0e5cda7dd0ed8c3ce20b1019f5895deb2b780039d4ed3e32cb7d383bf237ca33

General

Target

sorvpng.dll
Size

599KB
MD5

4b4b4f795f03dd4bd84759cf7da0eae9
SHA1

40b9fd52a1db33bac2a9ef12ddee3439d7e2d3f8
SHA256

0e5cda7dd0ed8c3ce20b1019f5895deb2b780039d4ed3e32cb7d383bf237ca33
SHA512

178a8065b7306cbd9e4586e0079e614f9131e5364aefa778af7d8974c839e36ea5419fd3f0362a9757a5fee97c4fc1363e32d1c3a30f11148ca1cb141ea14265

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

26 4708 rundll32.exe

flow	pid	process
26	4708	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 99 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30854716"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40046a873cced601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d000000000200000000001066000000010000200000005e5d76660471fc13bc15a6fd9518d0ea1c78e82adc43720f2a129aa2cf5977b0000000000e80000000020000200000005e191b794338394524bae88940aba8c03cfe713e90cd38329e97fb545b70f9f2200000004a66a2e37e6dacbd775740feec232d0d2481eabef70def6fa22d8bf7616ee1b940000000c64acf93dc11202ea2a047377d6d4963879dc5a745ac1feab364412b427592137e38e7f30b707fd6faf656774f7d62b11f8e1828bdc8119ecd9ab9ae9668f29c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0aa1d573cced601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e08f276c3cced601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B790DDA2-3A2F-11EB-BEBD-52BC0BFFD7E7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1426256503"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50dc165c3cced601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80818FD5-3A2F-11EB-BEBD-52BC0BFFD7E7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d00000000020000000000106600000001000020000000d94127b42e99df8a62d6c6bc38712ccb251dc12bca5e2bce274995e0ab81ab9f000000000e8000000002000020000000f5c8e579eb5ab94d13e33d011ef8cb1dff0c04067bcfc47ec424a8cfd544515220000000feb4d06115b605b2bddcbda473489298e712d543041d45160f708135ed992f2940000000a2dc06cfe3ea4e104270ab91adcf0d1a005475eb3d75757157f0156a8a5391a4980c716ef553d04da749d2865376fc77c37546e61754b16482ece30a9bd335a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d00000000020000000000106600000001000020000000d53bc49d68c4ed9854203aada642e7424242ce7afe4335f09c2468a2dc23903a000000000e80000000020000200000009c88b5a9af7b97ac6fc3cfee512bac56e7b599bd3476628757bbf9598a487d1d20000000f3dfe330cb499e065b898f2b82f78b61a7af30154f33e0cb3a58a392ef9c67ed40000000c97a8b73e2ecc93ecea91156dfe02a9eadbf812294e8e7a34125dccd6cd6e1da19deecc9591e75e719b392a428a8aa6d11421f5fbdf107b9f676db66f717eb83	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d00000000020000000000106600000001000020000000d14331290228de455b7df07cd95087d4078bd61bca4006f4de5236c7083f9f1d000000000e800000000200002000000076b22a990872720294c3986722f39ec2b33e95696ad5aaea34d76e30868250312000000061cf3cb3d89d5286128eee3611b93dbea0e5499ab2af110feec65aa5a804b691400000007fd4d7240ec8ad4fa3b0fab645a383edc21d99e5dda4e9518148225c832052fbea43ab891fa6080a86089a300cec1cde37bceca52757220fcb16c8de01817858	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d00000000020000000000106600000001000020000000c5eb341237fd725d1a2b62681034d336f339efa478937ab64e0615203db705a2000000000e800000000200002000000016da7ea8a7aec9a12b1ce53c3a6c788c805cc6720992e7f0ff3ac16f6aadd48520000000639109ac0a8aa7aa1faf89daede76cef0ace272e03db1a9d233a39393b23a71f40000000b3fe981ddea9afe293597cfe31c0793e216d328a088c59f9316a6b050555f623a79b93aa191302d0fe99aa14acb77c69b0fecc3e241c2fd772a79768bc12ac98	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid process

4092 iexplore.exe
512 iexplore.exe
1484 iexplore.exe
2508 iexplore.exe
2400 iexplore.exe
1616 iexplore.exe

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
4092	iexplore.exe
4092	iexplore.exe
1868	IEXPLORE.EXE
1868	IEXPLORE.EXE
512	iexplore.exe
512	iexplore.exe
896	IEXPLORE.EXE
896	IEXPLORE.EXE
1484	iexplore.exe
1484	iexplore.exe
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
2508	iexplore.exe
2508	iexplore.exe
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2400	iexplore.exe
2400	iexplore.exe
4316	IEXPLORE.EXE
4316	IEXPLORE.EXE
1616	iexplore.exe
1616	iexplore.exe
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

rundll32.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 4648 wrote to memory of 4708	4648	rundll32.exe	rundll32.exe
PID 4648 wrote to memory of 4708	4648	rundll32.exe	rundll32.exe
PID 4648 wrote to memory of 4708	4648	rundll32.exe	rundll32.exe
PID 4092 wrote to memory of 1868	4092	iexplore.exe	IEXPLORE.EXE
PID 4092 wrote to memory of 1868	4092	iexplore.exe	IEXPLORE.EXE
PID 4092 wrote to memory of 1868	4092	iexplore.exe	IEXPLORE.EXE
PID 512 wrote to memory of 896	512	iexplore.exe	IEXPLORE.EXE
PID 512 wrote to memory of 896	512	iexplore.exe	IEXPLORE.EXE
PID 512 wrote to memory of 896	512	iexplore.exe	IEXPLORE.EXE
PID 1484 wrote to memory of 1728	1484	iexplore.exe	IEXPLORE.EXE
PID 1484 wrote to memory of 1728	1484	iexplore.exe	IEXPLORE.EXE
PID 1484 wrote to memory of 1728	1484	iexplore.exe	IEXPLORE.EXE
PID 2508 wrote to memory of 2608	2508	iexplore.exe	IEXPLORE.EXE
PID 2508 wrote to memory of 2608	2508	iexplore.exe	IEXPLORE.EXE
PID 2508 wrote to memory of 2608	2508	iexplore.exe	IEXPLORE.EXE
PID 2400 wrote to memory of 4316	2400	iexplore.exe	IEXPLORE.EXE
PID 2400 wrote to memory of 4316	2400	iexplore.exe	IEXPLORE.EXE
PID 2400 wrote to memory of 4316	2400	iexplore.exe	IEXPLORE.EXE
PID 1616 wrote to memory of 1296	1616	iexplore.exe	IEXPLORE.EXE
PID 1616 wrote to memory of 1296	1616	iexplore.exe	IEXPLORE.EXE
PID 1616 wrote to memory of 1296	1616	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sorvpng.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sorvpng.dll,#1
2⤵
- Blocklisted process makes network request
PID:4708

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4092 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1868

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:512

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:512 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:896

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1484 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1728

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2608

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:82945 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:4316

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1296

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\44B788DE399AB1AE5EC9790303CA67AC
MD5
d2f8bef41d726a813a663016cc71d266

SHA1
c0f83268fbc3690e6c277760cb26f07819b096bd

SHA256
59a93ca668f037a8c1f00982beeca5684e3187f22fdc9d9edb6c4db36ff782ba

SHA512
0472ab952a063fffc9c9540248b56ec8c81d0684804b9d4f97376ea9fab742691594aa8e0c98c8fd4d3aced4527453ac763acadef2057e3c8304a69c92feee04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
MD5
a3937e7c96f6a6758d9d47b31ec2f631

SHA1
a6ddca987506ade6cff0c3fb14358c3f2e663de2

SHA256
39a093299e6413d6bb7f6daa0f69e95231e9feadab80737db6647ea98ab5d893

SHA512
56ab7a51045d426425df6858d2aaca07a9432f97bfe330e7fc7f39ebfffccf1daa62a1b012a6b5ef45271c5005a8768e3ce3c62df834670cd36159872112e208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\44B788DE399AB1AE5EC9790303CA67AC
MD5
99a7b35cd2b4f3d0b2223053da14e2f1

SHA1
7a272d6d1f9e412930d429d7c529d9a05745f5d9

SHA256
55f3fa489afcbd0ce884cff7b0e43d028339c3967661c7c71da6f7715dd59128

SHA512
6e5442f25e33041c32ad66c128d677ae1f9ff0931d6d91c233b095a751d4d6d0743c3bd82d4c2540305431b59a432c073962649b2dfb2a7b79879537992c0053

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
MD5
ed65f8a664b8014c2f527fa23a40b074

SHA1
44263fcb9bafe5122489f07944ac47a010a05cc3

SHA256
632aa63d8ae54855e81d1f6ef7143f0ef4171af2078ba6aeb224e275c24fd632

SHA512
1148f9641d961e3ccd230c2bc0f8c346ad8f4923b1db3782cd03afd210a2ee13b6564ad457913c7127911cfd7bd225acac8c310035ca54c574a1140ba7224773

Download Submit
memory/896-5-0x0000000000000000-mapping.dmp

Download
memory/1296-13-0x0000000000000000-mapping.dmp

Download
memory/1728-10-0x0000000000000000-mapping.dmp

Download
memory/1868-4-0x0000000000000000-mapping.dmp

Download
memory/2608-11-0x0000000000000000-mapping.dmp

Download
memory/4316-12-0x0000000000000000-mapping.dmp

Download
memory/4708-2-0x0000000000000000-mapping.dmp

Download
memory/4708-3-0x00000000031E0000-0x00000000031F2000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads