867ba4a56a4f26230020eb93794d28c1aae9023882f63ad61101f7bf6acd13a1

General

Target

run.bat
Size

32B
MD5

620730fa5833ca62711e01172f9767c4
SHA1

402d21e79fb264be16ed69f6d07d9e35bdd8fb91
SHA256

5e6b3126b585d6cbc03f0f2f03487cbf48519476407064a61ec0652cfc4172ea
SHA512

62c8dc846c1c18bbac254b4c48d84627646fe81bf68b7c69a8fe694706cdad3632558f7db11abbb6fd67f26c30f0fb32819374b02b3cb1d49ab455cd99d7f0de

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 131 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{997157F5-25C2-11EB-BEBD-7E1794D3ADA4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e1a936cfb9d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e045944dcfb9d601	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 906f7b55cfb9d601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A11DE955-25C2-11EB-BEBD-7E1794D3ADA4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d000000000200000000001066000000010000200000003c6915fce88b7c992b8224f9180fdb228f882d1c5e4c1d1290850b18180ef101000000000e800000000200002000000004f4132c7b1ca0fab98840e0744dff305d259b476d194fdefd54d22b1e80f3752000000028aec47721f01baca9e771d5cce4ef6a0024ee47d352f1ac322816e052d094fe400000000e72e9a0b9ed147d80ff2d31b9002c5f863a3e29f7d092f66391e8a8bcd9ed852630871e4ae4bee962ca11eabbb2ac1301d1fc14eecb221ea349ce5a0eb8c9e0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100c1b2bcfb9d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{897711F7-25C2-11EB-BEBD-7E1794D3ADA4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{730D7CE5-25C2-11EB-BEBD-7E1794D3ADA4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B0B161D-25C2-11EB-BEBD-7E1794D3ADA4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d00000000020000000000106600000001000020000000af7d753b12cd047d45f32196a47cfd6e47dc075c024a745c79aa66865262600d000000000e8000000002000020000000ee228b2de80b60b5658621826df8af8f554e0a1e12d970a20d8c04dac4c0e74a200000001c236f0c678d3fbd17ba66d1117d32c5b8caa213e5d8f5c9db9b5bbce451c0d040000000df04d29e10c405f71085c55d5e5219c72d0882b47294c3f26decbf83e36c98bce37d49d2d7a26651df542651fe6a834bafa64d707d5a2acc5b9932a541c17761	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08bba3ecfb9d601	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{918204B5-25C2-11EB-BEBD-7E1794D3ADA4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30849487"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d00000000020000000000106600000001000020000000cc4a162bb46a05ebe5025127e7d599dcb502771e1502b153bca8c7e11f76d081000000000e80000000020000200000004fb2ae794242d29657f5ec8ff59029d9d7d7b4b2510ddc5df473884ff607a5c420000000ade7a53f8b61acaec6afeaf06143f662ea30c2ce7f7ddc97a9e2843b4d98c4d840000000a9bf9a42f1d7be9781a49d3862dda55f2bc7b3c1bd7e84843d9d16529f9224efae5ad33bee8c985e429d1cdda8baa3b37c3a7007955a5011475d8e70e7965abd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d0000000002000000000010660000000100002000000043bc2dcd1b70659b70569cc5c424cf2ca036f881ba7aa04fb463ea75ef48378f000000000e80000000020000200000007549f43e1f55f7d8f507ec8daf926a97569ad34e3bdfebe39b3406e29d3278ac20000000ba4b9287bd049434da827c26ed44821d0b7531981a71dac83c8ad42a536585e140000000ef52ce022d67a0ae22ff8d649c8c1d2fbe05a0084db39b743569ca73b234913fceb3364bb4f2a4c7d48564727fde8694813dbb99e9ca0695b13846977db53ec2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "692889384"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d00000000020000000000106600000001000020000000cce254013d35ea9c7c676856d3b0061685632213de01f6886c43ee055ca49873000000000e8000000002000020000000860bb366d1849f3c51680048aacb032deaedabfba831d638db978dc595223a6b200000002efee2ae218d1ee7728cd54bf805ef9ca7eb9ea4627114f8c162f68d539b29d440000000bd477ec50ded616b6f1922238af16406a90b640a03e916819baefd2e417e877fb3d38ad585ed2bd975145407749d045bdf522f4298ede79d64fa0ee342a74815	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid process

1172 iexplore.exe
2588 iexplore.exe
2224 iexplore.exe
4792 iexplore.exe
1916 iexplore.exe
3144 iexplore.exe
3376 iexplore.exe
2104 iexplore.exe

Suspicious use of SetWindowsHookEx 32 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
1172	iexplore.exe
1172	iexplore.exe
1400	IEXPLORE.EXE
1400	IEXPLORE.EXE
2588	iexplore.exe
2588	iexplore.exe
3304	IEXPLORE.EXE
3304	IEXPLORE.EXE
2224	iexplore.exe
2224	iexplore.exe
4560	IEXPLORE.EXE
4560	IEXPLORE.EXE
4792	iexplore.exe
4792	iexplore.exe
4744	IEXPLORE.EXE
4744	IEXPLORE.EXE
1916	iexplore.exe
1916	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
3144	iexplore.exe
3144	iexplore.exe
4200	IEXPLORE.EXE
4200	IEXPLORE.EXE
3376	iexplore.exe
3376	iexplore.exe
4292	IEXPLORE.EXE
4292	IEXPLORE.EXE
2104	iexplore.exe
2104	iexplore.exe
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

cmd.exeregsvr32.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 4804 wrote to memory of 5036	4804	cmd.exe	regsvr32.exe
PID 4804 wrote to memory of 5036	4804	cmd.exe	regsvr32.exe
PID 5036 wrote to memory of 4240	5036	regsvr32.exe	regsvr32.exe
PID 5036 wrote to memory of 4240	5036	regsvr32.exe	regsvr32.exe
PID 5036 wrote to memory of 4240	5036	regsvr32.exe	regsvr32.exe
PID 1172 wrote to memory of 1400	1172	iexplore.exe	IEXPLORE.EXE
PID 1172 wrote to memory of 1400	1172	iexplore.exe	IEXPLORE.EXE
PID 1172 wrote to memory of 1400	1172	iexplore.exe	IEXPLORE.EXE
PID 2588 wrote to memory of 3304	2588	iexplore.exe	IEXPLORE.EXE
PID 2588 wrote to memory of 3304	2588	iexplore.exe	IEXPLORE.EXE
PID 2588 wrote to memory of 3304	2588	iexplore.exe	IEXPLORE.EXE
PID 2224 wrote to memory of 4560	2224	iexplore.exe	IEXPLORE.EXE
PID 2224 wrote to memory of 4560	2224	iexplore.exe	IEXPLORE.EXE
PID 2224 wrote to memory of 4560	2224	iexplore.exe	IEXPLORE.EXE
PID 4792 wrote to memory of 4744	4792	iexplore.exe	IEXPLORE.EXE
PID 4792 wrote to memory of 4744	4792	iexplore.exe	IEXPLORE.EXE
PID 4792 wrote to memory of 4744	4792	iexplore.exe	IEXPLORE.EXE
PID 1916 wrote to memory of 2148	1916	iexplore.exe	IEXPLORE.EXE
PID 1916 wrote to memory of 2148	1916	iexplore.exe	IEXPLORE.EXE
PID 1916 wrote to memory of 2148	1916	iexplore.exe	IEXPLORE.EXE
PID 3144 wrote to memory of 4200	3144	iexplore.exe	IEXPLORE.EXE
PID 3144 wrote to memory of 4200	3144	iexplore.exe	IEXPLORE.EXE
PID 3144 wrote to memory of 4200	3144	iexplore.exe	IEXPLORE.EXE
PID 3376 wrote to memory of 4292	3376	iexplore.exe	IEXPLORE.EXE
PID 3376 wrote to memory of 4292	3376	iexplore.exe	IEXPLORE.EXE
PID 3376 wrote to memory of 4292	3376	iexplore.exe	IEXPLORE.EXE
PID 2104 wrote to memory of 1680	2104	iexplore.exe	IEXPLORE.EXE
PID 2104 wrote to memory of 1680	2104	iexplore.exe	IEXPLORE.EXE
PID 2104 wrote to memory of 1680	2104	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\system32\regsvr32.exe
regsvr32 -s 10.11nov322.gif.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:5036

C:\Windows\SysWOW64\regsvr32.exe
-s 10.11nov322.gif.dll
3⤵
PID:4240

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1400

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2588 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3304

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4560

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4792 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4744

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2148

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3144 CREDAT:82945 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:4200

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3376 CREDAT:82945 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:4292

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1680

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
MD5
a69fba04d9b13e82fb772d1b38b6054a

SHA1
f7ab8c1d32ddc58e13f65f9b8bb0cc844f164454

SHA256
733d04f9d9e1fdf85914f097cca3f8bfb3926c38a7ccf69e7c74d887abbc64ff

SHA512
6fae50c73cc08c48d5ecb6814785f82c46ded1dc00ba9a8b02a9b2bd907a10bba6015e0a5753487a12765db242162ce4f822bf5d3381a71ae2143c9f5d34669a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
MD5
b03ca8d992e0af77865380d1947cc057

SHA1
03c88892d66e6eee2c7762437fcb4a1a66eba8b2

SHA256
ecedf8269b89351926760db3f4ceec12f512f7b51e243ab1e872c33c1a003b2c

SHA512
8dad09ad9569c5d0ef79b00b149cccfeb8d7cf30fba54c048be30a8a9675a74091360c4b995ac56a6026c2721e0b4aa9511ddfabf6b39bc7d4cbc942ec9b7cd2

Download Submit
memory/1400-3-0x0000000000000000-mapping.dmp

Download
memory/1680-12-0x0000000000000000-mapping.dmp

Download
memory/2148-9-0x0000000000000000-mapping.dmp

Download
memory/3304-4-0x0000000000000000-mapping.dmp

Download
memory/4200-10-0x0000000000000000-mapping.dmp

Download
memory/4240-2-0x00000000030B0000-0x00000000030C2000-memory.dmp

Filesize
72KB

Download
memory/4240-1-0x0000000000000000-mapping.dmp

Download
memory/4292-11-0x0000000000000000-mapping.dmp

Download
memory/4560-7-0x0000000000000000-mapping.dmp

Download
memory/4744-8-0x0000000000000000-mapping.dmp

Download
memory/5036-0-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads