Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10_x64 -
resource
win10 -
submitted
31-07-2020 08:18
Static task
static1
Behavioral task
behavioral1
Sample
247bfstrategiv.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
247bfstrategiv.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
247bfstrategiv.exe
-
Size
250KB
-
MD5
c994648ae8de71188133b048f59dd379
-
SHA1
21658eec79f93b62c9f72f670689a10e5ff818b4
-
SHA256
29e9868a1c30d321b8faabde473671a4c4156abe943346aae334f9303c0ffc26
-
SHA512
319e81362f3fba1685f0652e7cc0485d3bd90d41223dde1e9084ed3c76749b45ab1e9dbe2217a34942714ac9f6a9c02d5df8aaffdd3523030ef3bda2fad46c33
Score
1/10
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD56E5A8-D307-11EA-95F0-4E106C1FB7BA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f72535b3d71787499ad6028e231c2f4e00000000020000000000106600000001000020000000229d51b49d3ccbe9e95072b4652c9e1fbd68882fde014f54f8f2852075384e67000000000e8000000002000020000000e73c722d2849cdbb9298071562c347187b4bb5ec4ed3c520331d922955a6dd632000000016ac80dea9ec25ff04de8f72077e51afa481e577677caf1f9a52aaee1c5e0e08400000005ec6a368afa65a93b3e84b9ba6003b1d9e26b2d347df8145fb163d48a31d0ee7ed23dd9f09e03fc7a4710aa7eaa1aaad7d789eaa74bd97737294863341b87d28 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60124a681467d601 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f72535b3d71787499ad6028e231c2f4e00000000020000000000106600000001000020000000ca82ae5a8a5ad5c7d9463c0c184ea7d0e73ccea2de8fe3c83d8654ba1b5a7e29000000000e80000000020000200000003d10382f900cda2540bf120de29606ed44fbd8ecb390b1d2a5b38ff50673d8a220000000dbb7878b72e1ad481af993f5dabd518ebd1d9aa51a34dd6c37f34d8a8836138c400000002963d7d4c7e95e50b7cb690c6c9ff0e40b1ee88c6d7a7b13188941130cb98185a95aadc35022eef55a91dd904c8ea6fb33520efd58f95054cd52849d5e3d3afa iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C15A821F-D307-11EA-95F0-4E106C1FB7BA} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f72535b3d71787499ad6028e231c2f4e000000000200000000001066000000010000200000002ce7a113976cda374335859d44d418957e4eaa82fc52119331e03e6fa61dc37a000000000e8000000002000020000000b64fe811056a524d017cea80dde7a2cae44650adcbe0b126dcd2d78a55e981c32000000001c55254a7e88a8e3089a8ab5f727584e8d462abface6c4287e458e4a706b57140000000d1c50ea30b01b9a378163fb2292843111a3e289677a27c1d0d6c53ac2d167aa8935be3e1188104acdf97fb340732f232b44a8dc6ce95b0cb6e0640cc227562cf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70391e991467d601 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1740310761" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30828308" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 200431841467d601 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C851E111-D307-11EA-95F0-4E106C1FB7BA} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f72535b3d71787499ad6028e231c2f4e0000000002000000000010660000000100002000000062948e0e8a84cb41f5342e7ac82f12317007d418f41047e25f8a0f30b87429a9000000000e8000000002000020000000a21169d339cb25a09fdd291dc97fec96bbad6344fbe247c40c4b4a78aff46d6020000000a0b1413056be3d08861f2d60dd0b948f516a22439797ee00407cb55134dc950f40000000976feb06c6dbb3294665e1739de1787b6b7bf3602f1aa813f98b8335add4f5adda000ca596bfb6163a37afd4e598469a5b07cc60fec1fd301cb93626e41c1859 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10af33691467d601 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f72535b3d71787499ad6028e231c2f4e00000000020000000000106600000001000020000000fceedc8af49a88fc420e6699f007fdf3ffc945591affd33baeb135e425fe7b3e000000000e8000000002000020000000b21e08ea27cce4282296dc0dd1e215025ce904b1a63cf5047eff77eeb5739944200000001d901f6f8cee079957bf81debac653c2dc74f3da2a9bab206e2223933133726c4000000025357b0d701ccd32060eae106de7ba63c49aed051f47d535088c701cdbc2f3a2438e832554bfbec47113b1e11c9955feb68a6e9e61d9f2d4919ffb8cdc5c56a0 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A6585E88-D307-11EA-95F0-4E106C1FB7BA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF579278-D307-11EA-95F0-4E106C1FB7BA} = "0" iexplore.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exedescription pid process target process PID 3456 wrote to memory of 3472 3456 iexplore.exe IEXPLORE.EXE PID 3456 wrote to memory of 3472 3456 iexplore.exe IEXPLORE.EXE PID 3456 wrote to memory of 3472 3456 iexplore.exe IEXPLORE.EXE PID 1752 wrote to memory of 3744 1752 iexplore.exe IEXPLORE.EXE PID 1752 wrote to memory of 3744 1752 iexplore.exe IEXPLORE.EXE PID 1752 wrote to memory of 3744 1752 iexplore.exe IEXPLORE.EXE PID 900 wrote to memory of 1164 900 iexplore.exe IEXPLORE.EXE PID 900 wrote to memory of 1164 900 iexplore.exe IEXPLORE.EXE PID 900 wrote to memory of 1164 900 iexplore.exe IEXPLORE.EXE PID 1672 wrote to memory of 4028 1672 iexplore.exe IEXPLORE.EXE PID 1672 wrote to memory of 4028 1672 iexplore.exe IEXPLORE.EXE PID 1672 wrote to memory of 4028 1672 iexplore.exe IEXPLORE.EXE PID 416 wrote to memory of 3732 416 iexplore.exe IEXPLORE.EXE PID 416 wrote to memory of 3732 416 iexplore.exe IEXPLORE.EXE PID 416 wrote to memory of 3732 416 iexplore.exe IEXPLORE.EXE PID 1332 wrote to memory of 1812 1332 iexplore.exe IEXPLORE.EXE PID 1332 wrote to memory of 1812 1332 iexplore.exe IEXPLORE.EXE PID 1332 wrote to memory of 1812 1332 iexplore.exe IEXPLORE.EXE PID 2884 wrote to memory of 3828 2884 iexplore.exe IEXPLORE.EXE PID 2884 wrote to memory of 3828 2884 iexplore.exe IEXPLORE.EXE PID 2884 wrote to memory of 3828 2884 iexplore.exe IEXPLORE.EXE PID 1932 wrote to memory of 3860 1932 iexplore.exe IEXPLORE.EXE PID 1932 wrote to memory of 3860 1932 iexplore.exe IEXPLORE.EXE PID 1932 wrote to memory of 3860 1932 iexplore.exe IEXPLORE.EXE PID 2268 wrote to memory of 1692 2268 iexplore.exe IEXPLORE.EXE PID 2268 wrote to memory of 1692 2268 iexplore.exe IEXPLORE.EXE PID 2268 wrote to memory of 1692 2268 iexplore.exe IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 36 IoCs
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEpid process 3456 iexplore.exe 3456 iexplore.exe 3472 IEXPLORE.EXE 3472 IEXPLORE.EXE 1752 iexplore.exe 1752 iexplore.exe 3744 IEXPLORE.EXE 3744 IEXPLORE.EXE 900 iexplore.exe 900 iexplore.exe 1164 IEXPLORE.EXE 1164 IEXPLORE.EXE 1672 iexplore.exe 1672 iexplore.exe 4028 IEXPLORE.EXE 4028 IEXPLORE.EXE 416 iexplore.exe 416 iexplore.exe 3732 IEXPLORE.EXE 3732 IEXPLORE.EXE 1332 iexplore.exe 1332 iexplore.exe 1812 IEXPLORE.EXE 1812 IEXPLORE.EXE 2884 iexplore.exe 2884 iexplore.exe 3828 IEXPLORE.EXE 3828 IEXPLORE.EXE 1932 iexplore.exe 1932 iexplore.exe 3860 IEXPLORE.EXE 3860 IEXPLORE.EXE 2268 iexplore.exe 2268 iexplore.exe 1692 IEXPLORE.EXE 1692 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exepid process 3456 iexplore.exe 1752 iexplore.exe 900 iexplore.exe 1672 iexplore.exe 416 iexplore.exe 1332 iexplore.exe 2884 iexplore.exe 1932 iexplore.exe 2268 iexplore.exe -
Checks whether UAC is enabled 18 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\247bfstrategiv.exe"C:\Users\Admin\AppData\Local\Temp\247bfstrategiv.exe"1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3456 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:900 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:416 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1332 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1164-3-0x0000000000000000-mapping.dmp
-
memory/1692-9-0x0000000000000000-mapping.dmp
-
memory/1812-6-0x0000000000000000-mapping.dmp
-
memory/3104-0-0x00000000020A0000-0x00000000020B7000-memory.dmpFilesize
92KB
-
memory/3472-1-0x0000000000000000-mapping.dmp
-
memory/3732-5-0x0000000000000000-mapping.dmp
-
memory/3744-2-0x0000000000000000-mapping.dmp
-
memory/3828-7-0x0000000000000000-mapping.dmp
-
memory/3860-8-0x0000000000000000-mapping.dmp
-
memory/4028-4-0x0000000000000000-mapping.dmp