866bbfed0984202d487c557e4617c3b3372101031782748cc6a8cbf4c162cfc8

Analysis

Target
866bbfed0984202d487c557e4617c3b3372101031782748cc6a8cbf4c162cfc8.exe
Size 546KB
Sample201108-2ebzycw3ax
SHA256 866bbfed0984202d487c557e4617c3b3372101031782748cc6a8cbf4c162cfc8
MD5 66324491b9b8336452f7eb03828ba330
SHA1 61cd4d3d9d1e990ccce6fc0b512f0b826c9142d5
SHA512 4e390d8c04cfa1c22051c1f0936b35442f4a09b0d7bf57ce401a6bdca2e6aa432178ac687c68d7b2fda0b1f0b0d224a4d90472c31bdb8775d80652136287bfc8
MD5 SHA1 SHA512

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	866bbfed0984202d487c557e4617c3b3372101031782748cc6a8cbf4c162cfc8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	866bbfed0984202d487c557e4617c3b3372101031782748cc6a8cbf4c162cfc8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
656	866bbfed0984202d487c557e4617c3b3372101031782748cc6a8cbf4c162cfc8.exe
656	866bbfed0984202d487c557e4617c3b3372101031782748cc6a8cbf4c162cfc8.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact