3d2976f758c86656571a84dc68ecc9de1ec8500b3c35b6ad4ea6b0d72a4f9b00

Analysis

Target
3d2976f758c86656571a84dc68ecc9de1ec8500b3c35b6ad4ea6b0d72a4f9b00.exe
Size 546KB
Sample201108-1b8e3dabv6
SHA256 3d2976f758c86656571a84dc68ecc9de1ec8500b3c35b6ad4ea6b0d72a4f9b00
MD5 8cd692af7add8f503a45a77e6935156e
SHA1 4835f14ec911a8dd54704eaed4bcc3f44bf7df31
SHA512 93b2c65fe6bf4ec7e071df7bc6a9057b530c240e2c7b50bf0fde695efb36c60b1a05dc8b24f4883013f934890ac95e1b0a185e122ae20ce63e3470ba84f44c23
MD5 SHA1 SHA512

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	3d2976f758c86656571a84dc68ecc9de1ec8500b3c35b6ad4ea6b0d72a4f9b00.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	3d2976f758c86656571a84dc68ecc9de1ec8500b3c35b6ad4ea6b0d72a4f9b00.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3920	3d2976f758c86656571a84dc68ecc9de1ec8500b3c35b6ad4ea6b0d72a4f9b00.exe
3920	3d2976f758c86656571a84dc68ecc9de1ec8500b3c35b6ad4ea6b0d72a4f9b00.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact