a9a94f8f3dda875a661cbdeb090182c58aacc05e88027bad16b86dbb6d890993

General

Target

277bfstrategiv.exe
Size

250KB
MD5

302ecbde6adc7e31c9776cf7552e04ae
SHA1

1dea8ba1498d95ab4ca065a58a347b1d6ba1c1df
SHA256

a9a94f8f3dda875a661cbdeb090182c58aacc05e88027bad16b86dbb6d890993
SHA512

9fe93bb599ce134ffa04747af856863c579b9d64f85e83c7657513d719e585bd195aeb5a42ecb0c9c54f8230e2b7a3691dac3c3c8995fc39c6feab82fd8ff830

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid process

1696 iexplore.exe
1320 iexplore.exe
1952 iexplore.exe
1248 iexplore.exe
1464 iexplore.exe
1796 iexplore.exe
744 iexplore.exe
1848 iexplore.exe

Modifies Internet Explorer settings 1 TTPs 198 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9CC49C21-D318-11EA-A2F9-FE8A95F04971} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{52C7FF41-D318-11EA-A2F9-FE8A95F04971} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004183579d8c208a459c82062b1c0c5bf900000000020000000000106600000001000020000000e4948f56024a8dc9416884229c841f28f4bfa9246fd27505f8301de51b3ce73a000000000e8000000002000020000000139e9e1a57f80f1b353529e0431748664af3c147da8c6c9b4781d92a1ef414949000000054696e661e34b3029eb9ff563cc39c5339d1998893c47675a5f34e54c4265ae79e2afc1d6f55f50f0c7f9ab67878918251f91eadcd5704fcf5c2d5ed1259d9aca1f555b0a29ca40ade2f69bc54fbbd618007b405f8efc9b4a20261105fe7fb9ceac158e14d650ec4ab4bfa081e5150947b9de7ca0be2334f40b65f99f55a9b055651c049138944c41a509cd6b1548ef340000000c2eff130442a8113d56ee445460cac8f2d1fddaf245489deaa35cf4fe2cdfef8ee3a22e5a811da8e40c0d07d8929fc8e8b1e602c2670b1d803a43c54c04be88f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004183579d8c208a459c82062b1c0c5bf900000000020000000000106600000001000020000000cd53f375e767f837fe5b5d2a2e03fc6b3189c32da9e9b7cf733a2c31c96a2431000000000e8000000002000020000000c96c462c8ab381bdee0f41255efc0a230698ccb636a7479d00fe1ee51b92de0a2000000035d55ae5f9d05f46b6a57e5546957200f0ef090c9d03337d82f6e5a47b4fc76440000000f50fe08f1ac8518242ed69cdece0c948b5b19bdd97d7682ffb8fe7dade4f2c037b206ccf1e231ed56d8bc7d460df1276aa04478e67978a3b294faa681c391d66	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95E322A1-D318-11EA-A2F9-FE8A95F04971} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90316e2f2567d601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{748D8141-D318-11EA-A2F9-FE8A95F04971} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{882753C1-D318-11EA-A2F9-FE8A95F04971} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Checks whether UAC is enabled 16 IoCs

Processes:

IEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 1696 wrote to memory of 560	1696	iexplore.exe	IEXPLORE.EXE
PID 1696 wrote to memory of 560	1696	iexplore.exe	IEXPLORE.EXE
PID 1696 wrote to memory of 560	1696	iexplore.exe	IEXPLORE.EXE
PID 1696 wrote to memory of 560	1696	iexplore.exe	IEXPLORE.EXE
PID 1696 wrote to memory of 820	1696	iexplore.exe	IEXPLORE.EXE
PID 1696 wrote to memory of 820	1696	iexplore.exe	IEXPLORE.EXE
PID 1696 wrote to memory of 820	1696	iexplore.exe	IEXPLORE.EXE
PID 1696 wrote to memory of 820	1696	iexplore.exe	IEXPLORE.EXE
PID 1320 wrote to memory of 1496	1320	iexplore.exe	IEXPLORE.EXE
PID 1320 wrote to memory of 1496	1320	iexplore.exe	IEXPLORE.EXE
PID 1320 wrote to memory of 1496	1320	iexplore.exe	IEXPLORE.EXE
PID 1320 wrote to memory of 1496	1320	iexplore.exe	IEXPLORE.EXE
PID 1952 wrote to memory of 1900	1952	iexplore.exe	IEXPLORE.EXE
PID 1952 wrote to memory of 1900	1952	iexplore.exe	IEXPLORE.EXE
PID 1952 wrote to memory of 1900	1952	iexplore.exe	IEXPLORE.EXE
PID 1952 wrote to memory of 1900	1952	iexplore.exe	IEXPLORE.EXE
PID 1248 wrote to memory of 1480	1248	iexplore.exe	IEXPLORE.EXE
PID 1248 wrote to memory of 1480	1248	iexplore.exe	IEXPLORE.EXE
PID 1248 wrote to memory of 1480	1248	iexplore.exe	IEXPLORE.EXE
PID 1248 wrote to memory of 1480	1248	iexplore.exe	IEXPLORE.EXE
PID 1464 wrote to memory of 1664	1464	iexplore.exe	IEXPLORE.EXE
PID 1464 wrote to memory of 1664	1464	iexplore.exe	IEXPLORE.EXE
PID 1464 wrote to memory of 1664	1464	iexplore.exe	IEXPLORE.EXE
PID 1464 wrote to memory of 1664	1464	iexplore.exe	IEXPLORE.EXE
PID 1796 wrote to memory of 1748	1796	iexplore.exe	IEXPLORE.EXE
PID 1796 wrote to memory of 1748	1796	iexplore.exe	IEXPLORE.EXE
PID 1796 wrote to memory of 1748	1796	iexplore.exe	IEXPLORE.EXE
PID 1796 wrote to memory of 1748	1796	iexplore.exe	IEXPLORE.EXE
PID 744 wrote to memory of 2008	744	iexplore.exe	IEXPLORE.EXE
PID 744 wrote to memory of 2008	744	iexplore.exe	IEXPLORE.EXE
PID 744 wrote to memory of 2008	744	iexplore.exe	IEXPLORE.EXE
PID 744 wrote to memory of 2008	744	iexplore.exe	IEXPLORE.EXE
PID 1848 wrote to memory of 1028	1848	iexplore.exe	IEXPLORE.EXE
PID 1848 wrote to memory of 1028	1848	iexplore.exe	IEXPLORE.EXE
PID 1848 wrote to memory of 1028	1848	iexplore.exe	IEXPLORE.EXE
PID 1848 wrote to memory of 1028	1848	iexplore.exe	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 32 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
1696	iexplore.exe
1696	iexplore.exe
560	IEXPLORE.EXE
560	IEXPLORE.EXE
1320	iexplore.exe
1320	iexplore.exe
1496	IEXPLORE.EXE
1496	IEXPLORE.EXE
1952	iexplore.exe
1952	iexplore.exe
1900	IEXPLORE.EXE
1900	IEXPLORE.EXE
1248	iexplore.exe
1248	iexplore.exe
1480	IEXPLORE.EXE
1480	IEXPLORE.EXE
1464	iexplore.exe
1464	iexplore.exe
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE
1796	iexplore.exe
1796	iexplore.exe
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE
744	iexplore.exe
744	iexplore.exe
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
1848	iexplore.exe
1848	iexplore.exe
1028	IEXPLORE.EXE
1028	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\277bfstrategiv.exe
"C:\Users\Admin\AppData\Local\Temp\277bfstrategiv.exe"
1⤵
PID:1436

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:1696

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1696 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:560

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1696 CREDAT:472077 /prefetch:2
2⤵
PID:820

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:1320

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1320 CREDAT:275457 /prefetch:2
2⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:1496

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:1952

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:1900

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:1248

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1248 CREDAT:275457 /prefetch:2
2⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:1480

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:1464

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1464 CREDAT:275457 /prefetch:2
2⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:1664

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:1796

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:2
2⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:1748

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:744

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:744 CREDAT:275457 /prefetch:2
2⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:2008

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:1848

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275457 /prefetch:2
2⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:1028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\vvur1wv\imagestore.dat

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\vvur1wv\imagestore.dat

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\vvur1wv\imagestore.dat

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\vvur1wv\imagestore.dat

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\vvur1wv\imagestore.dat

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\vvur1wv\imagestore.dat

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\vvur1wv\imagestore.dat

Download Submit
memory/560-2-0x0000000005EB0000-0x0000000005ED3000-memory.dmp

Filesize
140KB

Download
memory/560-1-0x0000000000000000-mapping.dmp

Download
memory/1028-15-0x0000000000000000-mapping.dmp

Download
memory/1436-0-0x0000000000250000-0x0000000000267000-memory.dmp

Filesize
92KB

Download
memory/1480-7-0x0000000000000000-mapping.dmp

Download
memory/1496-3-0x0000000000000000-mapping.dmp

Download
memory/1664-9-0x0000000000000000-mapping.dmp

Download
memory/1748-11-0x0000000000000000-mapping.dmp

Download
memory/1900-5-0x0000000000000000-mapping.dmp

Download
memory/2008-13-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads