rahiwi | 2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a

Analysis

max time kernel
149s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Size 6.2MB
Sample260916-247anafd44
SHA256 2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a
MD5 3fb9c00d695a34d5c3ca2498d338fe7f
SHA1 be6a2c184af85291867f89d4fdb528d5627fd069
SHA512 130d746d359fe9a0daeddd15252338b141c9eed2846669b34b038c70b44d8636f74849e5464a976afd05cb4c1b95022c18abc419ddba4ffb3e08a2f34aaec55a
SSDEEP 49152:HGiBGi2Gi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGiw:
TLSH
T1C766D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery rahiwi persistence spyware stealer worm

Malware Config

Signatures

Family: Rahiwi
Rahiwi is a Windows worm written in VisualBasic.
worm rahiwi

Detects Rahiwi worm 42 IoCs

resource	yara_rule
behavioral1/memory/3904-125-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/3584-131-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/3516-294-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/1112-298-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/2516-296-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/4672-292-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/4108-304-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/512-319-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/512-333-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/1812-331-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/1300-334-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/4156-329-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/4912-343-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/1524-328-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/4112-364-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/3652-387-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/1884-394-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/2124-393-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/4700-391-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/2352-388-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/4156-362-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/3324-359-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/1524-356-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/1140-327-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/4328-325-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/4940-324-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/5096-321-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/1480-318-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/772-314-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/3464-289-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/2240-274-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/468-272-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/4644-269-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/2516-268-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/3956-267-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/4400-180-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/2240-179-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/3956-395-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/4644-396-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/3464-398-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/468-397-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi
behavioral1/memory/4672-399-0x0000000000400000-0x000000000042B000-memory.dmp	family_rahiwi

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	Tiwi.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cute.exe

Disables RegEdit via registry modification 6 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Tiwi.exe

Disables Task Manager via registry modification
defense_evasion

Disables cmd.exe use via registry modification 6 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe

Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Executes dropped EXE 31 IoCs

pid	Process
3956	Tiwi.exe
4644	IExplorer.exe
468	winlogon.exe
3464	imoet.exe
4672	cute.exe
3584	tiwi.exe
4400	Tiwi.exe
2240	IExplorer.exe
3516	Tiwi.exe
1112	Tiwi.exe
2516	Tiwi.exe
4108	winlogon.exe
772	IExplorer.exe
5096	Tiwi.exe
4940	IExplorer.exe
1480	IExplorer.exe
4328	imoet.exe
1140	winlogon.exe
1812	winlogon.exe
4912	IExplorer.exe
512	winlogon.exe
1524	cute.exe
4156	imoet.exe
1300	imoet.exe
4112	imoet.exe
3324	winlogon.exe
3652	cute.exe
2352	imoet.exe
4700	cute.exe
2124	cute.exe
1884	cute.exe

Loads dropped DLL 6 IoCs

pid	Process
3584	tiwi.exe
4400	Tiwi.exe
3516	Tiwi.exe
1112	Tiwi.exe
2516	Tiwi.exe
5096	Tiwi.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	cute.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	winlogon.exe
File opened (read-only)	\??\X:	winlogon.exe
File opened (read-only)	\??\E:	cute.exe
File opened (read-only)	\??\H:	cute.exe
File opened (read-only)	\??\L:	cute.exe
File opened (read-only)	\??\H:	Tiwi.exe
File opened (read-only)	\??\K:	IExplorer.exe
File opened (read-only)	\??\E:	imoet.exe
File opened (read-only)	\??\H:	imoet.exe
File opened (read-only)	\??\O:	imoet.exe
File opened (read-only)	\??\R:	imoet.exe
File opened (read-only)	\??\R:	winlogon.exe
File opened (read-only)	\??\U:	cute.exe
File opened (read-only)	\??\P:	imoet.exe
File opened (read-only)	\??\Z:	imoet.exe
File opened (read-only)	\??\T:	winlogon.exe
File opened (read-only)	\??\U:	winlogon.exe
File opened (read-only)	\??\P:	cute.exe
File opened (read-only)	\??\Y:	cute.exe
File opened (read-only)	\??\V:	Tiwi.exe
File opened (read-only)	\??\W:	IExplorer.exe
File opened (read-only)	\??\S:	imoet.exe
File opened (read-only)	\??\B:	winlogon.exe
File opened (read-only)	\??\I:	winlogon.exe
File opened (read-only)	\??\M:	winlogon.exe
File opened (read-only)	\??\V:	cute.exe
File opened (read-only)	\??\R:	Tiwi.exe
File opened (read-only)	\??\Y:	Tiwi.exe
File opened (read-only)	\??\R:	IExplorer.exe
File opened (read-only)	\??\Q:	imoet.exe
File opened (read-only)	\??\W:	winlogon.exe
File opened (read-only)	\??\B:	cute.exe
File opened (read-only)	\??\S:	cute.exe
File opened (read-only)	\??\B:	imoet.exe
File opened (read-only)	\??\E:	winlogon.exe
File opened (read-only)	\??\H:	winlogon.exe
File opened (read-only)	\??\X:	cute.exe
File opened (read-only)	\??\W:	Tiwi.exe
File opened (read-only)	\??\L:	IExplorer.exe
File opened (read-only)	\??\O:	IExplorer.exe
File opened (read-only)	\??\V:	imoet.exe
File opened (read-only)	\??\K:	winlogon.exe
File opened (read-only)	\??\O:	winlogon.exe
File opened (read-only)	\??\S:	winlogon.exe
File opened (read-only)	\??\N:	cute.exe
File opened (read-only)	\??\E:	Tiwi.exe
File opened (read-only)	\??\E:	IExplorer.exe
File opened (read-only)	\??\K:	imoet.exe
File opened (read-only)	\??\M:	imoet.exe
File opened (read-only)	\??\Q:	cute.exe
File opened (read-only)	\??\T:	cute.exe
File opened (read-only)	\??\W:	cute.exe
File opened (read-only)	\??\N:	Tiwi.exe
File opened (read-only)	\??\G:	IExplorer.exe
File opened (read-only)	\??\N:	imoet.exe
File opened (read-only)	\??\W:	imoet.exe
File opened (read-only)	\??\Y:	imoet.exe
File opened (read-only)	\??\J:	cute.exe
File opened (read-only)	\??\J:	Tiwi.exe
File opened (read-only)	\??\L:	Tiwi.exe
File opened (read-only)	\??\S:	Tiwi.exe
File opened (read-only)	\??\T:	Tiwi.exe
File opened (read-only)	\??\H:	IExplorer.exe
File opened (read-only)	\??\S:	IExplorer.exe

Modifies WinLogon 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	cute.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	Tiwi.exe
File opened for modification	C:\autorun.inf	Tiwi.exe
File created	F:\autorun.inf	Tiwi.exe
File opened for modification	F:\autorun.inf	Tiwi.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	IExplorer.exe
File created	C:\Windows\SysWOW64\shell.exe	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	cute.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\tiwi.scr	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	Tiwi.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	Tiwi.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	imoet.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	cute.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	IExplorer.exe
File created	C:\Windows\tiwi.exe	cute.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
File created	C:\Windows\tiwi.exe	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	imoet.exe
File opened for modification	C:\Windows\tiwi.exe	Tiwi.exe
File opened for modification	C:\Windows\tiwi.exe	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	winlogon.exe
File opened for modification	C:\Windows\tiwi.exe	imoet.exe
File opened for modification	C:\Windows\tiwi.exe	cute.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	Tiwi.exe
File created	C:\Windows\tiwi.exe	winlogon.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imoet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tiwi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tiwi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tiwi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tiwi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imoet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cute.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tiwi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cute.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imoet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imoet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cute.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imoet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cute.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cute.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imoet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tiwi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cute.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tiwi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe

Modifies Control Panel 54 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\s2359 = "Tiwi"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Mouse\SwapMouseButtons = "1"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Mouse\SwapMouseButtons = "1"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\s2359 = "Tiwi"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Mouse\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\s2359 = "Tiwi"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Mouse\SwapMouseButtons = "1"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\s2359 = "Tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Mouse\	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Mouse\SwapMouseButtons = "1"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\s1159 = "Tiwi"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Mouse\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Mouse\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Mouse\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\s2359 = "Tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Mouse\SwapMouseButtons = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\s1159 = "Tiwi"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Mouse\	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\s1159 = "Tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\s2359 = "Tiwi"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\s1159 = "Tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\s1159 = "Tiwi"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Mouse\SwapMouseButtons = "1"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\s1159 = "Tiwi"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	cute.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\	cute.exe

Modifies Internet Explorer start page 1 TTPs 6 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	imoet.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	imoet.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3904	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
3904	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
3956	Tiwi.exe
3464	imoet.exe
468	winlogon.exe
4644	IExplorer.exe
4672	cute.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
3904	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
3956	Tiwi.exe
4644	IExplorer.exe
468	winlogon.exe
3464	imoet.exe
4672	cute.exe
3584	tiwi.exe
4400	Tiwi.exe
2240	IExplorer.exe
3516	Tiwi.exe
1112	Tiwi.exe
2516	Tiwi.exe
4108	winlogon.exe
772	IExplorer.exe
1480	IExplorer.exe
5096	Tiwi.exe
4940	IExplorer.exe
4328	imoet.exe
1140	winlogon.exe
1812	winlogon.exe
512	winlogon.exe
1524	cute.exe
4156	imoet.exe
3324	winlogon.exe
1300	imoet.exe
4112	imoet.exe
3652	cute.exe
2352	imoet.exe
4700	cute.exe
2124	cute.exe
1884	cute.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 3956	3904	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe	90
PID 3904 wrote to memory of 4644	3904	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe	91
PID 3904 wrote to memory of 468	3904	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe	92
PID 3904 wrote to memory of 3464	3904	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe	93
PID 3904 wrote to memory of 4672	3904	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe	94
PID 3956 wrote to memory of 4400	3956	Tiwi.exe	98
PID 3956 wrote to memory of 2240	3956	Tiwi.exe	99
PID 4644 wrote to memory of 3516	4644	IExplorer.exe	100
PID 468 wrote to memory of 1112	468	winlogon.exe	101
PID 3464 wrote to memory of 2516	3464	imoet.exe	103
PID 3956 wrote to memory of 4108	3956	Tiwi.exe	102
PID 4644 wrote to memory of 772	4644	IExplorer.exe	104
PID 4672 wrote to memory of 5096	4672	cute.exe	105
PID 468 wrote to memory of 4940	468	winlogon.exe	106
PID 3464 wrote to memory of 1480	3464	imoet.exe	107
PID 3956 wrote to memory of 4328	3956	Tiwi.exe	108
PID 4644 wrote to memory of 1140	4644	IExplorer.exe	109
PID 3464 wrote to memory of 1812	3464	imoet.exe	110
PID 4672 wrote to memory of 4912	4672	cute.exe	111
PID 468 wrote to memory of 512	468	winlogon.exe	112
PID 3956 wrote to memory of 1524	3956	Tiwi.exe	113
PID 4644 wrote to memory of 4156	4644	IExplorer.exe	114
PID 468 wrote to memory of 4112	468	winlogon.exe	116
PID 3464 wrote to memory of 1300	3464	imoet.exe	115
PID 4672 wrote to memory of 3324	4672	cute.exe	117
PID 4644 wrote to memory of 3652	4644	IExplorer.exe	118
PID 4672 wrote to memory of 2352	4672	cute.exe	119
PID 468 wrote to memory of 2124	468	winlogon.exe	120
PID 3464 wrote to memory of 4700	3464	imoet.exe	121
PID 4672 wrote to memory of 1884	4672	cute.exe	122

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe

C:\Users\Admin\AppData\Local\Temp\2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe
"C:\Users\Admin\AppData\Local\Temp\2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3904
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3956
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4400
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2240
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4108
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4328
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1524
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4644
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3516
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:772
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1140
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4156
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3652
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:468
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1112
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4940
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:512
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4112
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2124
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3464
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2516
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1480
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1812
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1300
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4700
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4672
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5096
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4912
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3324
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2352
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1884

C:\Windows\tiwi.exe
C:\Windows\tiwi
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
Size 45KB
SHA256 2c7a60518a4c60b09ec50cd841eca641f6d303adde3b85587e6763b6fb4ae5e9
MD5 4d52da5c14e94b699620988803dcdbcb
SHA1 4dc53361116abd1ab320162fb733bbbd4c42f1c9
SHA512 8b93f62de12f8f0e208366a6bc91000074339d7280b4a8389c89bb13deebf97830baea4e33013f9223c3ab795b5c780eb964e10a4ca9ceb01f390698acfa81d7
SSDEEP 6:oP9z2q6L9AGEPAvzkCIRVprKFHIyPjsYOlllDY2q6L9AG7:oPl6L9AjArkC4rKFloYwlD26L9As
TLSH
T1172326C171B8A4DED90804BB0789C089C1046903098C7AA9674462B42A631455C08C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cute.exe

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
Size 6.2MB
SHA256 543570a1c06fd71daad034e6aab28706cc000a59e84cd657f050da7151e5c78e
MD5 99a4afd5a2d3e45bab6f5b481199cffd
SHA1 a9930e4046b7261dacd5e493762c454d623f440f
SHA512 0c7114f850e477e6cf172be5fd48581b1bfa6d9dd2dbd7eb8ca5e1812c95317cfa6b667e9b2e496a6bbb6a716464ffcf80e6f3f999910dec36d3c1e3f572bd61
SSDEEP 49152:HGi6Gi2Gi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGiw:
TLSH
T19C66D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imoet.exe

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
Size 6.2MB
SHA256 cad44b090fdbe9c7373d934321f5dff9be3066398d6f840360edacc37f1f4aaa
MD5 f3a0dd967470392002a8d435308c0ff7
SHA1 a76347e273f1535ec80b6980ce4057c703f625b0
SHA512 2ef17f577d87e5d40a0cd7a5d02b0086bd84a0b1643693d8817588ea10be39f4881c3abc0368fff8ec61655f81a4771619f4866c7e80e474885f52261c421a09
SSDEEP 49152:HGi9Gi2Gi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGiw:
TLSH
T1D866D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsass.exe

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
Size 45KB
SHA256 9fb3552f8ce56423ba742e98e9f7ee4a22f4b376b7548158219abd54cae18f03
MD5 0f4c62494f09654aea9e900f84275d00
SHA1 80719a3ec8ddcc63be5fc23a61cf6baf40e5b59e
SHA512 22753d8fcc58ae64466b1367c7b043980a3f449f418006bb604d3e409dcd49b841f94d7a37318086e5dfe14634b86f541568ac53fb41b303548ed17b003f2a1e
SSDEEP 6:vdyUi4aWYaVcrKByr1TAchROJWNPyx/rbgXYoHU7z3TXXu:IU/caKKByr1buWlyVbWYaU7zDHu
TLSH
T10B2328E324D38141C5437C3B18FE72C6F048D9071DC20992132D60176DCE308C53152F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsass.exe

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
Size 45KB
SHA256 c88e8cd087132061c51e792cbe7f28d419e68245f3ab5687a9cba77f68bdb82d
MD5 3829115c1c99254b8b4c2a96c5eccd5a
SHA1 cb73ab3e62a575b0341f1dd808562607e86eed55
SHA512 34cf11a396d6a020022abef328cee4e1bcbbbee6b68e8df86bbe29a1badcac95e2d443a6606edc52f3029a1fd87985b928e96806a596754747a334b01c011705
SSDEEP 6:a1wIbHj09UswDEJBEnxw9b26wYgS0hfG4QVLUMJfusM4ubw61wIpP7:xIbo93+xm6ZMJVM4Uw6aIp
TLSH
T1A5237D982DB90494FE14403BD00F6F2DA992C6DB15DC4F66C3118668D0174415444E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsass.exe

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
Size 45KB
SHA256 5fad569f232ab4618c69040910c9aa222aa3c4ee700dd873bcd696c930c834e2
MD5 84de7e93967f3915a9a4f50de18d010b
SHA1 9130a6089d390707740886dc3b1a05337ed1df6a
SHA512 10288b543237013286a044367883cfbf010668dc9c1b142b342c85202404aaf0bc566b53ca41ac1b073e1b1f7fdbbb4d1a06fc3206e29ae02dbbd94fbfb73ae0
SSDEEP 6:fOtsS4/kTw9b26wYgS0hfG4QVLUMJfusM4ubw61wIpP7:fOtsSwkTm6ZMJVM4Uw6aIp
TLSH
T15E232D446D2E49C2CB0440B3C00FEF1CDA66CDD330C843B00B200899A013045A400FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smss.exe

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe
Size 6.2MB
SHA256 ada2149d5ee1bc16c028758a27715eb62d1f504a0673e3a4dd44a5b08748b85a
MD5 4029294fe37cee6b392be9c6fdb83e40
SHA1 8f2194fbf792a073384b2ae76967470ee9cd0e96
SHA512 63ceeca2d5b694f32c1638a3908e80d1591c51e27fd982bf93bfea57a20188ef26d88a50ab8f56073b31a4450295e9134943ea3b6c4c919aecf4d727f54a4a06
SSDEEP 49152:HGiKGi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGi2Gih:
TLSH
T11F66D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon.exe

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
Size 6.2MB
SHA256 eb10969f9bfdd6ce78804c3c9c4b74da604521df270fa60a2ae82bb2d3926f1f
MD5 d72c9f97a671d79244c105e7c0a01aa9
SHA1 c2ae5f7b2107631cfc326a15b73b890e819bdadc
SHA512 c6c15be7f5163bd65866dfeea4961c127d2e1bcf263db679aab3077a4133b951bbff1652d25d21e5b3f58e476dc490b38973f9164ff3e9016f6d2b71cde23018
SSDEEP 49152:HGiaGi2Gi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGiw:
TLSH
T12D66D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Empty.pif

Path C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Size 6.2MB
SHA256 f7321cc22386b5f27d184fe7f2b30907aa7d5e7864d1cb686d0d26b8393ca892
MD5 8bcf06d69e5413bf877045d871258ca0
SHA1 5be07db3becc4b0da6904b3fa733d8ed3770d1af
SHA512 bdbf29e436aa7f2860ca32f25b68928e43bc48f99a0d345f40e1217159842987ae0e0e7a8b58d93207c3c1bf22606cefca59ad32399b0095e5746dea335e250d
SSDEEP 49152:HGi3Gi2Gi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGiw:
TLSH
T13B66D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Empty.pif

Path C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Size 6.2MB
SHA256 c18266be58450155a70b569b9a0c5397cf7b4b4ee604a2f8891830abe804ac93
MD5 71c4ed3db6f6154620f2951e0143c804
SHA1 1bbe93f9aa3c9018a346dd3b2078c3b765a7ac36
SHA512 a4c2f9efad415fb12729f7133d0c525e93fc2b4d811abe0d09d4a5c8118450f06f1170f909794cc727a5b8dcf23a895b3c93d77951f25ca49d6dc92878c40467
SSDEEP 49152:HGiGGi2Gi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGiw:
TLSH
T12566D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 6.2MB
SHA256 0a32725f141e12ebb48d42bfa4eea6940c1efd4ef583123c627d8b500fa27d9b
MD5 1e85d6707ff5bc3505360421e38f6a7f
SHA1 5b718f0623217dbc89500f7acab568bf913faafd
SHA512 632c767a5277a32443f635e62a780e938ae1284c6dbfd8d7c165e9fca8a845fba7e8f98449cba1125ff60a490fbffadde53d30b76ba86f908266907e2e632505
SSDEEP 49152:HGi/Gi2Gi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGiw:
TLSH
T10366D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shell.exe

Path C:\Windows\SysWOW64\shell.exe
Size 6.2MB
SHA256 96089c5fecfb43d87507dde5c902006b4d0f4ba6ad14c8fea9bdb7fef3634493
MD5 2ab5592ac1b8275da3db302f5330e092
SHA1 e0129e7fb8dc1fdc9af15206acaffaf36998efc2
SHA512 7ca1d243b9c5cb8c7df13f06647ccc1777663ac346fc611019254dadb4ba2b4f5084eaac2b94dbff2af308deedf1d8c63a685f3ee9ccca099ba4763f882d8377
SSDEEP 49152:HGiyGi2Gi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGiw:
TLSH
T1EA66D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shell.exe

Path C:\Windows\SysWOW64\shell.exe
Size 6.2MB
SHA256 0b44fbb2a40c3ba455a08e1df233e59e8a1421cc87400f1fa80e476d4d1bedfe
MD5 501606b81e4657282f57bfd3f05d91da
SHA1 6e2922cfce4f629fb3fee7d6933cc23ef6cd0f20
SHA512 2852c9a8beb9989dbc2627a0a3ddfb2e13c7f61a362bf4ec9f5e6b6bc162c0d8b46d0b8532fe0216ce0da5be0caa2c76adb67ea649c51a150db818f3caeee4b7
SSDEEP 49152:HGi5Gi2Gi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGiw:
TLSH
T11E66D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shell.exe

Path C:\Windows\SysWOW64\shell.exe
Size 6.2MB
SHA256 3cd50e0062f8bb56b232ea109ab349f1b2760c955314216b0de5d75891be9882
MD5 2be86f76074bba95896a15fec1661790
SHA1 8524e9be994eb2f836e1bd6b2fded2b962eb6bf4
SHA512 c1440b47ade76767e9bb11913012d2810d887880ef302ede4a95938c83ad4dbd4eea56ee35237af6fe2d6eea09646aaa926dc49e11049664712d66c268aad796
SSDEEP 49152:HGilGi2Gi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGiw:
TLSH
T17466D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shell.exe

Path C:\Windows\SysWOW64\shell.exe
Size 6.2MB
SHA256 2a656974f5e85bed2be088a375113915ddf302101247a315a6cd5f9b6fedd51a
MD5 3fb9c00d695a34d5c3ca2498d338fe7f
SHA1 be6a2c184af85291867f89d4fdb528d5627fd069
SHA512 130d746d359fe9a0daeddd15252338b141c9eed2846669b34b038c70b44d8636f74849e5464a976afd05cb4c1b95022c18abc419ddba4ffb3e08a2f34aaec55a
SSDEEP 49152:HGiBGi2Gi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGiw:
TLSH
T1C766D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tiwi.scr

Path C:\Windows\SysWOW64\tiwi.scr
Size 6.2MB
SHA256 99692c11e85d412db8a0a3266fb7aa06be14de12116fd5fd65e3f6330c84ddef
MD5 3d74c125a60168072f18522920ced80a
SHA1 584ea2fdfc2935fd719a312e4603cd4b2178ea3b
SHA512 ca60f10d4de6bab808dbad47e5246b2a2e08be69c6850c6e8757670438cb1657d4100ba28a1fc968bc6ed36ee641a29d9d870cbe924e2feabc68cd2a684c0fb1
SSDEEP 49152:HGiCGi2Gi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGiw:
TLSH
T10E66D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tiwi.scr

Path C:\Windows\SysWOW64\tiwi.scr
Size 6.2MB
SHA256 f77630c875f2c12518265d93115450adc5547dff0c2fa06b18528e0c680ba4ef
MD5 397b8af1fffb49780a0b9f8021f22fcc
SHA1 c4a845ad61f26c753bfafbd95afc530051e9e225
SHA512 5427beddae2cffaf121e80d6d9f3097ca44b26deae5ab0db5093fc0bddaca80fdc7d22dd4e8a179e6553de119cad6a41af35da21f4d42d219575293fdaa33659
SSDEEP 49152:HGiGGi2Gi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGiw:
TLSH
T16D66D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tiwi.exe

Path C:\Windows\Tiwi.exe
Size 6.2MB
SHA256 5b6e8e336e4f363a0c609fa5e32f6719ff26d5e57855c9adcfa6869660a84105
MD5 4033353796129f850517ea88a17da7cd
SHA1 3d61551c52eac7479166e3d92693ec2fe04066a6
SHA512 f1c66669b1d0dc446d917558b8c416f853b6182c1e347e0d05709a8fb0f61002de960a4a90880612a6cc1ec79cd43efe0e6b0422a736bff7d8101054f047b851
SSDEEP 49152:HGiKGi2Gi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGiw:
TLSH
T1BD66D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvbvm60.dll

Path C:\Windows\msvbvm60.dll
Size 1.4MB
SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
MD5 25f62c02619174b35851b0e0455b3d94
SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
TLSH
T102659E1337D08162D7A3653449176379B7BC6D119836ED4BAFA0394F2D33B01A72BB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

present.txt

Path C:\present.txt
Size 729B
SHA256 574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad
MD5 8e3c734e8dd87d639fb51500d42694b5
SHA1 f76371d31eed9663e9a4fd7cb95f54dcfc51f87f
SHA512 06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853
TLSH
T1B101239C96C322D8633012C550CE4CB53F3D5704DB699A217D2DA36C5B908D88468D6C
MD5 SHA1 SHA512 TLSH

Submit Download

tiwi.exe

Path C:\tiwi.exe
Size 6.2MB
SHA256 06ddfca264af5598de15abe38a622106162f41fda441e68f013650cf8c41c923
MD5 d4c7883afa46456dde87670b082ccf5e
SHA1 5c246f03585c5fe0956c621ec75b92200c522e33
SHA512 a9e6d97365dca994feaf650c263ced98c08f3653941847801fbc12c81bcebae9d9eb20a9ab8b9ec21b06f1db0fbf9f56e38c85eab3152d90be21e5ceb12c2b2d
SSDEEP 49152:HGiEGi2Gi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGiw:
TLSH
T1EE66D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tiwi.exe

Path C:\tiwi.exe
Size 6.2MB
SHA256 cc3462779036dd1d2d104788a17a06437aa11ebc7f22a3c9200a93b954034cfd
MD5 b5d5687c0152c2ab1424a17e9713b972
SHA1 1fcbab95616cb93fe16c5326b056a6972d58199e
SHA512 14af3fdc89b001dca530c50ab68c0fa2bf61053092b4c694528045697f6359009e6091c6680d39af1bdfcd9082cac8fe5aa18ecfd7fb01068eb0a58269336506
SSDEEP 49152:HGirGi2Gi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGiw:
TLSH
T18A66D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tiwi.exe

Path C:\tiwi.exe
Size 6.2MB
SHA256 170a8c75cda248fc82a7665a2edae99c55d2fbc7f26121aa44125f9a0b6b6c0e
MD5 7b77acbbed0e6a30f2db11094dab709b
SHA1 6a49d00e12bbf98ca3a97ac481c9740ea7c90e35
SHA512 0041d3a80a2ba5e55b97fd66701aaae67a0a4ca7b3580399c75672d75d887e6101d717c4c15d56f6fd7f8478310f7fc5553f0d6aa58f27d83ff82136246e5d44
SSDEEP 49152:HGi2Gi2Gi2Gi2Gi2GiyGivGiNGimGitGirGiqGi6GihGivGiyGiqGiHGigGiAGiw:
TLSH
T1C166D10BB61B9889F954CC7948A24B6C336A7E72CF27796561553D732C3A0CB7D02E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autorun.inf

Path F:\autorun.inf
Size 39B
SHA256 e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e
MD5 415c421ba7ae46e77bdee3a681ecc156
SHA1 b0db5782b7688716d6fc83f7e650ffe1143201b7
SHA512 dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62
MD5 SHA1 SHA512

Submit Download

memory/468-109-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/468-272-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/468-397-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/512-333-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/512-319-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/772-314-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1112-298-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1140-308-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1140-327-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1300-334-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1480-318-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1524-328-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1524-356-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1812-331-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1884-394-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2124-393-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2240-274-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2240-179-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2352-388-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2516-296-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2516-268-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3324-359-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3464-398-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3464-116-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3464-289-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3516-294-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3584-131-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3652-387-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3904-125-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3904-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3956-267-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3956-96-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3956-395-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4108-304-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4112-364-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4156-329-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4156-362-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4328-325-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4400-161-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4400-180-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4644-269-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4644-101-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4644-396-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4672-122-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4672-292-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4672-399-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4700-391-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4700-367-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4912-343-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4940-290-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4940-324-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5096-321-0x0000000000400000-0x000000000042B000-memory.dmp

Download