c9641f5ab1c36ade9014183237b583d4257e8c60a0850ade7dfd93a9d03315fa

Analysis

Target
c9641f5ab1c36ade9014183237b583d4257e8c60a0850ade7dfd93a9d03315fa.exe
Size 546KB
Sample201108-47dp53f65x
SHA256 c9641f5ab1c36ade9014183237b583d4257e8c60a0850ade7dfd93a9d03315fa
MD5 897c6bdd12183ed7e441d9463021a99a
SHA1 914466a0fa00baad439b8f05056c05ac32e11e8e
SHA512 30a040f7533cb03a1c8fc666ad009c35e56f9ba34ac1de5f381b8677637c52f62eb09c2e2a101745b57e64ba0c6dc4a5368ae62f06170611c1fe31072ded8f7d
MD5 SHA1 SHA512

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	c9641f5ab1c36ade9014183237b583d4257e8c60a0850ade7dfd93a9d03315fa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	c9641f5ab1c36ade9014183237b583d4257e8c60a0850ade7dfd93a9d03315fa.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1100	c9641f5ab1c36ade9014183237b583d4257e8c60a0850ade7dfd93a9d03315fa.exe
1100	c9641f5ab1c36ade9014183237b583d4257e8c60a0850ade7dfd93a9d03315fa.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact