4e49f62f1107ed67271099a42de8ca852ea74f8e03e0f259db68c8b765b38539

Analysis

Target
4e49f62f1107ed67271099a42de8ca852ea74f8e03e0f259db68c8b765b38539.exe
Size 546KB
Sample201108-er7m19yefn
SHA256 4e49f62f1107ed67271099a42de8ca852ea74f8e03e0f259db68c8b765b38539
MD5 7f89a368beb473d6343c59c5596ccc9e
SHA1 2ce08188974fbff030821705ddd7d49b7b1f502a
SHA512 4e717cbfd7227fa16d046e015f6f3b7061167b0b8bbf2cfc4042d1904e1fc1b3ee3afa1b6dc21ce876e56efbcbf2a8f71f5099bb97ebabc76667e6017930b501
MD5 SHA1 SHA512

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	4e49f62f1107ed67271099a42de8ca852ea74f8e03e0f259db68c8b765b38539.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	4e49f62f1107ed67271099a42de8ca852ea74f8e03e0f259db68c8b765b38539.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3980	4e49f62f1107ed67271099a42de8ca852ea74f8e03e0f259db68c8b765b38539.exe
3980	4e49f62f1107ed67271099a42de8ca852ea74f8e03e0f259db68c8b765b38539.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact