Analysis
-
max time kernel
23s -
max time network
11651379494s -
resource
win10
Task
task1
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win7
0 signatures
Task
task2
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10
0 signatures
Task
task3
Sample
fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
Resource
win7
0 signatures
Task
task4
Sample
fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
Resource
win10
0 signatures
General
-
Target
TwoLayer.zip
-
Sample
190926-jyftrj55ss
-
SHA256
aa892cf3eb80b918469a8689eabb240b2ad50784e74885d9e277640e252bbbae
Score
N/A
Malware Config
Signatures
-
Loads dropped DLL
-
Drops file in system dir 2 IoCs
at description ioc Process 2141 File created C:\Program Files (x86)\SinTech\TextEdit.exe fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 2141 File created C:\Program Files (x86)\SinTech\TextEdit.exe.config fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
at description ioc Process 2141 Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 2141 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SinTech client = "C:\\Program Files (x86)\\SinTech\\TextEdit.exe" fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe -
at description ioc Process 2141 Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\main fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 2141 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no" fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 2141 Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 2141 Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Recovery fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 2141 Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Recovery\AutoRecover = "2" fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 2141 Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 2141 Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceLastShown = "1" fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 2141 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceLastShown_TIMESTAMP = 232ab69ccc22d401 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 2141 Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10TourShown = "1" fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 2156 Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\main fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 2156 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10TourShownTime = f84268cb0c09d401 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 2156 Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 2156 Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOncePerInstallCompleted = "1" fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 2156 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceCompletionTime = f84268cb0c09d401 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 8062 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe 8062 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8" iexplore.exe 8406 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe 8406 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1" iexplore.exe 8406 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\BrowserEmulation iexplore.exe 8406 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\UnattendLoaded = "1" iexplore.exe 8422 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe 8469 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe 8469 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9" iexplore.exe 8469 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0" iexplore.exe 8469 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0" iexplore.exe 8516 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024" iexplore.exe 8516 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456" iexplore.exe 8531 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe 8531 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0" iexplore.exe 8531 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140" iexplore.exe 8531 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140" iexplore.exe 8531 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0" iexplore.exe 8531 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0" iexplore.exe 8531 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456" iexplore.exe 8531 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024" iexplore.exe 8531 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1" iexplore.exe 8547 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe 8547 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13" iexplore.exe 8547 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe 8547 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2429344429" iexplore.exe 8547 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "30766220" iexplore.exe 8672 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe 8672 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe 8687 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy iexplore.exe 8687 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1" iexplore.exe 8984 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe 8984 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Recovery iexplore.exe 8984 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C46BD3A1-E065-11E9-B2B2-EEA0E39E4040} = "0" iexplore.exe 9016 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe 9016 Set value (str) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe 9422 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe 9422 Set value (str) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe 9531 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe 9531 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe 10062 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE 10984 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE 16391 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy iexplore.exe 16391 Set value (int) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\SearchScopesUpgradeVersion = "1" iexplore.exe 22750 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE 22906 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe 22906 Set value (str) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe 23062 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe 23062 Set value (data) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e0000005e03000096020000 iexplore.exe -
Suspicious use of WriteProcessMemory 9 IoCs
at description Process procid_target 2172 PID 3616 wrote to memory of 3084 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 39 2250 PID 3616 wrote to memory of 3664 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 40 2437 PID 3664 wrote to memory of 2436 cmd.exe 42 2484 PID 3664 wrote to memory of 2432 cmd.exe 43 2531 PID 3664 wrote to memory of 2984 cmd.exe 44 4656 PID 3664 wrote to memory of 3964 cmd.exe 45 5062 PID 3616 wrote to memory of 3908 fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe 46 8781 PID 3864 wrote to memory of 4076 iexplore.exe 48 22641 PID 3864 wrote to memory of 3424 iexplore.exe 49 -
Executes dropped EXE
-
Creates new service 1 TTPs
-
Launches SC.exe
-
Windows firewall usage
-
Modifies Windows Firewall 1 TTPs
-
Suspicious use of SetWindowsHookEx
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of FindShellTrayWindow
-
Uses Task Scheduler COM API 1 TTPs 6 IoCs
at description ioc Process 15078 Key opened \Registry\Machine\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} iexplore.exe 15078 Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd} iexplore.exe 15078 Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Implemented Categories\{00021493-0000-0000-C000-000000000046} iexplore.exe 15969 Key opened \Registry\Machine\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} iexplore.exe 15969 Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd} iexplore.exe 15969 Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Implemented Categories\{00021494-0000-0000-C000-000000000046} iexplore.exe -
at description ioc Process 21891 Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\75E0ABB6138512271C04F85FDDDE38E4B7242EFE IEXPLORE.EXE 21891 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\75E0ABB6138512271C04F85FDDDE38E4B7242EFE\Blob = 5c000000010000000400000000080000090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020b000000010000005c00000047006f006f0067006c00650020005400720075007300740020005300650072007600690063006500730020002d00200047006c006f00620061006c005300690067006e00200052006f006f0074002000430041002d005200320000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0620000000100000020000000ca42dd41745fd0b81eb902362cf9d8bf719da1bd1b1efc946f5b4c99f42c1b9e1400000001000000140000009be20757671c1ec06a06de59b49a2ddfdc19862e1d000000010000001000000073621e116224668780b2d2bee454e52e03000000010000001400000075e0abb6138512271c04f85fddde38e4b7242efe2000000001000000be030000308203ba308202a2a003020102020b0400000000010f8626e60d300d06092a864886f70d0101050500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523231133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3036313231353038303030305a170d3231313231353038303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523231133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a6cf240ebe2e6f28994542c4ab3e21549b0bd37f8470fa12b3cbbf875fc67f86d3b2305cd6fdadf17bdce5f86096099210f5d053defb7b7e7388ac52887b4aa6ca49a65ea8a78c5a11bc7a82ebbe8ce9b3ac962507974a992a072fb41e77bf8a0fb5027c1b96b8c5b93a2cbcd612b9eb597de2d006865f5e496ab5395e8834ecbc780c0898846ca8cd4bb4a07d0c794df0b82dcb21cad56c5b7de1a02984a1f9d39449cb24629120bcdd0bd5d9ccf9ea270a2b7391c69d1bacc8cbe8e0a0f42f908b4dfbb0361bf6197a85e06df26113885c9fe0930a51978a5aceafabd5f7aa09aa60bddcd95fdf72a960135e0001c94afa3fa4ea070321028e82ca03c29b8f0203010001a3819c308199300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604149be20757671c1ec06a06de59b49a2ddfdc19862e30360603551d1f042f302d302ba029a0278625687474703a2f2f63726c2e676c6f62616c7369676e2e6e65742f726f6f742d72322e63726c301f0603551d230418301680149be20757671c1ec06a06de59b49a2ddfdc19862e300d06092a864886f70d01010505000382010100998153871c68978691ece04ab8440bab81ac274fd6c1b81c4378b30c9afcea2c3c6e611b4d4b29f59f051d26c1b8e983006245b6a90893b9a9334b189ac2f887884edbdd71341ac154da463fe0d32aab6d5422f53a62cd206fba2989d7dd91eed35ca23ea15b41f5dfe564432de9d539abd2a2dfb78bd0c080191c45c02d8ce8f82da4745649c505b54f15de6e44783987a87ebbf3791891bbf46f9dc1f08c358c5d01fbc36db9ef446d7946317e0afea982c1ffefab6e20c450c95f9d4d9b178c0ce501c9a0416a7353faa550b46e250ffb4c18f4fd52d98e69b1e8110fde88d8fb1d49f7aade95cf2078c26012db25408c6afc7e4238406412f79e81e1932e IEXPLORE.EXE -
flawedammy family
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe"C:\Users\Admin\AppData\Local\Temp\fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe"1⤵
- Drops file in system dir
- Adds Run entry to start application
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3616
-
C:\Program Files (x86)\SinTech\TextEdit.exe"C:\Program Files (x86)\SinTech\TextEdit.exe"1⤵PID:3084
-
C:\Windows\SysWOW64\cmd.execmd /c sc create Wlanspeed binpath= "C:\ProgramData\Wlanspeed\wlanspeed.exe -service" start= auto displayname= "Wlanspeed" & sc description Wlanspeed "Wlanspeed service" && netsh advfirewall firewall add rule name="Wlanspeed" dir=in action=allow profile=any description="Wlanspeed service" program="C:\programdata\Wlanspeed\wlanspeed.exe" && netsh advfirewall firewall add rule name="Wlanspeed" dir=out action=allow profile=any description="Wlanspeed service" program="C:\programdata\Wlanspeed\wlanspeed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3664
-
C:\Windows\SysWOW64\sc.exesc create Wlanspeed binpath= "C:\ProgramData\Wlanspeed\wlanspeed.exe -service" start= auto displayname= "Wlanspeed"1⤵PID:2436
-
C:\Windows\SysWOW64\sc.exesc description Wlanspeed "Wlanspeed service"1⤵PID:2432
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Wlanspeed" dir=in action=allow profile=any description="Wlanspeed service" program="C:\programdata\Wlanspeed\wlanspeed.exe"1⤵PID:2984
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Wlanspeed" dir=out action=allow profile=any description="Wlanspeed service" program="C:\programdata\Wlanspeed\wlanspeed.exe"1⤵PID:3964
-
C:\ProgramData\Wlanspeed\wlanspeed.exe"C:\ProgramData\Wlanspeed\wlanspeed.exe" -getid -nogui1⤵PID:3908
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Uses Task Scheduler COM API
PID:3864
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3864 CREDAT:82945 /prefetch:21⤵
- Modifies Internet Explorer settings
- Modifies system certificate store
PID:4076
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3864 CREDAT:82948 /prefetch:21⤵
- Modifies Internet Explorer settings
PID:3424
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Additional techniques
- T1060
- T1050
- T1031
- T1130