Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
26-05-2021 04:32
Static task
static1
Behavioral task
behavioral1
Sample
8f6b3ca7b7afd249f3fc68f7ff2ce5ca5a206c2a1d123b5ac3aa28bf7f1eabd8.exe
Resource
win7v20210408
General
-
Target
8f6b3ca7b7afd249f3fc68f7ff2ce5ca5a206c2a1d123b5ac3aa28bf7f1eabd8.exe
-
Size
279KB
-
MD5
e51e8d553d497180c028cbd9b3123d32
-
SHA1
902d5707d5e8d6d4e6f6e60e1b95aea5609723c6
-
SHA256
8f6b3ca7b7afd249f3fc68f7ff2ce5ca5a206c2a1d123b5ac3aa28bf7f1eabd8
-
SHA512
5ed08018b744233fd72f3c283b55e3809cc628e6d82edcbdf6f9ae6170c6e20faa8fc499d0949fc68695f98d757701418247b955f261a95bf7b6dc31b155f437
Malware Config
Extracted
gozi_rm3
202105141
https://robonight.xyz
-
build
300968
-
exe_type
loader
-
non_target_locale
RU
-
server_id
12
-
url_path
index.htm
Signatures
-
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad98e1c4c5c1f64cbad3c833b8884b2700000000020000000000106600000001000020000000368dbb6a8ac098472de2dc7be4aaea36a3305d1aa182ec46f3cc05bf1eef8575000000000e800000000200002000000045c800ebabf7a81c9c7a81df5a4f3a5fc98092af9cff98b0c128117b0035282920000000a8e45636202a8a6cc9ad47f358413981d2eb2d663aecdf0400a37f3821b4a7a040000000e4f49e01bac314ca0721410234e9ac976f6d90588771c228f0e44950beb9d3154faa9259f62061805c82d1522e833f08ab882a59e4237de2558a28f4cd28e1f6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3044847427" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2028fad6e851d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02dbeb9e851d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad98e1c4c5c1f64cbad3c833b8884b2700000000020000000000106600000001000020000000f6609a8353cc49603f8ae72463a94e490fa8f110ff2bb83c611289b1bc15652e000000000e8000000002000020000000b7f6b271e3909e13c88e071c4140361c8552a650142cfd59bd40eedef0123354200000009b187bbe59f43cb8e4da2d1b9a91e0b8c8f8a79c295ebfb93ba7e0b3ed04054b400000008df5bf76576ddad05b259f009a0feb94d7fb6aca3b2d2d3a3d26c7980dc25fdad0aee759943f0faeae145a980ece39c7b7f7a605c6908be38ded13a3cc01c269 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1AFE647A-BDDC-11EB-A11C-CE9B817779E4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E0FDAF3B-BDDB-11EB-A11C-CE9B817779E4} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad98e1c4c5c1f64cbad3c833b8884b2700000000020000000000106600000001000020000000dffdd393a1347827f61fcd80bb112c0d93fdf98a73468954dff7e836fb6c2105000000000e8000000002000020000000df9ec7fe018067195cf612c11b344594791e6010a791d6a04258b369d35a418420000000ffe55584bfa5188a465e1d460f5ae195af71eb0c93a4e2053066b9e0c30ad8aa4000000035495dc069b5a35f7360ca5b79298f97f04822fe7d231fa2d87c6875ddb2546b81b75d722b2d9b6c773b117132e06d7957b99e3bf5db5eb7c3e44f870155d3b1 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ad74dee851d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDD0BFC0-BDDB-11EB-A11C-CE9B817779E4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad98e1c4c5c1f64cbad3c833b8884b2700000000020000000000106600000001000020000000a133c5feb91060cf84a87f08f9d337fc14e01c2d08a9f0c1cf49d90bc804b41d000000000e80000000020000200000006d8a8507b15505637ba3564d3274cf07c7a69e8fe1cb3f205065d93da03b6f06200000001efa447a0944f8c540f46170018dfb9906075fefa5a3bc511544acfeb281014740000000bd91ef54004c6a1b324b49a9881400f720373443db6b17a2c006ccd6c927c16492142ad9f49752ebc61198ff34c85686a2eae31c5818b5fb24ce93b161e361a7 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22826E5C-BDDC-11EB-A11C-CE9B817779E4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A067A20-BDDC-11EB-A11C-CE9B817779E4} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad98e1c4c5c1f64cbad3c833b8884b2700000000020000000000106600000001000020000000390c0268aafb8179e9371e64dd416ea75ee6d3abd56a12264644b67e9f9c7b8d000000000e8000000002000020000000e363281f22e3201ed09dc329a9b222b3cb1fb6ec601891139005e8b75c4128ae20000000b355631db738fbacbdd368fed623e45f015d1a356425ae227a169ee93d3cc20f400000006b9920d36c17297517e5051ae9f6f839b378037c35e55e6e6ee8c782e77577107587b56e5b3f332c1ce363110eb336951895c91df515ef49a1b8e4bfa434c757 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad98e1c4c5c1f64cbad3c833b8884b2700000000020000000000106600000001000020000000e096580a2de0731780bad4343a51ef1d800357235d85e3b4a88d937df380d28a000000000e8000000002000020000000da3e81f866213fcc2d3cf3c17e82fff482365711959ee73794129a15944696392000000013e83e97e336e63187b08519bed7d2b732aea321f181ce4c89209a2a0ce1b2cf40000000d7743790245e26dcdb5de5c00143d8662abb9e9d5b191dbef101cb865d6cdcc5f48af2ac8ae5c0d0b529ed2a04b1ee44e27c0d6dc85a78342a2a330b4584a272 iexplore.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exepid process 3364 iexplore.exe 192 iexplore.exe 1532 iexplore.exe 1768 iexplore.exe 1352 iexplore.exe 644 iexplore.exe 1192 iexplore.exe 2480 iexplore.exe -
Suspicious use of SetWindowsHookEx 32 IoCs
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEpid process 3364 iexplore.exe 3364 iexplore.exe 4092 IEXPLORE.EXE 4092 IEXPLORE.EXE 192 iexplore.exe 192 iexplore.exe 3100 IEXPLORE.EXE 3100 IEXPLORE.EXE 1532 iexplore.exe 1532 iexplore.exe 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 1768 iexplore.exe 1768 iexplore.exe 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE 1352 iexplore.exe 1352 iexplore.exe 3864 IEXPLORE.EXE 3864 IEXPLORE.EXE 644 iexplore.exe 644 iexplore.exe 1588 IEXPLORE.EXE 1588 IEXPLORE.EXE 1192 iexplore.exe 1192 iexplore.exe 580 IEXPLORE.EXE 580 IEXPLORE.EXE 2480 iexplore.exe 2480 iexplore.exe 1896 IEXPLORE.EXE 1896 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exedescription pid process target process PID 3364 wrote to memory of 4092 3364 iexplore.exe IEXPLORE.EXE PID 3364 wrote to memory of 4092 3364 iexplore.exe IEXPLORE.EXE PID 3364 wrote to memory of 4092 3364 iexplore.exe IEXPLORE.EXE PID 192 wrote to memory of 3100 192 iexplore.exe IEXPLORE.EXE PID 192 wrote to memory of 3100 192 iexplore.exe IEXPLORE.EXE PID 192 wrote to memory of 3100 192 iexplore.exe IEXPLORE.EXE PID 1532 wrote to memory of 2128 1532 iexplore.exe IEXPLORE.EXE PID 1532 wrote to memory of 2128 1532 iexplore.exe IEXPLORE.EXE PID 1532 wrote to memory of 2128 1532 iexplore.exe IEXPLORE.EXE PID 1768 wrote to memory of 2208 1768 iexplore.exe IEXPLORE.EXE PID 1768 wrote to memory of 2208 1768 iexplore.exe IEXPLORE.EXE PID 1768 wrote to memory of 2208 1768 iexplore.exe IEXPLORE.EXE PID 1352 wrote to memory of 3864 1352 iexplore.exe IEXPLORE.EXE PID 1352 wrote to memory of 3864 1352 iexplore.exe IEXPLORE.EXE PID 1352 wrote to memory of 3864 1352 iexplore.exe IEXPLORE.EXE PID 644 wrote to memory of 1588 644 iexplore.exe IEXPLORE.EXE PID 644 wrote to memory of 1588 644 iexplore.exe IEXPLORE.EXE PID 644 wrote to memory of 1588 644 iexplore.exe IEXPLORE.EXE PID 1192 wrote to memory of 580 1192 iexplore.exe IEXPLORE.EXE PID 1192 wrote to memory of 580 1192 iexplore.exe IEXPLORE.EXE PID 1192 wrote to memory of 580 1192 iexplore.exe IEXPLORE.EXE PID 2480 wrote to memory of 1896 2480 iexplore.exe IEXPLORE.EXE PID 2480 wrote to memory of 1896 2480 iexplore.exe IEXPLORE.EXE PID 2480 wrote to memory of 1896 2480 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f6b3ca7b7afd249f3fc68f7ff2ce5ca5a206c2a1d123b5ac3aa28bf7f1eabd8.exe"C:\Users\Admin\AppData\Local\Temp\8f6b3ca7b7afd249f3fc68f7ff2ce5ca5a206c2a1d123b5ac3aa28bf7f1eabd8.exe"1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3364 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:192 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1532 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1352 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:644 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1192 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4MD5
9bd290c73c295139470b5a56f8d857bb
SHA1c838907b18895bc98a601e27c30b5de9acef88e7
SHA256bfc8f14e57e8fe77f10ec2c420b746a75291c034dd872bc673e459ebfdac5968
SHA512c8a77182ce1832fe96f35a2816120c9df00eca1aa29dce49a111f057d3583b3b25a69c88f579cc84f4ff43fbf17f663a1e07234aacdd1831bbdb443f8f234e36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4MD5
ee7dfef539382e021c014a341abeef4e
SHA11a04f4b37d0c3b593aabcbe8b30b2410ac3e2061
SHA2569f1fa0bd5bbb23e37d4a49220ba1069409bb4f9dda87c3e32d7749ff0034bfbf
SHA51201cc73f9434fd6fe7608de907288a5c897c3786f1da6270c19eb73fd28dcb91d80b8e1fdf6d737bbf714a69cc7ea49235e850e67772e70845f4d87b2a9817698
-
memory/192-121-0x00007FFA57D90000-0x00007FFA57DFB000-memory.dmpFilesize
428KB
-
memory/580-134-0x0000000000000000-mapping.dmp
-
memory/644-131-0x00007FFA57EA0000-0x00007FFA57F0B000-memory.dmpFilesize
428KB
-
memory/1192-133-0x00007FFA57EA0000-0x00007FFA57F0B000-memory.dmpFilesize
428KB
-
memory/1352-129-0x00007FFA57EA0000-0x00007FFA57F0B000-memory.dmpFilesize
428KB
-
memory/1532-125-0x00007FFA57D90000-0x00007FFA57DFB000-memory.dmpFilesize
428KB
-
memory/1588-132-0x0000000000000000-mapping.dmp
-
memory/1768-127-0x00007FFA57EA0000-0x00007FFA57F0B000-memory.dmpFilesize
428KB
-
memory/1896-136-0x0000000000000000-mapping.dmp
-
memory/2128-126-0x0000000000000000-mapping.dmp
-
memory/2208-128-0x0000000000000000-mapping.dmp
-
memory/2480-135-0x00007FFA57EA0000-0x00007FFA57F0B000-memory.dmpFilesize
428KB
-
memory/3100-122-0x0000000000000000-mapping.dmp
-
memory/3364-119-0x00007FFA471B0000-0x00007FFA4721B000-memory.dmpFilesize
428KB
-
memory/3864-130-0x0000000000000000-mapping.dmp
-
memory/3904-115-0x0000000000530000-0x0000000000544000-memory.dmpFilesize
80KB
-
memory/3904-118-0x0000000001000000-0x0000000001055000-memory.dmpFilesize
340KB
-
memory/3904-117-0x0000000000400000-0x000000000054A000-memory.dmpFilesize
1.3MB
-
memory/4092-120-0x0000000000000000-mapping.dmp