94bb5ce324e3dbf3b2f19b85d33b77b376539ef51dce95443803c9036ffb2be3

General

Target

94bb5ce324e3dbf3b2f19b85d33b77b376539ef51dce95443803c9036ffb2be3.exe
Size

1.4MB
MD5

cf960a758eaedcd2b6e110a3ab359d9e
SHA1

54bd36675e88cc21dc125942c1474625a86cd83f
SHA256

94bb5ce324e3dbf3b2f19b85d33b77b376539ef51dce95443803c9036ffb2be3
SHA512

06277298a92a283f21e8c2e8b095723d84ee758de86c0c3684ee0316d2b3f5c13dcf7263f7b7d9c53387ebe9d32c2c056cd8eebc43124d9a45dcc9df116b7086

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 86 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E77253A7-1843-11EB-A97A-DED2E64E3982} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017569456ed1d8a4f809c4bd856b164d40000000002000000000010660000000100002000000041e75888f7ecb27fe51a71db047f39702684e4aeab460df4801be1072e42e798000000000e8000000002000020000000681f6abd2071c66c826160b6a983baafe1e5635b8693df00e324309178f5079a200000007c8788d55f10a3951a71329b7e795e34fff55193ae2e7c5849815b434598ba58400000002c9f8f24771bb2caff6babc4c10857367600824714216d285ec6623b39db1f43f1aefa8fcc75b08a6f12d571f66d1c1cb25b9b302baa20343210debeee829dfa	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017569456ed1d8a4f809c4bd856b164d4000000000200000000001066000000010000200000004e4677f4ca4a95463b6a35cbd693ed50412ee697b4cde25a3f62774da25de820000000000e80000000020000200000005594cc895c9041fb909363e01dad4b2f7bd055378d2d47d1472edc016e72d81e2000000060671afaa24e72eeaec5fc5c4a415a404ff21b63533324721c4d17a09d6505ff40000000af7337b71132738561e01673194d7984f12b4f88523b56572d060b10693b771084917cb1a1b724db9491770c1a484421885dbd893df3fbb028efffc539c94bca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 208551e350acd601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3153623556"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e1bebe50acd601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017569456ed1d8a4f809c4bd856b164d400000000020000000000106600000001000020000000aa0cfcfd3fd5eda96dd8b135a91aca08440c6dfc4c347ed9bdb827123e00dcad000000000e8000000002000020000000b609b20c2837638c17279edeef868cc4aa9cc27a723f78fbf4ae15a27cbaa417200000002020d5de99beb5644ac7754e137997c2cbf57b6cf964028e3b2c6a144c35a6184000000050a5acafd0e2a13802295d0adf1a99a69b98f13779290f9e2eedde827dda69f12b346955ef751c2a627458a4b8438c189354d29beb38fc2722edbc77105e4ca9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30846032"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE996A87-1843-11EB-A97A-DED2E64E3982} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017569456ed1d8a4f809c4bd856b164d400000000020000000000106600000001000020000000062d858d2ed2f921da9ab1148b65d2455ffcaa544f3a002a1c726a5b5d7505a1000000000e8000000002000020000000bd4a594c7a494721a0cf961234dcdd7bfd875b47c41c8a99da44ffbb6cec13732000000057d72817aa572160da3401b95f7052a553408a58faaebfb7aa34a59cac088280400000007c0363905362c88b619fd8addcc6669c28653fc55959b2f49be0328353e7e873759a0b23dd2dfb33bf12daf32b78c23572b8a9d64910313dd8ade226cd450736	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3153623556"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017569456ed1d8a4f809c4bd856b164d4000000000200000000001066000000010000200000008c66b2755e01e76d53329acd998dc1c6a3ac3577f4654990d327ed5b03bbe7f8000000000e8000000002000020000000e4f97d8b5549056d38c32186ec213c4dba64af18a5fc9dca042888ad1f2a23ea20000000f0f53e70a787abad1a4b14ed6d212d3bbe06aad3d65e7f60eedfb6830611920a4000000062b5ae4c9a3dc0365fd349d5ca12a7f1132ae7518e497eaa290ec86acfd27d1060da3a845b415905ff60cee6a90f776ca33f1e1566432aa5cbf9dc433c9da177	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fab2be50acd601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017569456ed1d8a4f809c4bd856b164d400000000020000000000106600000001000020000000c709303cd41845cfbc76aa608a725970c00e1c4824fcf6f1d34d801aa491f2aa000000000e80000000020000200000008bbbd415205cac5659986347383a7d5086b7fa3884ab09d879971ab7845dd3f520000000689b82088719354fed80e90b25c1019b632ad6086564fc470e016e296f9a4b5840000000333d51a1c7f4638e62842459824031af599b28645ea7eb31dcaf0980cc830acbaa8397340906b3a32ee7a44fa6fd8d9abb1555abe0f3d47c3adbbfb783476126	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5038f5d450acd601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0694A86A-1844-11EB-A97A-DED2E64E3982} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504b9cca50acd601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0ED50B0B-1844-11EB-A97A-DED2E64E3982} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid process

2024 iexplore.exe
1780 iexplore.exe
3488 iexplore.exe
1288 iexplore.exe
2052 iexplore.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
2024	iexplore.exe
2024	iexplore.exe
3896	IEXPLORE.EXE
3896	IEXPLORE.EXE
1780	iexplore.exe
1780	iexplore.exe
3868	IEXPLORE.EXE
3868	IEXPLORE.EXE
3488	iexplore.exe
3488	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
1288	iexplore.exe
1288	iexplore.exe
928	IEXPLORE.EXE
928	IEXPLORE.EXE
2052	iexplore.exe
2052	iexplore.exe
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 2024 wrote to memory of 3896	2024	iexplore.exe	IEXPLORE.EXE
PID 2024 wrote to memory of 3896	2024	iexplore.exe	IEXPLORE.EXE
PID 2024 wrote to memory of 3896	2024	iexplore.exe	IEXPLORE.EXE
PID 1780 wrote to memory of 3868	1780	iexplore.exe	IEXPLORE.EXE
PID 1780 wrote to memory of 3868	1780	iexplore.exe	IEXPLORE.EXE
PID 1780 wrote to memory of 3868	1780	iexplore.exe	IEXPLORE.EXE
PID 3488 wrote to memory of 2500	3488	iexplore.exe	IEXPLORE.EXE
PID 3488 wrote to memory of 2500	3488	iexplore.exe	IEXPLORE.EXE
PID 3488 wrote to memory of 2500	3488	iexplore.exe	IEXPLORE.EXE
PID 1288 wrote to memory of 928	1288	iexplore.exe	IEXPLORE.EXE
PID 1288 wrote to memory of 928	1288	iexplore.exe	IEXPLORE.EXE
PID 1288 wrote to memory of 928	1288	iexplore.exe	IEXPLORE.EXE
PID 2052 wrote to memory of 2324	2052	iexplore.exe	IEXPLORE.EXE
PID 2052 wrote to memory of 2324	2052	iexplore.exe	IEXPLORE.EXE
PID 2052 wrote to memory of 2324	2052	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\94bb5ce324e3dbf3b2f19b85d33b77b376539ef51dce95443803c9036ffb2be3.exe
"C:\Users\Admin\AppData\Local\Temp\94bb5ce324e3dbf3b2f19b85d33b77b376539ef51dce95443803c9036ffb2be3.exe"
1⤵
PID:3892

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3896

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1780 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3868

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3488 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2500

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:928

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
MD5
9c8803157da472557f25514b484e123e

SHA1
0c6f830fe60b615f1543eee6755bbe7bad1fc25b

SHA256
c0e6e5ae60ed8ed5918f5bec491bdf51a3c47ccd46d4cb0e4ac1e8896fa5551b

SHA512
c41dcc9c756c102c6521e44f1937e054de804a20378443733463a754dd944bcbac97ca9ff7b0b649e5b5c2072826877081871808b442ac5a7a92ba335daa6c78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
MD5
141b0cdcad0d58d42ed5894154dadf30

SHA1
0957a566850bd72ba873868a02e0845b98ddce49

SHA256
2ec1c49e69aef34c0f9768f0404801fe933354e4440178053d11a256fec67497

SHA512
5454f1370976f5382b80e4d021ef0a4d0bf9624410ce4286debf7b86b63575d595e63eea6c0baa5acec4dbe64b0709cf0ee3355fa52e261dd6263518d5370ed8

Download Submit
memory/928-6-0x0000000000000000-mapping.dmp

Download
memory/2324-7-0x0000000000000000-mapping.dmp

Download
memory/2500-5-0x0000000000000000-mapping.dmp

Download
memory/3868-2-0x0000000000000000-mapping.dmp

Download
memory/3892-0-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download
memory/3896-1-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads