Analysis
- max time kernel
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 22:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
28 signatures
150 seconds
General
- Target 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe
- Size 5.0MB
- Sample260916-2rb9rawerf
- SHA256 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897
- MD5 ef5e1db6f0b3a339f6ca87fbc7c176a2
- SHA1 6311287db361dd73e9abc638a456ddbe4bc5ca8e
- SHA512 d8c78b1207896ec16af20a0402c6cc15287da5a8c5913e7bc69effc615624cb108535930eab994647e9322ecae63229c1fbb1d287666240fab44ef58097b049f
- SSDEEP 49152:HGiDGi2GivGiZGi2Gi2Gi2Gi2Gi2Gi2GihGiZGi2Gi2Gi2Gi2Gi2Gi2GiyGivGit:B
- TLSH T12836D10BB61B9889F954CC7948628B6C336A7E72CF27796561553D732C3A0CB7D02E32
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Rahiwi worm 57 IoCs
resource yara_rule behavioral1/memory/2876-96-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4248-113-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/1480-142-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4248-144-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/1480-206-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4684-205-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4884-204-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4376-203-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/2876-202-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/636-201-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/412-244-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/412-249-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/2080-258-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/2740-252-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/1576-276-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/1480-280-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/1108-282-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/1768-303-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/2080-301-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4348-308-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4728-304-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/2096-298-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/3092-309-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/2600-312-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4192-322-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/1112-327-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/1772-329-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4192-336-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/3768-333-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/5044-325-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/3768-324-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/1772-320-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4728-318-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4524-342-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4960-347-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4404-353-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4536-345-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/3308-362-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/884-365-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/1184-367-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4900-373-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4404-371-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4340-363-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/2332-410-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/1164-414-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/3404-416-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/5080-412-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/2360-408-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/3500-436-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/1836-439-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/1292-443-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/636-445-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4376-446-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4884-447-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/4684-448-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/1480-449-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi behavioral1/memory/2876-450-0x0000000000400000-0x000000000042B000-memory.dmp family_rahiwi - Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" imoet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" cute.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" Tiwi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" Tiwi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" cute.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" imoet.exe - Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Tiwi.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" IExplorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cute.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" imoet.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" IExplorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cute.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" imoet.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Tiwi.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Tiwi.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" IExplorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cute.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" imoet.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe - Disables Task Manager via registry modification
- Disables cmd.exe use via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" IExplorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" cute.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" imoet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Tiwi.exe - Disables use of System Restore points 1 TTPs
- Executes dropped EXE 39 IoCs
pid Process 2876 Tiwi.exe 4376 IExplorer.exe 4248 tiwi.exe 4884 cute.exe 4684 winlogon.exe 1480 imoet.exe 412 Tiwi.exe 2740 Tiwi.exe 1576 Tiwi.exe 1108 Tiwi.exe 2096 Tiwi.exe 2080 IExplorer.exe 1768 IExplorer.exe 5044 IExplorer.exe 2600 IExplorer.exe 3092 IExplorer.exe 4348 winlogon.exe 4728 winlogon.exe 1112 Tiwi.exe 1772 winlogon.exe 4960 imoet.exe 4524 imoet.exe 4192 winlogon.exe 3768 winlogon.exe 4536 IExplorer.exe 884 imoet.exe 4340 imoet.exe 3308 imoet.exe 4404 cute.exe 1184 winlogon.exe 4900 cute.exe 2360 cute.exe 5080 cute.exe 1164 cute.exe 2332 imoet.exe 3404 winlogon.exe 3500 cute.exe 1836 imoet.exe 1292 cute.exe - Loads dropped DLL 7 IoCs
pid Process 4248 tiwi.exe 412 Tiwi.exe 2740 Tiwi.exe 1576 Tiwi.exe 2096 Tiwi.exe 1108 Tiwi.exe 1112 Tiwi.exe - Modifies system executable filetype association 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" imoet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" Tiwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" Tiwi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" Tiwi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" cute.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" imoet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command Tiwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" cute.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command imoet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command imoet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" imoet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command Tiwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command cute.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" imoet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" imoet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command Tiwi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" Tiwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" Tiwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command imoet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" Tiwi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" cute.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command imoet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" cute.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command cute.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command cute.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" imoet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command Tiwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command Tiwi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" cute.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command imoet.exe - Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi" cute.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe" cute.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi" IExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe" IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe" imoet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi" Tiwi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe" Tiwi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe" IExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe" imoet.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe" Tiwi.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe" cute.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe" cute.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi" imoet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe" imoet.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe" Tiwi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe" IExplorer.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened (read-only) \??\R: IExplorer.exe File opened (read-only) \??\I: imoet.exe File opened (read-only) \??\U: imoet.exe File opened (read-only) \??\R: 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened (read-only) \??\H: Tiwi.exe File opened (read-only) \??\L: cute.exe File opened (read-only) \??\U: cute.exe File opened (read-only) \??\P: IExplorer.exe File opened (read-only) \??\J: 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened (read-only) \??\O: 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened (read-only) \??\Q: Tiwi.exe File opened (read-only) \??\N: 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened (read-only) \??\V: Tiwi.exe File opened (read-only) \??\Z: Tiwi.exe File opened (read-only) \??\V: cute.exe File opened (read-only) \??\J: IExplorer.exe File opened (read-only) \??\J: winlogon.exe File opened (read-only) \??\Q: winlogon.exe File opened (read-only) \??\R: cute.exe File opened (read-only) \??\S: IExplorer.exe File opened (read-only) \??\R: imoet.exe File opened (read-only) \??\P: 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened (read-only) \??\S: cute.exe File opened (read-only) \??\I: winlogon.exe File opened (read-only) \??\R: winlogon.exe File opened (read-only) \??\G: IExplorer.exe File opened (read-only) \??\L: Tiwi.exe File opened (read-only) \??\O: winlogon.exe File opened (read-only) \??\P: winlogon.exe File opened (read-only) \??\W: imoet.exe File opened (read-only) \??\X: imoet.exe File opened (read-only) \??\Z: imoet.exe File opened (read-only) \??\K: 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened (read-only) \??\W: IExplorer.exe File opened (read-only) \??\J: imoet.exe File opened (read-only) \??\O: imoet.exe File opened (read-only) \??\Y: Tiwi.exe File opened (read-only) \??\U: Tiwi.exe File opened (read-only) \??\B: IExplorer.exe File opened (read-only) \??\L: imoet.exe File opened (read-only) \??\T: imoet.exe File opened (read-only) \??\Z: 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened (read-only) \??\G: cute.exe File opened (read-only) \??\P: cute.exe File opened (read-only) \??\Q: 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened (read-only) \??\I: 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened (read-only) \??\X: Tiwi.exe File opened (read-only) \??\X: cute.exe File opened (read-only) \??\X: IExplorer.exe File opened (read-only) \??\B: 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened (read-only) \??\T: Tiwi.exe File opened (read-only) \??\K: IExplorer.exe File opened (read-only) \??\U: IExplorer.exe File opened (read-only) \??\B: winlogon.exe File opened (read-only) \??\S: imoet.exe File opened (read-only) \??\E: 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened (read-only) \??\H: 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened (read-only) \??\V: 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened (read-only) \??\P: Tiwi.exe File opened (read-only) \??\N: winlogon.exe File opened (read-only) \??\S: winlogon.exe File opened (read-only) \??\Y: winlogon.exe File opened (read-only) \??\P: imoet.exe - Modifies WinLogon 2 TTPs 18 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P " imoet.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\ Tiwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\ IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P " winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\ 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum" Tiwi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum" IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\ cute.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\ imoet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum" imoet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P " IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P " cute.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum" cute.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P " 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P " Tiwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\ winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum" winlogon.exe - Drops autorun.inf file 1 TTPs 10 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf winlogon.exe File opened for modification C:\autorun.inf 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened for modification C:\autorun.inf Tiwi.exe File created F:\autorun.inf 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened for modification F:\autorun.inf 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File created C:\autorun.inf 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File created C:\autorun.inf Tiwi.exe File created C:\autorun.inf cute.exe File opened for modification C:\autorun.inf cute.exe File created C:\autorun.inf winlogon.exe - Drops file in System32 directory 40 IoCs
description ioc Process File created C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\shell.exe Tiwi.exe File created C:\Windows\SysWOW64\IExplorer.exe Tiwi.exe File opened for modification C:\Windows\SysWOW64\shell.exe cute.exe File created C:\Windows\SysWOW64\IExplorer.exe cute.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe imoet.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File created C:\Windows\SysWOW64\shell.exe 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened for modification C:\Windows\SysWOW64\tiwi.scr 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened for modification C:\Windows\SysWOW64\tiwi.scr cute.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe Tiwi.exe File opened for modification C:\Windows\SysWOW64\tiwi.scr imoet.exe File created C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\tiwi.scr Tiwi.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe cute.exe File created C:\Windows\SysWOW64\IExplorer.exe IExplorer.exe File opened for modification C:\Windows\SysWOW64\shell.exe imoet.exe File created C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File created C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File created C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\tiwi.scr IExplorer.exe File opened for modification C:\Windows\SysWOW64\tiwi.scr winlogon.exe File created C:\Windows\SysWOW64\IExplorer.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened for modification C:\Windows\SysWOW64\shell.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe IExplorer.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe winlogon.exe File created C:\Windows\SysWOW64\IExplorer.exe imoet.exe File created C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File created C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\shell.exe 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll IExplorer.exe File created C:\Windows\SysWOW64\tiwi.scr 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File created C:\Windows\SysWOW64\IExplorer.exe 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened for modification C:\Windows\SysWOW64\shell.exe IExplorer.exe - Drops file in Windows directory 26 IoCs
description ioc Process File created C:\Windows\tiwi.exe Tiwi.exe File created C:\Windows\tiwi.exe IExplorer.exe File opened for modification C:\Windows\tiwi.exe winlogon.exe File created C:\Windows\tiwi.exe imoet.exe File opened for modification C:\Windows\msvbvm60.dll IExplorer.exe File created C:\Windows\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\msvbvm60.dll IExplorer.exe File created C:\Windows\tiwi.exe 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File opened for modification C:\Windows\tiwi.exe cute.exe File created C:\Windows\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\msvbvm60.dll IExplorer.exe File created C:\Windows\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\msvbvm60.dll IExplorer.exe File created C:\Windows\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\tiwi.exe IExplorer.exe File created C:\Windows\tiwi.exe cute.exe File created C:\Windows\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\tiwi.exe 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe File created C:\Windows\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\msvbvm60.dll IExplorer.exe File created C:\Windows\tiwi.exe winlogon.exe File opened for modification C:\Windows\tiwi.exe imoet.exe File created C:\Windows\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\msvbvm60.dll IExplorer.exe File opened for modification C:\Windows\tiwi.exe Tiwi.exe - System Location Discovery: System Language Discovery 1 TTPs 40 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tiwi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tiwi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cute.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cute.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IExplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IExplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language imoet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tiwi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tiwi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language imoet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language imoet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cute.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tiwi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IExplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language imoet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cute.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language imoet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language imoet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tiwi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IExplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IExplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cute.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IExplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language imoet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tiwi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cute.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tiwi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IExplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cute.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cute.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language imoet.exe - Modifies Control Panel 54 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\s2359 = "Tiwi" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ Tiwi.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Mouse\ Tiwi.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Mouse\SwapMouseButtons = "1" Tiwi.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\ cute.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR" imoet.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ IExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" IExplorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Mouse\SwapMouseButtons = "1" IExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" cute.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\s2359 = "Tiwi" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\s1159 = "Tiwi" cute.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Mouse\SwapMouseButtons = "1" cute.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" IExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\s2359 = "Tiwi" IExplorer.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Mouse\ IExplorer.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" cute.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Mouse\ cute.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ imoet.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\ Tiwi.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\s2359 = "Tiwi" Tiwi.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\ IExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\s2359 = "Tiwi" cute.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\s1159 = "Tiwi" imoet.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Mouse\ imoet.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" imoet.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\ imoet.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Mouse\ 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Mouse\SwapMouseButtons = "1" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR" Tiwi.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" Tiwi.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\s1159 = "Tiwi" Tiwi.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\s1159 = "Tiwi" IExplorer.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ cute.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR" cute.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\ winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\s1159 = "Tiwi" winlogon.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Mouse\ winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Mouse\SwapMouseButtons = "1" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" imoet.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\s2359 = "Tiwi" imoet.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\s1159 = "Tiwi" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" Tiwi.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR" IExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Mouse\SwapMouseButtons = "1" imoet.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\ 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main\ Tiwi.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main\ IExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.." IExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.." Tiwi.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main\ cute.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com" cute.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.." cute.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com" imoet.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.." imoet.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.." 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com" Tiwi.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com" IExplorer.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main\ winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.." winlogon.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main\ imoet.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main\ 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe - Modifies Internet Explorer start page 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com" Tiwi.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com" IExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com" cute.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com" imoet.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ Tiwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command imoet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile imoet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" Tiwi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" Tiwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D} cute.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" cute.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command imoet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command Tiwi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" Tiwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" imoet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" imoet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command Tiwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ IExplorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" imoet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ cute.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" cute.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command imoet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile Tiwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E} IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E} cute.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" imoet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command cute.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E} 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D} Tiwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E} Tiwi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" Tiwi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command cute.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D} IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command imoet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command Tiwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D} winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" cute.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF" imoet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command cute.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 636 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe 636 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe - Suspicious behavior: GetForegroundWindowSpam 5 IoCs
pid Process 1480 imoet.exe 2876 Tiwi.exe 4684 winlogon.exe 4376 IExplorer.exe 4884 cute.exe - Suspicious use of SetWindowsHookEx 40 IoCs
pid Process 636 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe 2876 Tiwi.exe 4376 IExplorer.exe 4684 winlogon.exe 4884 cute.exe 4248 tiwi.exe 1480 imoet.exe 412 Tiwi.exe 2740 Tiwi.exe 1576 Tiwi.exe 1108 Tiwi.exe 2096 Tiwi.exe 2080 IExplorer.exe 1768 IExplorer.exe 5044 IExplorer.exe 4348 winlogon.exe 2600 IExplorer.exe 3092 IExplorer.exe 4728 winlogon.exe 1112 Tiwi.exe 1772 winlogon.exe 4192 winlogon.exe 3768 winlogon.exe 4524 imoet.exe 4536 IExplorer.exe 4960 imoet.exe 884 imoet.exe 3308 imoet.exe 4340 imoet.exe 1184 winlogon.exe 4404 cute.exe 4900 cute.exe 1164 cute.exe 2360 cute.exe 5080 cute.exe 2332 imoet.exe 3404 winlogon.exe 3500 cute.exe 1836 imoet.exe 1292 cute.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 636 wrote to memory of 2876 636 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe 83 PID 636 wrote to memory of 4376 636 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe 89 PID 2876 wrote to memory of 412 2876 Tiwi.exe 95 PID 636 wrote to memory of 2740 636 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe 94 PID 4684 wrote to memory of 1576 4684 winlogon.exe 98 PID 4884 wrote to memory of 2096 4884 cute.exe 97 PID 4376 wrote to memory of 1108 4376 IExplorer.exe 96 PID 636 wrote to memory of 2080 636 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe 99 PID 2876 wrote to memory of 1768 2876 Tiwi.exe 100 PID 4684 wrote to memory of 5044 4684 winlogon.exe 101 PID 4376 wrote to memory of 2600 4376 IExplorer.exe 102 PID 4884 wrote to memory of 3092 4884 cute.exe 103 PID 2876 wrote to memory of 4348 2876 Tiwi.exe 104 PID 636 wrote to memory of 4728 636 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe 105 PID 1480 wrote to memory of 1112 1480 imoet.exe 106 PID 2876 wrote to memory of 4960 2876 Tiwi.exe 109 PID 4684 wrote to memory of 1772 4684 winlogon.exe 108 PID 4376 wrote to memory of 4192 4376 IExplorer.exe 110 PID 636 wrote to memory of 4524 636 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe 111 PID 4884 wrote to memory of 3768 4884 cute.exe 107 PID 1480 wrote to memory of 4536 1480 imoet.exe 112 PID 4684 wrote to memory of 884 4684 winlogon.exe 113 PID 4884 wrote to memory of 3308 4884 cute.exe 114 PID 4376 wrote to memory of 4340 4376 IExplorer.exe 115 PID 636 wrote to memory of 4404 636 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe 116 PID 1480 wrote to memory of 1184 1480 imoet.exe 117 PID 2876 wrote to memory of 4900 2876 Tiwi.exe 118 PID 4376 wrote to memory of 2360 4376 IExplorer.exe 121 PID 4884 wrote to memory of 5080 4884 cute.exe 120 PID 4684 wrote to memory of 1164 4684 winlogon.exe 119 PID 1480 wrote to memory of 2332 1480 imoet.exe 122 PID 636 wrote to memory of 3404 636 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe 123 PID 1480 wrote to memory of 3500 1480 imoet.exe 124 PID 636 wrote to memory of 1836 636 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe 125 PID 636 wrote to memory of 1292 636 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe 126 - System policy modification 1 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Tiwi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" IExplorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cute.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" cute.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" imoet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System IExplorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System imoet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Tiwi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe"C:\Users\Admin\AppData\Local\Temp\27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:636 -
C:\Windows\Tiwi.exeC:\Windows\Tiwi.exe2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2876 -
C:\Windows\Tiwi.exeC:\Windows\Tiwi.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:412
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1768
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4348
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4960
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4900
-
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4376 -
C:\Windows\Tiwi.exeC:\Windows\Tiwi.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1108
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2600
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4192
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4340
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2360
-
-
-
C:\Windows\Tiwi.exeC:\Windows\Tiwi.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2740
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2080
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4728
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4524
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4404
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3404
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1836
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1292
-
-
C:\Windows\tiwi.exeC:\Windows\tiwi1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4248
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4884 -
C:\Windows\Tiwi.exeC:\Windows\Tiwi.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2096
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3092
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3768
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3308
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5080
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4684 -
C:\Windows\Tiwi.exeC:\Windows\Tiwi.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1576
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5044
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1772
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:884
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1164
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1480 -
C:\Windows\Tiwi.exeC:\Windows\Tiwi.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1112
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4536
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1184
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2332
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3500
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
- Size 45KB
- SHA256 7b69502687eb7fd485b7666ce7f1d7b6d57014f40bff340df2c04f5971dc286d
- MD5 ed35eee7c9ae8b549da3d5a60f8d6083
- SHA1 1f30a2e22857f1c33821bbd4f6bf18f3855b5f6e
- SHA512 952eb95f13bf8f979fd673fc3af27662f2d350bddc81aea98267f74ae93284e9515c6ead0764e9a3a554db760375da8f3f35323d8064aa3229cbbdbf21a314dc
- SSDEEP 12:c0IVVU6jJ96xe4bjjOcwgBDMEGTVZdBa7:2VVU6jexe4bjjOczeZZda
- TLSH T198237DF9A203AF0BDF5A423389D7548B85C56EEF19A56D16AD4271450B6CF39140824B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
- Size 5.0MB
- SHA256 64f5214e37d34e7d6c86721e6818ed0c64823e5e4c4bcb9a4f275bca1f9e238d
- MD5 d10710c9ab7ffe239f03070ec830c53e
- SHA1 dba19843f0bbbd3ceadda7240072fbbbbbcc961d
- SHA512 8b02f99a0316048e84e19a32bb88b45fc3650e2161b4a93919386b7c69ee69c128b65f3d5feea51b8b51d6536ecac70c88d9e4bf2d8e96cba6a7299b17b29047
- SSDEEP 49152:HGinGi2GivGiZGi2Gi2Gi2Gi2Gi2Gi2GihGiZGi2Gi2Gi2Gi2Gi2Gi2GiyGivGit:J
- TLSH T19736D10BB61B9889F954CC7948628B6C336A7E72CF27796561553D732C3A0CB7D02E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
- Size 5.0MB
- SHA256 9999504faacb4223e850ac624608c3c1087421b86e8280a17b23ca55afaf760f
- MD5 bdf538a6ee6f770fb82e8e6c641b3cbc
- SHA1 0832ca1db635e07b444a4fc870072fc469b19e3c
- SHA512 bdfe564217e6289bf67e658ca6bba614c7a52542759ad40586a4f5e1ff93d44574827837a33a98da0d777f83df03aa38ec674672985df34872a85c2d77c069d2
- SSDEEP 49152:HGiYGi2GivGiZGi2Gi2Gi2Gi2Gi2Gi2GihGiZGi2Gi2Gi2Gi2Gi2Gi2GiyGivGit:y
- TLSH T18E36D10BB61B9889F954CC7948628B6C336A7E72CF27796561553D732C3A0CB7D02E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
- Size 45KB
- SHA256 b566de8c32e3675a47fe77a57ece8b84e5f4e09001279a57cda998073862aa16
- MD5 52dc376348c0a21b9b1870cb1a61dc55
- SHA1 4b783302fdb3088e56b5d69cc4ad8f112b131017
- SHA512 583f0840ad8cd0e2f45983ef28083776ab86888a743c5bb1d3887bd3af396d6f5f5efad6f9c07795861073f167f76be1661c4ef75bdb31299c26e752bf3be2a1
- SSDEEP 6:xq2d4Tnjkq2aViggzOgUYSO+fE6/FLpDexDyOLFFx1jvcdBeRLUI:xTqwq2aQggagUY9MhSxWirXj0dBa7
- TLSH T116237DEAC118B74BF70422B205D7A81184459C8F209B643C05693E38A55C92C4A38B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
- Size 5.0MB
- SHA256 0edab8da7e32d6d3b7374c624432a14642cff640fb8c58cbcd1ec4a39d436a61
- MD5 f0cbd1904d41d91d3b224d1a6f4bdd28
- SHA1 9d40f11bcaeb716a5abf2b88d38ada7f80048e17
- SHA512 29fb4bca041fbe6dd2dc0e748556036b76d7e474ceb956bf99335f68d2ccd3815aaa54375d76547664f958abe4b155ed173b6846471ac44495eb559bc20bea6a
- SSDEEP 49152:HGi6Gi2GivGiZGi2Gi2Gi2Gi2Gi2Gi2GihGiZGi2Gi2Gi2Gi2Gi2Gi2GiyGivGit:Q
- TLSH T1CC36D10BB61B9889F954CC7948628B6C336A7E72CF27796561553D732C3A0CB7D02E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
- Size 5.0MB
- SHA256 d318c98a192b3399fe2c076078fc34f10995ad05090e100e86ceef1f179c7c62
- MD5 11c6e8605c56672fa7f52a80ad21766b
- SHA1 67026dcad2f88cc37d3e32df8df21fd3a44428e3
- SHA512 52c9a2d16a4a927c3f98cfcc76fde933220e0547d7306cddcf1d10144ebfeb9a2503fed3bae57e68206d1f5b122f2cfa95edb499b37e334d10485ac0980fb118
- SSDEEP 49152:HGiXGi2GivGiZGi2Gi2Gi2Gi2Gi2Gi2GihGiZGi2Gi2Gi2Gi2Gi2Gi2GiyGivGit:t
- TLSH T15D36D10BB61B9889F954CC7948628B6C336A7E72CF27796561553D732C3A0CB7D02E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\IExplorer.exe
- Size 5.0MB
- SHA256 376a4d5164bf53f123267665125769a901f28a1456c4940bf12099ecaf565409
- MD5 74701a4fb9d50d8aaade2b621a717820
- SHA1 97e74a361c339270400c752dcede9ff4ef001b65
- SHA512 2a2cfd2b7223acc11060f86d05d778b20792ef730e11deb597b0590f54665ed173cef40a64e194d15f9257b0c7b6a1589ba6fe1d6f485c4939461788636c543e
- SSDEEP 49152:HGidGi2GivGiZGi2Gi2Gi2Gi2Gi2Gi2GihGiZGi2Gi2Gi2Gi2Gi2Gi2GiyGivGit:D
- TLSH T19A36D10BB61B9889F954CC7948628B6C336A7E72CF27796561553D732C3A0CB7D02E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\shell.exe
- Size 5.0MB
- SHA256 d6f420db06d2c0b37d90583be3599bb1ea8bea6d5c6682f7ef81e8ef5e999d21
- MD5 ef33237eded5c8d293eea44c5555ce09
- SHA1 d62cf56681a065645c03e00b5deb1a8183edc675
- SHA512 ab99bb74ed5c9102fcc15dc4ce61f86f1fbae4db237b8f0165c3987c8e2e16b675a7c34d2691d92bd962d8d7aee68a6dd69bc4e5e51cff049d4ec18a8d7688fc
- SSDEEP 49152:HGiWGi2GivGiZGi2Gi2Gi2Gi2Gi2Gi2GihGiZGi2Gi2Gi2Gi2Gi2Gi2GiyGivGit:M
- TLSH T13F36D10BB61B9889F954CC7948628B6C336A7E72CF27796561553D732C3A0CB7D02E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\shell.exe
- Size 5.0MB
- SHA256 fc3232a87cfef1286bcaf5598c2f1417bb5558c8bf308e7add3166e634de3b42
- MD5 d7bab4ecec107a7b8e2ff2ced18cb5d1
- SHA1 ccabe0523142fb997e5f60143d1581e2b7a0b5e0
- SHA512 c0eacb28c81dcbbb6dcf8180c40cfe2af2924ddf68128a3bcdb35b274642bcf9fa6bc6b40110bf9094a89cd076d5c6cfa3060d0128bef87e6cb1c4070880c6dd
- SSDEEP 49152:HGiCGi2GivGiZGi2Gi2Gi2Gi2Gi2Gi2GihGiZGi2Gi2Gi2Gi2Gi2Gi2GiyGivGit:s
- TLSH T10036D10BB61B9889F954CC7948628B6C336A7E72CF27796561553D732C3A0CB7D02E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\shell.exe
- Size 5.0MB
- SHA256 27f36d0beeee1a2b89a7dd186aba4807ab8cf4f638fc521edde6aee79060c897
- MD5 ef5e1db6f0b3a339f6ca87fbc7c176a2
- SHA1 6311287db361dd73e9abc638a456ddbe4bc5ca8e
- SHA512 d8c78b1207896ec16af20a0402c6cc15287da5a8c5913e7bc69effc615624cb108535930eab994647e9322ecae63229c1fbb1d287666240fab44ef58097b049f
- SSDEEP 49152:HGiDGi2GivGiZGi2Gi2Gi2Gi2Gi2Gi2GihGiZGi2Gi2Gi2Gi2Gi2Gi2GiyGivGit:B
- TLSH T12836D10BB61B9889F954CC7948628B6C336A7E72CF27796561553D732C3A0CB7D02E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\tiwi.scr
- Size 5.0MB
- SHA256 28d4f975192389304be1bccc15357c89f225dc5d21fabddecb757903802f2e2c
- MD5 6d48b85b5c729ac7763f4d0db6f14745
- SHA1 ab1ee3c61572fdb0e1529f6b601daef384bb4805
- SHA512 20ec59fa4ca7b8f403e033915af4f7a8ba92233a2fd8029c668967fbc25e8166e9585957479f1e2a50cb52d04465c543074500cfb077d1c8efd50005c4aa6459
- SSDEEP 49152:HGixGi2GivGiZGi2Gi2Gi2Gi2Gi2Gi2GihGiZGi2Gi2Gi2Gi2Gi2Gi2GiyGivGit:H
- TLSH T1D136D10BB61B9889F954CC7948628B6C336A7E72CF27796561553D732C3A0CB7D02E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\tiwi.scr
- Size 5.0MB
- SHA256 2c3e0146ea875b552f5d725c233eee1fd1e796fc66e199236849c9639203043f
- MD5 3ae0efa7a3c59bddcef4b870a95b1abd
- SHA1 de7a73338847f001e01bfff5934279eb9231b4a9
- SHA512 67d2715d9339a1ee8f13e062c4934c37367159ef95f5362d04e46a8f49d0d3465baa988bb2f6c0349af99f7f3e0d13492c89bac98b4e55f05304c78815d89b94
- SSDEEP 49152:HGi9Gi2GivGiZGi2Gi2Gi2Gi2Gi2Gi2GihGiZGi2Gi2Gi2Gi2Gi2Gi2GiyGivGit:r
- TLSH T17436D10BB61B9889F954CC7948628B6C336A7E72CF27796561553D732C3A0CB7D02E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Tiwi.exe
- Size 5.0MB
- SHA256 647508994647bb8fbabb19758239f2c93523def9dbef92c6e99445fc4aa7ed88
- MD5 29ae0c65d21e1fb2e4376a3f0098f27c
- SHA1 62dacb4e0899bf0cae7f9976eb3dc967cd8f9ceb
- SHA512 b7a8c555299385ecf0671be53d563fbd373fbb6245ea8c1583325aa54cac39a2fecdd0110155376de4fd5ca0260328365f1d02bd4f4736387c2ce29742dae49e
- SSDEEP 49152:HGi0Gi2GivGiZGi2Gi2Gi2Gi2Gi2Gi2GihGiZGi2Gi2Gi2Gi2Gi2Gi2GiyGivGit:u
- TLSH T1D236D10BB61B9889F954CC7948628B6C336A7E72CF27796561553D732C3A0CB7D02E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\msvbvm60.dll
- Size 1.4MB
- SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
- MD5 25f62c02619174b35851b0e0455b3d94
- SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
- SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
- SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
- TLSH T102659E1337D08162D7A3653449176379B7BC6D119836ED4BAFA0394F2D33B01A72BB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\present.txt
- Size 729B
- SHA256 574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad
- MD5 8e3c734e8dd87d639fb51500d42694b5
- SHA1 f76371d31eed9663e9a4fd7cb95f54dcfc51f87f
- SHA512 06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853
- TLSH T1B101239C96C322D8633012C550CE4CB53F3D5704DB699A217D2DA36C5B908D88468D6C
- MD5 SHA1 SHA512 TLSH
- Path C:\tiwi.exe
- Size 5.0MB
- SHA256 f2b2d1e0c0c6bf9a606d32f919c8e78b56293c34c9b3ec804b54eadec779534e
- MD5 ddfd892f9d64753eef8e9f476859bdb0
- SHA1 f03d3595a284d984fa9d8c2b57412903851476da
- SHA512 a131ee4c36ac1cef2cf15dbef76403dd4a757811955ff0186d5ac6188d4ce1e957182b9c458ac1d7de4bbcb376da1ab2216a91ce8e9def4ddb4dc586b49a6176
- SSDEEP 49152:HGi9Gi2GivGiZGi2Gi2Gi2Gi2Gi2Gi2GihGiZGi2Gi2Gi2Gi2Gi2Gi2GiyGivGit:j
- TLSH T19C36D10BB61B9889F954CC7948628B6C336A7E72CF27796561553D732C3A0CB7D02E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\tiwi.exe
- Size 5.0MB
- SHA256 f4725f5a31e43a99256230dcce4512a679c049673a37ca689bf1553386e950d5
- MD5 3da58fcc98a50b6c9ff8fc667e9442b6
- SHA1 cd2769056735aa0095762bda43825be1879e40f8
- SHA512 74a0844a39aa8a62ea5b004deacf321c3af4bed260b87aadee213d7a2795d43638b3ee0a809641c92edf920cf1d68701b533862c50afd48fbc939c3f5cee59e1
- SSDEEP 49152:HGiJGi2GivGiZGi2Gi2Gi2Gi2Gi2Gi2GihGiZGi2Gi2Gi2Gi2Gi2Gi2GiyGivGit:D
- TLSH T16836D10BB61B9889F954CC7948628B6C336A7E72CF27796561553D732C3A0CB7D02E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\autorun.inf
- Size 39B
- SHA256 e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e
- MD5 415c421ba7ae46e77bdee3a681ecc156
- SHA1 b0db5782b7688716d6fc83f7e650ffe1143201b7
- SHA512 dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62
- MD5 SHA1 SHA512