e60565332f82fb6265adcaffb2df26c8be1e4d96d3cf129263e7522bfbfd99bf

Analysis

Target
e60565332f82fb6265adcaffb2df26c8be1e4d96d3cf129263e7522bfbfd99bf.exe
Size 546KB
Sample201108-wthwscjp6x
SHA256 e60565332f82fb6265adcaffb2df26c8be1e4d96d3cf129263e7522bfbfd99bf
MD5 925b8b6649ba1058ca75216e3e212d13
SHA1 4907deab6fcb1cdbcb0ec0acc5471ed550705145
SHA512 6916f278443b94f6bc5e62009b45b1d0d77bf0fb0be17357638b9c7dfb8f94c773c3ffc5723a27dc69b097cda4af4a8ac626f43d0ff9b99629a1562a197d9c8b
MD5 SHA1 SHA512

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	e60565332f82fb6265adcaffb2df26c8be1e4d96d3cf129263e7522bfbfd99bf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	e60565332f82fb6265adcaffb2df26c8be1e4d96d3cf129263e7522bfbfd99bf.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4648	e60565332f82fb6265adcaffb2df26c8be1e4d96d3cf129263e7522bfbfd99bf.exe
4648	e60565332f82fb6265adcaffb2df26c8be1e4d96d3cf129263e7522bfbfd99bf.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact