8900a081311a5ef2c53ac928d096893e45e109eb5242d47a69a1911b8d9d4889

Analysis

Target
8900a081311a5ef2c53ac928d096893e45e109eb5242d47a69a1911b8d9d4889.exe
Size 546KB
Sample201108-j7egpw2ebe
SHA256 8900a081311a5ef2c53ac928d096893e45e109eb5242d47a69a1911b8d9d4889
MD5 aeeb15678776ec85c6f4b21f52381661
SHA1 37509ba55978e1ff46d49573740376df5af65515
SHA512 b549a259d02ff2b2e5ec24ba7bde4fc845849f34722ae6db3c0abe0ef5984e9021bb6c6f1cea1d018c880fc839cf31b3849a88d4fea8cccc9d2f78e5b9ad21bf
MD5 SHA1 SHA512

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	8900a081311a5ef2c53ac928d096893e45e109eb5242d47a69a1911b8d9d4889.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	8900a081311a5ef2c53ac928d096893e45e109eb5242d47a69a1911b8d9d4889.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4764	8900a081311a5ef2c53ac928d096893e45e109eb5242d47a69a1911b8d9d4889.exe
4764	8900a081311a5ef2c53ac928d096893e45e109eb5242d47a69a1911b8d9d4889.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact