e434f8bb5d41623fd9207b39ce339867

SHA1
2528a234e04d8a89a2175f96a576dc23a52e0249

SHA256
d4b57f35632d1e8b876906b6e6fec37800f0b11ede0f92ec24e3ce2e5f2d8a93

SHA512
6c6177d79ac5e0a58acd2936eeecdbfc5f837c286a18db7d9783c27266f45ba85d7f7621e60ae2573600991f3cf6b80928f11b00621564baa0b7615d2cb60e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\54935423-beee-4c66-be85-92930522be7c.vbs

Filesize
732B

MD5
6b0ddc173f45a2c87d7cf9a1ffd90ddf

SHA1
e075e64ce101359205ef9f432ec38715d01298d6

SHA256
2ea1a2712014517978f5e87425db2a2a8dbaa4fbc119c0014badae3975dbdd86

SHA512
9d9cefaf8184d47f809b53a24a9ad6ecdc914ea89f9aac567cf1119c737a7c74c6dcc19ce86f72a963321f1a56521ee8654f60c99cadd55d789c695ee3f1a3b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\57db56d3-9235-49b6-8af4-7a0ae7f38200.vbs

Filesize
732B

MD5
fce7427de83db4691c78825ce7ae21c2

SHA1
0c248174d757bfe7375b90a9521e23bb0bb5a541

SHA256
9243360a72bb39a8978c49fb23a93abfe9fdb42efc5a694e47d577ce2d1fba1e

SHA512
2674d68c069fcd1033be850b4b813713538c248dd572ac132ef697fd01251d5a9feb7bceaf088c14dcc9930cf60415e2bebfbf211bfb3d5ee6d2687d4023b35d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7eff2284-335c-4f57-8f2c-f5be4e3ab3de.vbs

Filesize
732B

MD5
1cb9378f1239036be169a5ca6540670f

SHA1
55f4891a97576cc033319ad08cbfb59b83f93993

SHA256
4e41a1d4917b7df66d27dd35c3ae8852f994fe48a89e96c142476326685b497e

SHA512
c2e272dbe007d1130cbe499fd2903ba9dd91146ec14cfbd24116edbc9490bf42eda7e3926f24077c8fe597d98b42a11cba445a955fd87977cee6703bea047e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8278051a-5584-4710-b21a-4ed4ad75ad6c.vbs

Filesize
732B

MD5
5c894e16dfe3e45a9c09e7ca016453e9

SHA1
593e0ed721bb10c3a3cb21a8ed39000c5a8c49c6

SHA256
c530530d3291b70e2f25539e1a5fe2cf16482155618c6e746f3d4e747aa8b15d

SHA512
02f991d5fd674d46a1bdd50a3a5c6e4ce449e8bf9417b80cc58609703f124ec67850d96b3b3f16c370fcb6722887648035789c75667b891d7fb88e52b126d9fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\966782fd-4ac5-4e25-b8fc-25a613417793.vbs

Filesize
731B

MD5
a21f27b07bd99fdba4a55baaefc9dcf6

SHA1
bce38d910d3f16cc19387ff999d95cad76e934e1

SHA256
44cd860ef8e80d4dccbf070ec75a6e0f9dbd5bbae0aad6d2deb56454c1bf9711

SHA512
b12ea41a2b9aeef4bbaa60a67582b74b1932f6abb7368854df29b15523bd089ace5569bf3e1d8c8b762bcb4cb5533a31150a3f9913daa5c42cd63fbb8539597d

Download Submit
C:\Users\Admin\AppData\Local\Temp\989841bc-c42a-4267-adc3-933c51cb261d.vbs

Filesize
732B

MD5
907690fa2cf97e0422410131d5571d8b

SHA1
1708e9a19b2b4121a7545180a613960a49e3ec97

SHA256
7d0048162509bc3504e85e22a821bb44eebfa0013a61a9ef58e5f911f4cf3403

SHA512
fb39dc5acbb806bf61f42e3b3fb452c455f803293826e64ba4cef6837a63faaf4fd3c6a1d7a422426ed104b55ab0c21d23c34f77bed688c6563dd90f25aa7b2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\9c8d1f6f-8b76-4d5b-8db4-bd143dfd5dd8.vbs

Filesize
732B

MD5
689cb5e22956bfc90f50239d2a217fd9

SHA1
488418d7a35cd0f96fdcb56122a5b07638d54a23

SHA256
b9b159f8cf2e86ae72228eb941c95b1d2c26abc79d2330d0796d5c1516678402

SHA512
dc41b2cd2e50e0ce09eb4d1acca8aab3e5fc2cf3785ee76d52af2ed20f4ef7e741139eda65b2cba943af41309db8acf1519cbe4e100ce5aca0db3a05f4e3d90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\9e741c33-4840-477d-bb6f-32ef18f42df5.vbs

Filesize
732B

MD5
2bfff00ad98b6aefcfe21c22d15ca03b

SHA1
b6adb8e02e899505dfd0a33afc2da967cc961a01

SHA256
06af5f26d77980a1361461e9b31275e4b58dbc3a31082e4e6182a7df82ced70c

SHA512
5bde1b494d0190901617039112c4e160caea6508fb52d07709e734f1ad7360e063c41c8460eb37f0cd10df8057ba9dee32c1802e8228db9dcd8701b54ea3046e

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ed3a8ac-d439-478f-a611-139aa17a792a.vbs

Filesize
508B

MD5
02b3403f3f60bdf78373d651b8f7338d

SHA1
743085341c8e147d6b9a0db1ca729b9b06b5c551

SHA256
f04c2fa051610f218f428f41f4b98e0121b1e3b93c00f9cd00ee3cde0680ebfa

SHA512
96e3048c3831e2b8c6baeea8e5c39f6e0bffe83ab799d22c4755497ceea4e108a6664c3d2366c9906e2fd01d17bf2c52fb2fe49ce4dbd351a75527e7f7563786

Download Submit
C:\Users\Admin\AppData\Local\Temp\fb8484f2-c3a9-4828-a03f-f152f6ad5964.vbs

Filesize
732B

MD5
192e441e63a41a95470ca61aa74ff803

SHA1
7e3d8f105f66e21631d8518b9ce9ea6d7b0044d3

SHA256
400d6e1eab41bee265bdb28b702350c4a89d8e439376bde6cb01cfaadaa8bdae

SHA512
0bf506cbec2aff666cd5bdc8e6a802df4d122357730700f3d38a246d21f40400543639b47c5773fb341b7891ab41457ca71feba108b1b212911ea01ddb549e3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
5f1ad6bc5fbde8788ba49f1cca394a2c

SHA1
2cf5414cf3071d03c3da3314c896f45119b9db46

SHA256
0e550a0171aef047b5fb71dd00d69a60caff24747bf4d2adf4f40fa9dd8b74b7

SHA512
d1c60688f9c5283bd34e2e0c2cdc25374cd9a0d46e3fea1bca4868f8ce53cada8814bec9a231fe0d3908b870083d613caa6de6b9c7214fc68c9a55d51dee7830

Download Submit
C:\Users\Public\Music\Sample Music\csrss.exe

Filesize
1.9MB

MD5
d86e6cc7346308e41de12dfbc84d5bd5

SHA1
885b3f3bc7e0d58734064494a30bc35862730d29

SHA256
cf674696b51d8fb4bb01167cd7e32fb9ae15df7effbc8a0b8be5f8f47075a443

SHA512
6419748e4dd699c2aa91315000f8750fa8498036b2d1121d88f96d2e37751557dd4e64d947a3238d8e0e0f99fe6111db02007f53680ba2b2b38d142adcfd29b2

Download Submit
C:\Windows\Panther\explorer.exe

Filesize
1.9MB

MD5
ac8d5c8cb6270bdc5db2cc9b419739be

SHA1
6b57ba9047774850e31bf21b6bdc1040374aeb54

SHA256
498117709e4ccf55621111e95e9c5c0d46044583df5c585c5fe596b198806e0e

SHA512
f54821f5390579a2c825e71c33cc43038807f7932a7e96d4eef5b71b47cf521661070e5db4512dcb8dbd3871a9f0cba237e2731b26e53c4bed28d2025702c3dd

Download Submit
memory/744-399-0x0000000000240000-0x000000000042A000-memory.dmp

Filesize
1.9MB

Download
memory/1148-411-0x0000000000C60000-0x0000000000E4A000-memory.dmp

Filesize
1.9MB

Download
memory/1148-412-0x0000000000B00000-0x0000000000B12000-memory.dmp

Filesize
72KB

Download
memory/1532-351-0x0000000001350000-0x000000000153A000-memory.dmp

Filesize
1.9MB

Download
memory/2288-326-0x00000000012E0000-0x00000000014CA000-memory.dmp

Filesize
1.9MB

Download
memory/2472-14-0x000000001AE60000-0x000000001AE6A000-memory.dmp

Filesize
40KB

Download
memory/2472-7-0x00000000020B0000-0x00000000020BA000-memory.dmp

Filesize
40KB

Download
memory/2472-9-0x00000000020C0000-0x00000000020CC000-memory.dmp

Filesize
48KB

Download
memory/2472-10-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/2472-1-0x0000000000990000-0x0000000000B7A000-memory.dmp

Filesize
1.9MB

Download
memory/2472-2-0x000007FEF6190000-0x000007FEF6B7C000-memory.dmp

Filesize
9.9MB

Download
memory/2472-215-0x000007FEF6193000-0x000007FEF6194000-memory.dmp

Filesize
4KB

Download
memory/2472-4-0x0000000000980000-0x0000000000988000-memory.dmp

Filesize
32KB

Download
memory/2472-3-0x0000000000450000-0x000000000046C000-memory.dmp

Filesize
112KB

Download
memory/2472-18-0x000000001AEE0000-0x000000001AEEC000-memory.dmp

Filesize
48KB

Download
memory/2472-5-0x0000000002080000-0x0000000002090000-memory.dmp

Filesize
64KB

Download
memory/2472-8-0x000000001ADF0000-0x000000001AE46000-memory.dmp

Filesize
344KB

Download
memory/2472-12-0x00000000021E0000-0x00000000021F2000-memory.dmp

Filesize
72KB

Download
memory/2472-13-0x00000000021F0000-0x00000000021FC000-memory.dmp

Filesize
48KB

Download
memory/2472-248-0x000007FEF6190000-0x000007FEF6B7C000-memory.dmp

Filesize
9.9MB

Download
memory/2472-0-0x000007FEF6193000-0x000007FEF6194000-memory.dmp

Filesize
4KB

Download
memory/2472-15-0x000000001AE70000-0x000000001AE7E000-memory.dmp

Filesize
56KB

Download
memory/2472-16-0x000000001AE80000-0x000000001AE88000-memory.dmp

Filesize
32KB

Download
memory/2472-17-0x000000001AED0000-0x000000001AEDC000-memory.dmp

Filesize
48KB

Download
memory/2472-6-0x0000000002090000-0x00000000020A6000-memory.dmp

Filesize
88KB

Download
memory/2680-374-0x0000000000260000-0x000000000044A000-memory.dmp

Filesize
1.9MB

Download
memory/2680-375-0x0000000000750000-0x00000000007A6000-memory.dmp

Filesize
344KB

Download
memory/2692-338-0x00000000005F0000-0x0000000000646000-memory.dmp

Filesize
344KB

Download
memory/2692-339-0x00000000004D0000-0x00000000004E2000-memory.dmp

Filesize
72KB

Download
memory/2800-234-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2800-237-0x0000000001F10000-0x0000000001F18000-memory.dmp

Filesize
32KB

Download
memory/2804-387-0x0000000000120000-0x000000000030A000-memory.dmp

Filesize
1.9MB

Download
memory/2880-302-0x0000000000860000-0x0000000000872000-memory.dmp

Filesize
72KB

Download
memory/2880-301-0x00000000002D0000-0x00000000004BA000-memory.dmp

Filesize
1.9MB

Download
memory/2972-314-0x00000000007A0000-0x00000000007F6000-memory.dmp

Filesize
344KB

Download
memory/2972-313-0x0000000000280000-0x000000000046A000-memory.dmp

Filesize
1.9MB

Download