76c8a9dbff9b571500729611595f1a1bce8dab543922d731c3bb42af5477f517

General

Target

76c8a9dbff9b571500729611595f1a1bce8dab543922d731c3bb42af5477f517.exe
Size

459KB
MD5

165764b4314eea6105dcb41e02a0bea4
SHA1

9e9218fa0b3d51ed02185658a5290200b7ced108
SHA256

76c8a9dbff9b571500729611595f1a1bce8dab543922d731c3bb42af5477f517
SHA512

641477979c2484bd5101e537bea96001bcc93737b0945d26ab4ddc6d748653dce5f09655e0f6dec002c6f16aa2918dcfc77912b5c06323adee47c807de52adc6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 101 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017569456ed1d8a4f809c4bd856b164d400000000020000000000106600000001000020000000fde3c28d9547a251debe6f587056ba7c0523e904e604d95c6b9c95fd4e414f58000000000e80000000020000200000005fce356674e8badb748fcafaf48c1f5a35d81ad2ee1a288a5224282a37d64fa92000000095440959e4ea9966c708964bcfa4574b47ee9af59e70f37fb49d1a7cc91e3d6b40000000fa68644a05036146f49ad5153e9c332a0f125a2f86d1d075d26e6d760bc013153631427e16574af4694104ccb6cb2dcfc0266b23f06670ddd102555192e6fbec	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ee2cc750acd601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30846032"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20FC3E76-1844-11EB-A97A-D6D084740B7E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017569456ed1d8a4f809c4bd856b164d40000000002000000000010660000000100002000000084a31f2df0d8bde336fc205d216d9d2cbdc3900ffd3ee622100e921cc1c9385c000000000e80000000020000200000001a02a63ca9405aa4d72d517188528880529e35d4024fec5d09d32d73a09da68520000000827a97c370bc72de0b630010d57f5cb3346bf8a6516624e8ebe449c4a5542212400000009518b615adec7c743d59a698ef01271f10a41409ab86d9c777863beb61da68c46857f0ef8038c11483a34c1a42d0d3d127640768ba297123b88c4fe533f7ea4d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017569456ed1d8a4f809c4bd856b164d400000000020000000000106600000001000020000000f1d8e66e79eea71e7960b06e602f74188d2390a8391c1940889fc614b7e91d0d000000000e8000000002000020000000dac7b6ef5a6736b6f79f72948c9072ed21675f97b481eb85e88d4b2bcecd2836200000009835ac5dcf1449569b1fc37229998576a084bffe1d45e9dc1637c05d6b248e5740000000c1cf31d937fa1ad60c4d1f6fad3974a0b0e8454d8fa5acc9d11e9c25259f42044c345ac107fdb4c45d4b73d42d45002c2b087a20ff1e7ce9208d01a7267488ed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017569456ed1d8a4f809c4bd856b164d400000000020000000000106600000001000020000000cf8c2e562a39ca20433dd746ed883ac61bce37e3891f37390088a370fe660226000000000e8000000002000020000000f083041a21aa646957a0f2a74a63b3566230756727c96090b4824c3ca6d64b2d20000000b2da2e34246f5dd27603995b40069dc70d1fb17bb640669b9b3987b7bc20f41c4000000075c611b72da836e50015b057e1e4453f95f51cfa790eaf3962978d9081c4e0fa68c6000eb3ad428d81e9f06418cfcfbbbce36cae62cae27b558c4c0610808e6f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5E23402-1843-11EB-A97A-D6D084740B7E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e949bc50acd601	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0376610A-1844-11EB-A97A-D6D084740B7E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307601dd50acd601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04c40bc50acd601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d0bee450acd601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{195936F8-1844-11EB-A97A-D6D084740B7E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3127557920"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017569456ed1d8a4f809c4bd856b164d400000000020000000000106600000001000020000000c0791779d5a015c240bd5b7c42c9dd485776133f343bb3cf9fb6114a5e52a71b000000000e80000000020000200000008bfb3f09766d3e29762fa51445f9fd00a73583f406627fc2f13cfc8282ffcf3720000000798f1855d8047e9bf32359e3e641c92c315fabe06f8ac54d15f5455a7b110c5f400000008388c7c99d57fafef29ac4d04abd615a5904ec5f4e716921310d81f0c4cd4f1438497cbc87b02735b34a68f7f5012cb6279a35da03735a7c58b5abf69edae5cb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B209195-1844-11EB-A97A-D6D084740B7E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30846032"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid process

2652 iexplore.exe
3800 iexplore.exe
3676 iexplore.exe
3128 iexplore.exe
936 iexplore.exe
3920 iexplore.exe

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
2652	iexplore.exe
2652	iexplore.exe
4092	IEXPLORE.EXE
4092	IEXPLORE.EXE
3800	iexplore.exe
3800	iexplore.exe
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
3676	iexplore.exe
3676	iexplore.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
3128	iexplore.exe
3128	iexplore.exe
1112	IEXPLORE.EXE
1112	IEXPLORE.EXE
936	iexplore.exe
936	iexplore.exe
860	IEXPLORE.EXE
860	IEXPLORE.EXE
3920	iexplore.exe
3920	iexplore.exe
1896	IEXPLORE.EXE
1896	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 2652 wrote to memory of 4092	2652	iexplore.exe	IEXPLORE.EXE
PID 2652 wrote to memory of 4092	2652	iexplore.exe	IEXPLORE.EXE
PID 2652 wrote to memory of 4092	2652	iexplore.exe	IEXPLORE.EXE
PID 3800 wrote to memory of 2016	3800	iexplore.exe	IEXPLORE.EXE
PID 3800 wrote to memory of 2016	3800	iexplore.exe	IEXPLORE.EXE
PID 3800 wrote to memory of 2016	3800	iexplore.exe	IEXPLORE.EXE
PID 3676 wrote to memory of 2248	3676	iexplore.exe	IEXPLORE.EXE
PID 3676 wrote to memory of 2248	3676	iexplore.exe	IEXPLORE.EXE
PID 3676 wrote to memory of 2248	3676	iexplore.exe	IEXPLORE.EXE
PID 3128 wrote to memory of 1112	3128	iexplore.exe	IEXPLORE.EXE
PID 3128 wrote to memory of 1112	3128	iexplore.exe	IEXPLORE.EXE
PID 3128 wrote to memory of 1112	3128	iexplore.exe	IEXPLORE.EXE
PID 936 wrote to memory of 860	936	iexplore.exe	IEXPLORE.EXE
PID 936 wrote to memory of 860	936	iexplore.exe	IEXPLORE.EXE
PID 936 wrote to memory of 860	936	iexplore.exe	IEXPLORE.EXE
PID 3920 wrote to memory of 1896	3920	iexplore.exe	IEXPLORE.EXE
PID 3920 wrote to memory of 1896	3920	iexplore.exe	IEXPLORE.EXE
PID 3920 wrote to memory of 1896	3920	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\76c8a9dbff9b571500729611595f1a1bce8dab543922d731c3bb42af5477f517.exe
"C:\Users\Admin\AppData\Local\Temp\76c8a9dbff9b571500729611595f1a1bce8dab543922d731c3bb42af5477f517.exe"
1⤵
PID:3140

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:82945 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:4092

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3800

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3800 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2016

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3676 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2248

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3128

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3128 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1112

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:936 CREDAT:82945 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:860

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3920 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1896

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-5-0x0000000000000000-mapping.dmp

Download
memory/1112-4-0x0000000000000000-mapping.dmp

Download
memory/1896-6-0x0000000000000000-mapping.dmp

Download
memory/2016-2-0x0000000000000000-mapping.dmp

Download
memory/2248-3-0x0000000000000000-mapping.dmp

Download
memory/3140-0-0x0000000000820000-0x0000000000832000-memory.dmp

Filesize
72KB

Download
memory/4092-1-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads