ff152184b78d56ab5dd08bf749cc8d1b77209652b34fa2a6dbc77cd087b763a2

Analysis

Target
ff152184b78d56ab5dd08bf749cc8d1b77209652b34fa2a6dbc77cd087b763a2.exe
Size 554KB
Sample201109-ahs29nj3mx
SHA256 ff152184b78d56ab5dd08bf749cc8d1b77209652b34fa2a6dbc77cd087b763a2
MD5 35c2a7bd767399cb0a12cc286b562ba1
SHA1 e797301f6c8faddf632f9fd809c1ff9cd31a00dc
SHA512 9fe305f9c47f9419026bff70dac0a6833b4bc5e795b1dfa40be7c77ba20169a38a5ab187aa7bc2ae00e472949cc07a740ff918651e12d05a303ab78ba2eec454
MD5 SHA1 SHA512

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ff152184b78d56ab5dd08bf749cc8d1b77209652b34fa2a6dbc77cd087b763a2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ff152184b78d56ab5dd08bf749cc8d1b77209652b34fa2a6dbc77cd087b763a2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4004	ff152184b78d56ab5dd08bf749cc8d1b77209652b34fa2a6dbc77cd087b763a2.exe
4004	ff152184b78d56ab5dd08bf749cc8d1b77209652b34fa2a6dbc77cd087b763a2.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact