cabf48001bf51ae6946d3a6aa48485db6e511b97c2a8043dbb2e956dbb2fac09

General

Target
2026-08-24_5b9efc9e6ceeeac4e63de1ccb5e1eb26_amadey_elex_emotet_gh0st_nymaim_rhadamanthys_smoke-loader_stop_wannacry.exe
Size 15.4MB
Sample260825-pt42bssdnb
SHA256 cabf48001bf51ae6946d3a6aa48485db6e511b97c2a8043dbb2e956dbb2fac09
MD5 5b9efc9e6ceeeac4e63de1ccb5e1eb26
SHA1 e0c845bb65de432eec9f43229c576d794f3eed15
SHA512 290f5d29af07a69abce333a445e099861c9f4b2d49dfc67bef7a285234729f9471f6f7419399dadd07a55c99a457c0a8fd28a6e65a721de29f9cdea48c2efac3
SSDEEP 98304:abSoPdVa5AgFoQkO743BRBRBRBix432BRBRBRBix4ujnbBRBRBRBix4ivX9/ig6y:aG8dVaXGOsNhjGCAc3K9pMw
TLSH
T1E5F674E19ACC1659E3E59479CD7F508601CA3C41B72F8B96B16C3C6F6F2A0DAF215C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4476	WScript.exe

Executes dropped EXE 22 IoCs

pid	Process
4980	winlogin.exe
4748	winlogin.exe
2556	winlogin.exe
5776	winlogin.exe
4864	winlogin.exe
5796	winlogin.exe
2916	winlogin.exe
1732	winlogin.exe
4084	winlogin.exe
1416	winlogin.exe
3256	winlogin.exe
4300	winlogin.exe
5956	winlogin.exe
4220	winlogin.exe
2432	winlogin.exe
4088	winlogin.exe
3040	winlogin.exe
5588	winlogin.exe
4712	winlogin.exe
1616	winlogin.exe
3556	winlogin.exe
2676	winlogin.exe

Adds Run key to start application 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	2026-08-24_5b9efc9e6ceeeac4e63de1ccb5e1eb26_amadey_elex_emotet_gh0st_nymaim_rhadamanthys_smoke-loader_stop_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\PrivateHelp = "C:\\Windows\\winlogin.exe"	winlogin.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EC408523CFEB39121BE33594D22453B7	winlogin.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	winlogin.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3	winlogin.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EC408523CFEB39121BE33594D22453B7	winlogin.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	winlogin.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	winlogin.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	winlogin.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61	winlogin.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61	winlogin.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3	winlogin.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4476	WScript.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\winlogin.exe	2026-08-24_5b9efc9e6ceeeac4e63de1ccb5e1eb26_amadey_elex_emotet_gh0st_nymaim_rhadamanthys_smoke-loader_stop_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4736	4748	WerFault.exe	91
2940	4980	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_5b9efc9e6ceeeac4e63de1ccb5e1eb26_amadey_elex_emotet_gh0st_nymaim_rhadamanthys_smoke-loader_stop_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	winlogin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winlogin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winlogin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	winlogin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	winlogin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	winlogin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winlogin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	winlogin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	winlogin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	winlogin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	winlogin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winlogin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	2026-08-24_5b9efc9e6ceeeac4e63de1ccb5e1eb26_amadey_elex_emotet_gh0st_nymaim_rhadamanthys_smoke-loader_stop_wannacry.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\BDB1B93CD5978D45C6261455F8DB95C75AD153AF	winlogin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\BDB1B93CD5978D45C6261455F8DB95C75AD153AF\Blob = 5c00000001000000040000008001000062000000010000002000000069729b8e15a86efc177a57afb7171dfc64add28c2fca8cf1507e34453ccb14700b000000010000001a0000004900530052004700200052006f006f0074002000580032000000090000000100000016000000301406082b0601050507030206082b060105050703011400000001000000140000007c4296aede4b483bfa92f89e8ccf6d8ba97237951d0000000100000010000000e3b494871af5dc80ac5089a40ec3c4c7030000000100000014000000bdb1b93cd5978d45c6261455f8db95c75ad153af20000000010000001f0200003082021b308201a1a003020102021041d29dd172eaeea780c12c6ce92f8752300a06082a8648ce3d040303304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205832301e170d3230303930343030303030305a170d3430303931373136303030305a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f742058323076301006072a8648ce3d020106052b8104002203620004cd9bd59f80830aec094af3164a3e5ccf77acde67050d1d07b6dc16fb5a8b14dbe27160c4ba459511898eea06dff72a161ca4b9c5c532e003e01e8218388bd745d80a6a6ee60077fb02517d22d80a6e9a5b77dff0fa41ec39dc75ca68070c1feaa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604147c4296aede4b483bfa92f89e8ccf6d8ba9723795300a06082a8648ce3d040303036800306502307b794e465084c24487461b4570ff5899def4fda4d255a6202d74d634bc41a3505f012756b4be277506af122e75988dfc0231008bf5776cd4c865aae00b2cee149d2737a4f953a551e42983d7f890315b429f0af5feae0068e78c490fb66f5b5b15f2e7	winlogin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4908	2026-08-24_5b9efc9e6ceeeac4e63de1ccb5e1eb26_amadey_elex_emotet_gh0st_nymaim_rhadamanthys_smoke-loader_stop_wannacry.exe
4908	2026-08-24_5b9efc9e6ceeeac4e63de1ccb5e1eb26_amadey_elex_emotet_gh0st_nymaim_rhadamanthys_smoke-loader_stop_wannacry.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	winlogin.exe
Token: SeDebugPrivilege	4748	winlogin.exe
Token: SeDebugPrivilege	2556	winlogin.exe
Token: SeDebugPrivilege	5776	winlogin.exe
Token: SeDebugPrivilege	4864	winlogin.exe
Token: SeDebugPrivilege	5796	winlogin.exe
Token: SeDebugPrivilege	2916	winlogin.exe
Token: SeDebugPrivilege	1732	winlogin.exe
Token: SeDebugPrivilege	4084	winlogin.exe
Token: SeDebugPrivilege	1416	winlogin.exe
Token: SeDebugPrivilege	3256	winlogin.exe
Token: SeDebugPrivilege	4300	winlogin.exe
Token: SeDebugPrivilege	5956	winlogin.exe
Token: SeDebugPrivilege	4220	winlogin.exe
Token: SeDebugPrivilege	2432	winlogin.exe
Token: SeDebugPrivilege	4088	winlogin.exe
Token: SeDebugPrivilege	3040	winlogin.exe
Token: SeDebugPrivilege	5588	winlogin.exe
Token: SeDebugPrivilege	4712	winlogin.exe
Token: SeDebugPrivilege	1616	winlogin.exe
Token: SeDebugPrivilege	3556	winlogin.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4748	4980	winlogin.exe	91
PID 4908 wrote to memory of 4476	4908	2026-08-24_5b9efc9e6ceeeac4e63de1ccb5e1eb26_amadey_elex_emotet_gh0st_nymaim_rhadamanthys_smoke-loader_stop_wannacry.exe	92
PID 4748 wrote to memory of 2556	4748	winlogin.exe	93
PID 2556 wrote to memory of 5776	2556	winlogin.exe	95
PID 5776 wrote to memory of 4864	5776	winlogin.exe	96
PID 4864 wrote to memory of 5796	4864	winlogin.exe	97
PID 5796 wrote to memory of 2916	5796	winlogin.exe	98
PID 2916 wrote to memory of 1732	2916	winlogin.exe	99
PID 1732 wrote to memory of 4084	1732	winlogin.exe	100
PID 4084 wrote to memory of 1416	4084	winlogin.exe	101
PID 1416 wrote to memory of 3256	1416	winlogin.exe	102
PID 3256 wrote to memory of 4300	3256	winlogin.exe	103
PID 4300 wrote to memory of 5956	4300	winlogin.exe	104
PID 5956 wrote to memory of 4220	5956	winlogin.exe	105
PID 4220 wrote to memory of 2432	4220	winlogin.exe	106
PID 2432 wrote to memory of 4088	2432	winlogin.exe	107
PID 4088 wrote to memory of 3040	4088	winlogin.exe	111
PID 3040 wrote to memory of 5588	3040	winlogin.exe	114
PID 5588 wrote to memory of 4712	5588	winlogin.exe	115
PID 4712 wrote to memory of 1616	4712	winlogin.exe	116
PID 1616 wrote to memory of 3556	1616	winlogin.exe	117
PID 3556 wrote to memory of 2676	3556	winlogin.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-08-24_5b9efc9e6ceeeac4e63de1ccb5e1eb26_amadey_elex_emotet_gh0st_nymaim_rhadamanthys_smoke-loader_stop_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_5b9efc9e6ceeeac4e63de1ccb5e1eb26_amadey_elex_emotet_gh0st_nymaim_rhadamanthys_smoke-loader_stop_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\3790.vbs"
  2⤵
  - Deletes itself
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4476

C:\Windows\winlogin.exe
C:\Windows\winlogin.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\winlogin.exe
  C:\Windows\winlogin.exe Win7
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\winlogin.exe
    C:\Windows\winlogin.exe Win7
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\winlogin.exe
      C:\Windows\winlogin.exe Win7
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5776
    - - C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4864
      - C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5796
        
        C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1416
        
        C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4300
        
        C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5956
        
        C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        14⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4220
        
        C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        18⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5588
        
        C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4712
        
        C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        20⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3556
        
        C:\Windows\winlogin.exe
        
        C:\Windows\winlogin.exe Win7
        22⤵
        Executes dropped EXE
        
        PID:2676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1780
    3⤵
    - Program crash
    PID:4736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 1856
  2⤵
  - Program crash
  PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4748 -ip 4748
1⤵
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4980 -ip 4980
1⤵
PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Visual Basic

1

T1059.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3790.vbs

Path C:\3790.vbs
Size 500B
SHA256 fa1ccffa46f1a267fef5b352bf539245817e7a758192554541c7845988f5760d
MD5 6a11cc8b7cb445d4f7c1fb842137157e
SHA1 9c27b6714b145b13933036f97568b8808287647e
SHA512 818e238f874753731014949c16ed3062c04e90a5f757e49d23dadceeb951149337f5adba10243381aaa0aee89d93b9bb5730352091ecf0997b59949e59760038
TLSH
T186F0614A5D77C53FC535C2B306F1D40EC260F408541AF31826C0D6EC999ABB41E5E573
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
Size 355B
SHA256 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
MD5 53ae64e9ee4ba962ee4b516077735710
SHA1 dae8a6fd15a9c447cdb2778f63880db25b0dd198
SHA512 ec31df0d1fbf225bc5a884ee8324aab6e2aa43031bede210b04677ed825966c8ebc0693b06d8f0e55de2cd5919b95a7b25691b6ae1fab893f58756e08836a168
TLSH
T1BFE0C08867AC24200AB19E539550C4936FBE31892970B05C8251CBED30C1A58C28B30F
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 283B
SHA256 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
MD5 7f9d3dc54f928bf6c38576705ad18203
SHA1 2b5e33e5301753684973bfddbc6cfb11d297cf90
SHA512 ef5b01e74a5e49cd0fe887b9d92d830e1052bd93cda7d11ee68829705432a21a9943535de8dff9d77eb3402253adf9d5760eda03ca80a0c3495f83396d648967
TLSH
T102D0C29CA9273E660FE69B454A50C087AEE610CA9C15B648008EC45B0887B02EA962AE
MD5 SHA1 SHA512 TLSH

Submit Download

EC408523CFEB39121BE33594D22453B7

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EC408523CFEB39121BE33594D22453B7
Size 53KB
SHA256 507d0d825b195566a80846342791531f934242dff6f8466c1e80d296ca7cfa08
MD5 37687c3165832a74d46f73e87915cd3d
SHA1 e8a97483c41676f2d2441c054163fac4e042e919
SHA512 2a9d191c21f742b4900cf35d5ffcbdafa18f6d5ddb92b6bcaec107d6bc0fba8783f226ba6e7940f8ff15047381a993b7d8e7a510cf07f0f0050ebba28803d590
SSDEEP 1536:eSHmZISFLjv0OtMLcHYDo3wJ/bdLOnyWe:xSiVrJ/pLF
TLSH
T1F5331DA87C3BB6A2DD07CF518DDE9A975EE542D72952832F0E30AE505C13A9FDB53080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Size 192B
SHA256 f40c0963380a81a34b92593d13dcb5a7e5cca8a82977814c6afc1ef064b1b3fb
MD5 ee88608a040c72ff48a377318946bb85
SHA1 6c0ddec83c3fef37755e79b783e93fcfe7e125d6
SHA512 4c8c9408cdb6f14a338c2c3ef56a7fc836653f8a2f8980745983703c049355864c09f9e8802d50f9ec23e22d5393ea64a002ed8f221c4c9ec603a6b17717d286
TLSH
T1C2C08C1C4AA3060AF2E4437D12C12D039B20A420F2858F011AB13A08DC21F502C38C28
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 192B
SHA256 f7529aff0ffccc8f9978b4ae55d4d82c836915d64498afdf94d4cf5c9e1f48f5
MD5 d453af297304492cd5f5a137969bc3c8
SHA1 9a4f9f8199547cc3e6455593ce473e74968cc8c5
SHA512 1a9ae56e7c82575e6be39f2ade8d64ada2ea1e0d68cc065582309d121ef945b407d3bb82d38eed35042d23c42fd7d3f428cdd5359107d2668f3a9cc510284400
TLSH
T18FC08C181FAA0606E2EC0BBE22D02A839A14E001F2818F0A263A2A488C10B141C30C1C
MD5 SHA1 SHA512 TLSH

Submit Download

EC408523CFEB39121BE33594D22453B7

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EC408523CFEB39121BE33594D22453B7
Size 248B
SHA256 de186e4d09090312068bded8bc761e2184cc8ba4555e1f059f42fe02a1d2ec8b
MD5 bc6c8abba734de63677e3b78db89fa16
SHA1 dde1d5d83aaf37171496147fee6c0cc22760353b
SHA512 db074ed196137d8755c4e8463d1573a65e2dd3e6c98a390fda565f2015c5cfb0290c3fb39738666811ec7a5e632591bd783bd79ea53fc57d02135a6ac005bc10
TLSH
T10DD0223437620325FEB58739BC7003886A2EBA2BA0420F8D0B72025C0C0BB230CB2C4C
MD5 SHA1 SHA512 TLSH

Submit Download

winlogin.exe

Path C:\Windows\winlogin.exe
Size 15.4MB
SHA256 cabf48001bf51ae6946d3a6aa48485db6e511b97c2a8043dbb2e956dbb2fac09
MD5 5b9efc9e6ceeeac4e63de1ccb5e1eb26
SHA1 e0c845bb65de432eec9f43229c576d794f3eed15
SHA512 290f5d29af07a69abce333a445e099861c9f4b2d49dfc67bef7a285234729f9471f6f7419399dadd07a55c99a457c0a8fd28a6e65a721de29f9cdea48c2efac3
SSDEEP 98304:abSoPdVa5AgFoQkO743BRBRBRBix432BRBRBRBix4ujnbBRBRBRBix4ivX9/ig6y:aG8dVaXGOsNhjGCAc3K9pMw
TLSH
T1E5F674E19ACC1659E3E59479CD7F508601CA3C41B72F8B96B16C3C6F6F2A0DAF215C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads