Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
141s -
platform
windows10_x64 -
resource
win10 -
submitted
09/07/2020, 19:22
Static task
static1
Behavioral task
behavioral1
Sample
https://www.google.com/appserve/mkt/p/AD-FnEzfRrCkFzCbI9b4pgsMdcoXWU2S0ra2GtezbuIdBhnUT5auBLj7r4YmwYefqwsUFYNbnjFnBsjwhdNRu9lD-ahOGoshUHIVHpWI79s69Y4
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
https://www.google.com/appserve/mkt/p/AD-FnEzfRrCkFzCbI9b4pgsMdcoXWU2S0ra2GtezbuIdBhnUT5auBLj7r4YmwYefqwsUFYNbnjFnBsjwhdNRu9lD-ahOGoshUHIVHpWI79s69Y4
-
Sample
200709-1wv6thm9j6
Score
1/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 19 IoCs
pid Process 3932 iexplore.exe 3932 iexplore.exe 3876 IEXPLORE.EXE 3876 IEXPLORE.EXE 3876 IEXPLORE.EXE 3876 IEXPLORE.EXE 3876 IEXPLORE.EXE 3876 IEXPLORE.EXE 3876 IEXPLORE.EXE 3876 IEXPLORE.EXE 3876 IEXPLORE.EXE 3876 IEXPLORE.EXE 3876 IEXPLORE.EXE 3876 IEXPLORE.EXE 3876 IEXPLORE.EXE 3876 IEXPLORE.EXE 3876 IEXPLORE.EXE 3876 IEXPLORE.EXE 3876 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3932 iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3932 iexplore.exe -
Modifies system certificate store 8 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\SystemCertificates\MSIEHistoryJournal\Certificates\5FF1348C80820F2A988D0C0C7ABEA0EA394B5E6C\Blob = 0300000001000000140000005ff1348c80820f2a988d0c0c7abea0ea394b5e6c040000000100000010000000fd42404f68fae3f0d490e8d19d08ab1d0f00000001000000200000005546bb2210de2560292e6f4610af4ffbdb453f9bf9983e62942c35959e16038d140000000100000014000000b3b30880146b0eb235e8e136e7d15c9c4847f5f3190000000100000010000000e142e209d34bfb2eac257eb76a2b61e15c0000000100000004000000000800001800000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d702000000001000000e5050000308205e1308203c9a0030201020213330000016fd585f24b93e88a0700000000016f300d06092a864886f70d01010b0500307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f667420536563757265205365727665722043412032303131301e170d3139313231323030303333315a170d3231303331323030303333315a3081a3310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b130442696e67311b301906035504031312494520496e737472756d656e746174696f6e3121301f06092a864886f70d010901161271666265406d6963726f736f66742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100cfb24782c35c66c63688c01ed857df9a4330b81628c86831de4d577f8cb2155b880ee41953a18ac28de644bacfa97558ec6f522490f103b7fa0092430f8e0ba55c36dd91f6f1f91baec6eb3581d89133141e1580e02ec2445e5380b178f92f81e97193be8be1223d36e5f2be070a3db6ac17987ea3b42d15994c73a10e64794da4660a5d875e179c567bb06ecfd7cbf4c1ee4fe453284e72877d746a3e178788a1bd540ba9250a931a11105bb98f1b2b757fa6c5ade16e7cc1d1628fedb716018526f5b56630b54cd5f75f938e9b4a956609cc441aac84a10a101f6429b6fceb9434a41b24f0ca9781bf72b010f14bd13dc5d996b6ed6c4d53156969dd04f7390203010001a38201303082012c300e0603551d0f0101ff0404030204f030150603551d25040e300c060a2b0601040182374c0c01301d0603551d0e04160414b3b30880146b0eb235e8e136e7d15c9c4847f5f3301f0603551d230418301680143656896549cb5b9b2f3cac4216504d91b933d79130530603551d1f044c304a3048a046a0448642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63726c2f4d69635365635365724341323031315f323031312d31302d31382e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63657274732f4d69635365635365724341323031315f323031312d31302d31382e637274300c0603551d130101ff04023000300d06092a864886f70d01010b0500038202010064d81278e224099c122690412271d5f2d92ae1c00f7135d64f63663ccc0588826bf24cc6cffa0d6666b7e3f989825dd1021fd1bdc6a9d4a492c0f46198534382204d8668b0f3c8d85f9f614f7fff47e391a4fdc89dba1b423f1d2a8d4986ff42bac032a21224b246b03ffef26e7da49d3ef381ff9d669cda0234445bff395be1b70627f013ccde692280d75d690b4f4c5e3a123b379bd30bdc6cf1af0c69d97eb0aa4f580eb4e876465b2c62514a612a3971f6bc6ace33f569e0cbcbd5498caf2af949952c310221a382d0a7fbc4594b0bfe96a1c81d26639b249beea28179ead8377bf70e9a09596997af2b405c5425a1e5e6e46b065016901b7cd120e2389d47924b1f834955135461f7592c9487e3910bf0de382ad5906dd8c46b321b176698caaec19d1ee10aa6679981d8f2f5c40d69240a7075ce4341305d2bbd082e03c81c41baeb557b41904482ae88d0566f339ab517ae2f84223d567f9ec734c1c5a2be39aa24c49930b6428bbe2fa300f2369e1c8cc554c14010f1ee518afa32e4bf0a15cb251d37791338f5ade8ced4b67ca5fc56320c2c2973f9b13e250dabe4a373580becf787afd552c6b293dfc7bfb1f67739c64df74ae3d373e2db9c27090fe15e58591824e4f150602af628917a6d1353919cd0a8489596f97070833a98b34c2d3a0ebafda2f81096533b773c5914d7f05e66cb17af2bcd11ad517440b5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\SystemCertificates\MSIEHistoryJournal iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\SystemCertificates\MSIEHistoryJournal\Certificates iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\SystemCertificates\MSIEHistoryJournal\CRLs iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\SystemCertificates\MSIEHistoryJournal\CTLs iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658BE73ACF0A4930C0F99B92F01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658BE73ACF0A4930C0F99B92F01\Blob = 03000000010000001400000083da05a9886f7658be73acf0a4930c0f99b92f011400000001000000140000003656896549cb5b9b2f3cac4216504d91b933d79104000000010000001000000062455357dd57cb80c32ab295743cccc00f00000001000000200000006811c6215f18c75fdbe32cf56bd66248562a7fa3ba459cfee338745061e583941900000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d705c000000010000000400000000100000180000000100000010000000bb048f1838395f6fc3a1f3d2b7e976542000000001000000dc060000308206d8308204c0a003020102020a613fb718000000000004300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131313031383232353531395a170d3236313031383233303531395a307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f66742053656375726520536572766572204341203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100d00bc0a4a81981e236e5e2aae5f3b2155875beb4e549f1e084f9bb0d64ef85c18155b8f3e7f16d40553dce8b6ad18493f5757c5ba4d47410ca32f323d3aeeecf9e0458c2d947cbd17c004148711b01671718afc6fe73037ee4ef439cef01712a1f81264377985457739d552bf09e8e7d060eac1b54f326f7f82308228b9e061d3738fd72d2cae563c19a5a7db26db352a96ee9aeb5fc8b36f99efaf61c581b9756a511e5b752dbbbe9f054bfb4ff2c6cb85d26cea00ad7df93ed7fddacf12c731ad9193755badd22788ea1d49b09f807223171b094aee0b0e726445790819715ce61ec65e24bf185521632f8b578aa7ecd4dec8321a4a89bbe9a6a04e0a31ccd56186cfd6b2f423ee237f272abd07873727bdeec0058e52130a3083a99ef9fc3f77a169665b5c381aff4397049aff6a9f66a0038f9b40819e01a35a55676225f6af269ae3ead58464db854f68941441e72b1bc122753d2c1ffb2cd50981eb5f4bbb6c28239d9ac1bf23b27846ab0c6260bd73a10e7b3db7cd356ac534c0bfa3b313774d8592bf9007919067bfd1c1d42d4410d2f050ed56b4923ffcfcdf87a82cfda3c2ddfe8d8120418ba1e8877b8981f1007bbc8057e0b09bf6bdde34e5bb0f9c784a63bca4c9f5b6229f7c7a2a89588702ce5c13f3c52234f409ac33185832fbf29f11d508f219607ceeff280c2447d9b62ef2fc37789ab454d533e0279d30203010001a382014b30820147301006092b06010401823715010403020100301d0603551d0e041604143656896549cb5b9b2f3cac4216504d91b933d791301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014722d3a02319043b914054ee1eaa7c731d1238934305a0603551d1f04533051304fa04da04b8649687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f436572417574323031315f323031315f30335f32322e63726c305e06082b0601050507010104523050304e06082b060105050730028642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f436572417574323031315f323031315f30335f32322e637274300d06092a864886f70d01010b0500038202010041c861c1f55b9e3e9131f1b0c6bf0901b49db69074d709dba62e0d9fc8e7763446af0760894c81b33cd5f4123575c273a5f54d848ccba45dafbf92f617085742957265057679adeed1bab82e54a35107ac68eb210ce32581c2cd2af2c3ffcfc2bd49189ac7f084c5f914bc6b95e596efb342d253d54aa012c4ae12765309560e9df7d3a6498850f28a2c9720a2be4e78ef0565b74ba11688de31c70842247ca47b9e9dbc60005e6297e393fca7fe5b7b25dfe4537f4bbee63ef0db0179421c6e856c7db64430fba5379293b2a5ee20ad3f53d5c9f4286b57c1f81d6ab7562ab627811ca62d9fe7f4d0318397a82ab6acbe1b41f5e4895f56fbda5ad35e7d5594107e5357f44a3d402ac8bd679f84e110eefdda6b158249fc461dff4506749c4214edc539d3b3cd0b832790435192f24482ae6e9a1517b219fac7456c98017bbf37a9b088a492bc3838e01de47c97981a2e5fef3865b7352fbd7f4f21fac48cd26f06f94935eadf200f25aaea60ab2c1f4b89fcb7fa5c54904b3ea2284f6ce45265c1fd901c8582886ee9a655dd21287945b014e50acce65fc4bbdb6134699fac2638f7c1294108152e4ca0f7f90c3ede5fab08092d83acac348362f4c949428925b56eb247c5b339a0b1201b2cb18e046fa530491cd046e9405bf4ad6ebadb824a87124a80094ddbdf76b9055b1be0bb20705f0025c7d30efa16ad7b229e7108 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\SystemCertificates\MSIEHistoryJournal\Certificates\5FF1348C80820F2A988D0C0C7ABEA0EA394B5E6C iexplore.exe -
Checks whether UAC is enabled 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3932 wrote to memory of 3876 3932 iexplore.exe 67 PID 3932 wrote to memory of 3876 3932 iexplore.exe 67 PID 3932 wrote to memory of 3876 3932 iexplore.exe 67 -
Suspicious use of AdjustPrivilegeToken 282 IoCs
description pid Process Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE Token: SeShutdownPrivilege 3876 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3876 IEXPLORE.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 IEXPLORE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "7" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30823974" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "301104156" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DOMStorage\accounts.google.com IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30823974" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f72535b3d71787499ad6028e231c2f4e00000000020000000000106600000001000020000000227ee1f186583f24525c2c99e40859949bc4782884fc6a9699a35a17150f7db7000000000e8000000002000020000000797f1fedb4bd4d3f1211d2470b11085567b69f70faba62e0cb59e04a62d7f1b320030000bd041fbf6eb12f210731748089bc6073b0317b8be256bb79ea6b24d0dbb4c863e848cb2f2a20b130550290df3806ce000503fee069dad9d5c602baec828dba14e93bd6909e5c19b39b35a389bf92b7a19bfd383f1a8050bfe4c652bf17aed35284ab5311ba517b2fb9ef43ceead4da731d78fcdb27702e1a81e99165f257599da4c2e6f6812d3d3a10dc18deb493e060f6285d46c05fb7ad03347e4d019a5365bbf2f887ef8d608e8a87542dda0e26aa63e4473682191924e051aa43fcc5d81a6f5a71e861004ba6fb55b431aadda89f6d494b1d88f1f5a9dc879722b744028cec13f1c53d7a47f57517dd204a6241975d6e8f737d615c9a210323087f64296ac624c1ab579854a13682d31f0a74efd514263a02639d4929fce103c2afc0cf80fcb85cee25109fea113fcd3ede514d1987b7511c42078df625979653b7d5d0b67ea002b4c3eef85a38422ed66ba92c291696ee89ed791ca2a84c42a354409ef2a5cd458914bb532365c79b561537891f04d8b879e3babfca27f7354bb36312ad5cb52721a8e23d3a1cb2b83f10969d8c42abe4b782b6b3724d8c50d56347b1f61b9d187fd1db93d22b9410df0ef23a42bb966761bfab7d802b4fe0ae110e8ac60b6e857bb8b3c8a6307749763003dba2857408c796aa04efab2bcf108177c9dddfce6b8396f6d9427299e71457ca09cf10d0ca33a8b8b5c2802f96f70b6130444e2a1769da9498ba68a449d4c2524420aa7b555602cb2510fcddfa4b84980d081972153e396097313c5a0e46161ab87e4b0920503fcf6568e94ad99b0b1a40dfc0f98e9a727810dcc0419a98cbfc82ca06b977f42bfdaaeafa1ab39b8d4954c906cc6f7b57a8fdf32389e2950aaf9f3dffa467d9dcc7ebaf3a119f8354b66961a6c001710b18ef22a435c287e105cd07ed8e58a6c89234e9450347d40e53566e30bd683f52ac1401b83623758d8fd6299c04458274302e433a8f758e965c9568b6b9bbb34398bea893b877c1845a63ca340df00d41ec5b12339b64c19ae8ae8697365963eda3b85a22ee398b94cfb9b54b918daff2c4bcfeb053b4a45e964fc302746eaa950f2f345d269858cd9166057ccac045ff6aa629a8f2203fd1310fab40000000785c51e11a12eb53dec458dd6cedf8507db57d76b21ca2b2ecc2ca5eee7e98e9826879fb1a6591bb1f7669aea8a63bd9d3227c739a7e22f8a4967b1a3114a42a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f72535b3d71787499ad6028e231c2f4e0000000002000000000010660000000100002000000011bdac1804fa21777ab618ae4fb3fa1e526b4ff92a3b1a959f5500504f6de47f000000000e80000000020000200000006c1217e2db053ce54b51c591c96898f48ad90d73f73dae04cae3b04ba043455db0030000b6a7bd4a701d3fbb87ef6e517187964caf770e1b8832a7f07f13eb164a37e0323c2acd968673683979bb4738cffdd79cc1ae206edefb5f945c4da327cb56e0cb2539279ee4175d2e7b65703ed879cd4939b5ed8d58d82e974ce6a57be458ae852f1daeab7b9417edd93f09d58d28e8107dc99ddd0746418fbf9eb9b0e6ab2d7faa71b676bb0ad3725416fa81efe349a2519fc8df3dfbd6a3d4f14ef634723de8239aa7a5a0f439b841f811cc969f2bb9c4994c13a3ad7815a1d5c76709b03ce84945ddf53b7d123f041db475a65f4988efe95a0a518c1f06cc9d0ac5562dc6cf90337b0915abf3b74a32bcbd35e9fc398ac168e000effe8babc43144d00ce8ecac6ddeffe400a6cd0af200e3893cd086ebeafaeefb9286355ca66cdc5987d140170ced311825c045c20f9b2c080d46a30ab07a85d0b58dfb97664447ab6690144fb45a7b9686db2e4d6b9c364ef24db32188e3e0b50e44ba3e649e624ef1bf1ee8385bc338162e7dbb844f3f746a1dea0b66df50f68a1fbef7dd6fb3a22ada8e19e10fe118e959e370499e36f916cab1a80ee7171e7e1c9480c430caf067d38aca8c9eb55aafbb042cf0d7f16c71c9086683b5136a6f5342fbf88e3b2ec303b874d1880efd1a08f70b40022239f3bc22dea5f32ac4930ea422190a318f0b4458be82ec882b107116b886f1ea930a8f42feefcea72847ae4ddd397d35c88e60f95e7971d6226c5c7c12d089f0a6955acdb4b4f1bd3f37fb09c3816e70dadf7070fba60ee75f2d9397b1d6d6c1680fa43e3adac5876c794c667ced9daa7d7c92852d9114dc06fa5dd14d8beca6214a4724c33e958e0028f5db5df50e2a29704c12d1cf434559558f51b68171b63535d9f3327452bf99700ec300ee2263d5bccc4c540b7ea96ce3a0b5c0b37e06fe1dbaf9c20eaa06612dd7dcdb0c16e3b1bf95de5d5aab082e3b5f6c4302919a613eadba9738fa2fd75f1932cc1773f81b33ead3d948a7a531ff502da9adcbdc7ed0d33101ac79d18e9888c37473fd97dce8518fc39dd015d7ba4ec1128a51240b7f7d4ba2c37ce68334a3fa13474e1f6f4cc3b17f36070477cf8ffe4df30b609acd8bc952c622a549e4c05096028eab809c4dd9d7acdd806dec879b5f5cc11a26b2c78d79ff1ddd3b64cf796c8273ad1aff6807fc1ae68b12a50bfdf58028711c5866026405fba6f5fad329550fac4a59311e611f645d179e09e2d5cedc87e6fcf330acedb603070ad55b760576bc6fc1e6924d159429951e0ccd288dbb400307065f502b6e5b21ec8936de9b7f11725d5c8ab9416177ed2e1a087d3e514e9e1ea4a82c4000000051f898aa3d13f858575e6fd0a0e14c7b769661ced97fa0821205ad1c863cb1e11f341fe616ede4ab76dc419bef78d0716e7e769dbbae2e1817f5135c2edb5fb7 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "301136147" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f72535b3d71787499ad6028e231c2f4e00000000020000000000106600000001000020000000cc305543da1fb321a09f8a74b7cabcbad1910821ea7e9c18004e83ac3702b440000000000e8000000002000020000000cddbd0d8b8a83fb930813bd25b9692cef2546a8035ef0a5cc6bf2811c5bc25ac200300003d40e22723ca1fc0551fecc4d2ed62f064869b9bed2b77b126a5e6bd22718330d0c958f316bb8adee35f42b57967ab041032d15554d041caecbc5aca7edbe4535cdb9a14fcee32a8199d21a1588ffe8d54ad8430d210ae99aabdd20e58bc748cabe0edc914c78e0fa15ade7a65dcf64d995d25ad526e7e5d3e186717dfa45b2bce6f4b2c01c0f2cdd12f2e9312c446b4a1dcce40dc27ba104b9dba58dd8530a9877abef67bdcba16bcc9ecd9209362057a9150a45ccec2170c6e5a800dc00f034b5d60252d64e3a99612cd3d0e06c374ebd1577e43399361dd0d942e1ed5985d6a766e58fda317cdb0df66d05a9247afea451a3fed580c240b94f50b6bcbe6e6b7b3a46e481c70c8156e63385fd1a83e639e0a590e79345e670f52dbb1ae8d6cac41914dc7a4b3bb994e73d83050aaa5aa09526268b81b2f8ead4d8953b38c0f6642deaa27d49c799731420e8789bc6014e895bc5d623a9e82ebeace15f75814a3dbd94407198017afc9b8224e2faaa5e22b900a318ac70bbc16f24a997ef0a9ffa42e4ec9b0701fcabafe3a1e260de0acf0cc42331d40f6f28d340de27a4d59a35cdafd69035742164de00724cc4674f7d8eb3fc556c5578d7d78fa62b905dfe992b36135401ee60da007abed0cd203199c4152c000c6713dd043dee1db1f3f0f724e09760f17f3c1756993ab4dd86bae742beff7863c62b67f7fe449ebd5fed2914ec27f019f6ac34c7dca832782ce9fe00d21d2d56ee3acace70c4ed4182e27e8e776bc0e6f6785cfdf4b4f63f269049ef611dfa5f0f91233e3e04088081d911680670863ffa78b33fc6c49d30e73ae1adf9eb27086658ce985f65a5e872e6056a5931d739054eff2bb5f4ef08d0135b29cb9745b7b282ae219ae9996fccdf2521511886810dc15a4acd2ee207f01004510f560483d431bd74d9672c6efe5a19b152f9e5a78493cfb66cbe81483d5350c1e60d6fdba1a88ee3d67a5d17e20c12b3bb2ee7b6509f5026d1c51ce29d6d1962587bd2af7592348d839edf7c68770f535cc5ab0e9ca97151b3b952614eebaa4611359f109d8f4823626e1d516fdc17c18645ebc3abbc332ae1bd68f2ce68fbd3e85cc2cb4235dec5b7767a8f5c540000000aa549f6ad4de44a30e7808d86ef0ad410c49fb6d701f30c99938755b50575448b7957582b3129b62a5d7de9b5e9fb8f5634929ebfae8f5a0046e1eaabe39ed81 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1928431465" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1928526822" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f72535b3d71787499ad6028e231c2f4e0000000002000000000010660000000100002000000021b137b66d30f395ed2f29e5c0db53a023212ed63c7bda2b267990484f85f7d7000000000e80000000020000200000009c555991100f38d615d0050d74b4bb7f0ad1d4159536d269158eec4c1ad15964200000008093a7bcc88f002ff05b56c14bccf3e1b684c37040c92001f38cf371c12a83fd40000000f37f8a8dcad6d0f2b28973b2c3047d3d58f876fda0a8b144b0710e21a6e3bc5e7e174c63359b333e5391e57a1be450f98267e977e5b4583a8b75d0e8d6a411a5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "7" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9726CAAF-C219-11EA-95F0-DED2E64E3982} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07f5e722656d601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DOMStorage\accounts.google.com\ = "7" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30823974" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1928431465" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "301087550" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30823974" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1928531464" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DOMStorage\accounts.google.com\ = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DOMStorage\accounts.google.com\ = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/appserve/mkt/p/AD-FnEzfRrCkFzCbI9b4pgsMdcoXWU2S0ra2GtezbuIdBhnUT5auBLj7r4YmwYefqwsUFYNbnjFnBsjwhdNRu9lD-ahOGoshUHIVHpWI79s69Y41⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: GetForegroundWindowSpam
- Modifies system certificate store
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
PID:3932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3932 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Checks processor information in registry
- Modifies Internet Explorer settings
PID:3876
-