328449250e95af61e5e92254665d4c1a43d835482cd2d159c1e8a08a1ad8c725

Analysis

Target

c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe
Size

965KB
MD5

613eb0c25564d774d81d1e4a96fd49b4
SHA1

39517f6689a4fc87df0b014fd163a2d291379e8f
SHA256

c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536
SHA512

b8caa329c7ce7cd18a9fee3201bd3da8ba531e88e9049ff93c0dde4c198569a17debda7388c652d2bb486f71a7612fd709e52642ce68406791ec6114030aee0a

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 1 IoCs

Modify Registry

Processes:

c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe

pid process

912 c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe

pid	process
912	c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe
912	c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2008-0-0x000007FEF6580000-0x000007FEF67FA000-memory.dmp

Filesize
2.5MB

Download