Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
10-09-2021 05:26
Static task
static1
Behavioral task
behavioral1
Sample
31f5ee68e7548cd1d49720492502877466b35241cd441b48eefbddffc74a5475.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
General
-
Target
31f5ee68e7548cd1d49720492502877466b35241cd441b48eefbddffc74a5475.exe
-
Size
880KB
-
MD5
d0cb3af3f2f9bbb89faba16f41585e7c
-
SHA1
3a1006610fc6e98670cfd6f01744e4623eeedd9b
-
SHA256
31f5ee68e7548cd1d49720492502877466b35241cd441b48eefbddffc74a5475
-
SHA512
c0865d84c4b60dbb257e2486a0928d984c0595fe505ddb79998efe57b5302855403b5e2dc884c47a3eade3e90ad4c3ac10033a05ed22ac80413b21828899d0d3
Malware Config
Extracted
Family
gozi_rm3
Attributes
-
build
300981
Extracted
Family
gozi_rm3
Botnet
202108021
C2
https://haverit.xyz
Attributes
-
build
300981
-
exe_type
loader
-
non_target_locale
RU
-
server_id
12
-
url_path
index.htm
rsa_pubkey.plain
aes.plain
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10ad35cd15a6d701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bfc25816c5d5de43a62917dde3a44bc200000000020000000000106600000001000020000000f6ead5e04b54b82e793e469681bbd51f3b186363f30c853b906142aa4adf0ba6000000000e80000000020000200000009b2ecc607eeefc63ce4d24b3796a00c43c5638b533f77424b6d026880f4bc8042000000008daa415ce67b8b914777b71b6c656368c5bc973e23528118052809b540f71f440000000bf957f6311bb7eb87c2f7ad2f503e471d282b1d47c134298a8759325f6c1e86d4fdf9bcf265607a8b7384f35c7f6a2dd0f38fa01fa69a09963b6280fa462bb43 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30909973" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bfc25816c5d5de43a62917dde3a44bc200000000020000000000106600000001000020000000b903af2c74ea4303833ed0c2a3f9fbc7a068d79d17f0e94d3993dcd6ba30637c000000000e8000000002000020000000ef331500e9b85d4e9a82f9d3190ad4add3c21450dea5744f3de9a15015e6d21320000000fffd784dd3851cc87005126246a9d2187889ea137e086bf20a9e3d5cbaa06c5540000000023f62ebfc62e3f9ff9c5d0430b29950b0eafed50c46e4a4f2f620084b8a4595e09500c269872940fa6225d0885eddbaaa13925033cf5d41d4728cb142e9e37a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3338325324" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A451B11-1209-11EC-B2DB-E6C57AC66A15} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3338325324" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A4E8C8E-1209-11EC-B2DB-E6C57AC66A15} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bfc25816c5d5de43a62917dde3a44bc200000000020000000000106600000001000020000000b0396adea039a728793888b6ff2d5abdae3031a0ae52332ff0baaa24f66048e0000000000e80000000020000200000006c10487cc0213ccc5c8ccacf8290b75d4f88b5e4d210818d706249c99f9f2e922000000051bee995458f2312f43c086c2681faf4ddba70580facc35faaff1894f1fb37d540000000cd12b8553782a9bc592605a822f896fd4678d3e5da15963775c24c75b271c3c6195f9e794abb19ed140e303fd484636c407260ca6da1f378dd3a05f60188bc38 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bfc25816c5d5de43a62917dde3a44bc200000000020000000000106600000001000020000000d31916c7b1f4d4fab013c682e04aaa2b82b8ba8738bb91c3905c6785d4add426000000000e80000000020000200000006a6118f94fe049707a9108565144c2078d76369c4e59cf01662f3c207dafa1cf20000000573c055752bc12dd8a424ef1a9144ef7dd137e5a11f4d9a03fe327161e3de19540000000ea9d51a2f02fdee82889557707e3f582b17775bf4fc15dba74fe11638716926a617361466a57c49477aa47958aa982be3495166af6ed5d825162b88302722c4c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a226f615a6d701 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30909973" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bfc25816c5d5de43a62917dde3a44bc2000000000200000000001066000000010000200000006eec144ecaf0800eadb40a9c0e6b4224bb646dddd10c8d473ecc523b94aa67b9000000000e800000000200002000000047ebb7f3b898d1e98b5c346b1b232b693c4617cc6e49e1e7149b526118202c48200000007b44f241864724505616939d0e1c7130de8e224b329ded41470fc3bc4ab3dea84000000010f6892db84794d50d2695c0e1e51b533f1990ee5f9ded285902ca0a82f3ade73ece9fbb173a378b2258001d173eca09299c89fcb14316e11d1a26fb410c20c2 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F225FA2F-1208-11EC-B2DB-E6C57AC66A15} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{254E4D61-1209-11EC-B2DB-E6C57AC66A15} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b925ef15a6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2288 iexplore.exe 3636 iexplore.exe 1564 iexplore.exe 3568 iexplore.exe 1404 iexplore.exe 3972 iexplore.exe 1304 iexplore.exe 1716 iexplore.exe -
Suspicious use of SetWindowsHookEx 32 IoCs
pid Process 2288 iexplore.exe 2288 iexplore.exe 4052 IEXPLORE.EXE 4052 IEXPLORE.EXE 3636 iexplore.exe 3636 iexplore.exe 504 IEXPLORE.EXE 504 IEXPLORE.EXE 1564 iexplore.exe 1564 iexplore.exe 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 3568 iexplore.exe 3568 iexplore.exe 3148 IEXPLORE.EXE 3148 IEXPLORE.EXE 1404 iexplore.exe 1404 iexplore.exe 3872 IEXPLORE.EXE 3872 IEXPLORE.EXE 3972 iexplore.exe 3972 iexplore.exe 3284 IEXPLORE.EXE 3284 IEXPLORE.EXE 1304 iexplore.exe 1304 iexplore.exe 1860 IEXPLORE.EXE 1860 IEXPLORE.EXE 1716 iexplore.exe 1716 iexplore.exe 2496 IEXPLORE.EXE 2496 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2288 wrote to memory of 4052 2288 iexplore.exe 82 PID 2288 wrote to memory of 4052 2288 iexplore.exe 82 PID 2288 wrote to memory of 4052 2288 iexplore.exe 82 PID 3636 wrote to memory of 504 3636 iexplore.exe 84 PID 3636 wrote to memory of 504 3636 iexplore.exe 84 PID 3636 wrote to memory of 504 3636 iexplore.exe 84 PID 1564 wrote to memory of 2276 1564 iexplore.exe 86 PID 1564 wrote to memory of 2276 1564 iexplore.exe 86 PID 1564 wrote to memory of 2276 1564 iexplore.exe 86 PID 3568 wrote to memory of 3148 3568 iexplore.exe 88 PID 3568 wrote to memory of 3148 3568 iexplore.exe 88 PID 3568 wrote to memory of 3148 3568 iexplore.exe 88 PID 1404 wrote to memory of 3872 1404 iexplore.exe 90 PID 1404 wrote to memory of 3872 1404 iexplore.exe 90 PID 1404 wrote to memory of 3872 1404 iexplore.exe 90 PID 3972 wrote to memory of 3284 3972 iexplore.exe 92 PID 3972 wrote to memory of 3284 3972 iexplore.exe 92 PID 3972 wrote to memory of 3284 3972 iexplore.exe 92 PID 1304 wrote to memory of 1860 1304 iexplore.exe 94 PID 1304 wrote to memory of 1860 1304 iexplore.exe 94 PID 1304 wrote to memory of 1860 1304 iexplore.exe 94 PID 1716 wrote to memory of 2496 1716 iexplore.exe 96 PID 1716 wrote to memory of 2496 1716 iexplore.exe 96 PID 1716 wrote to memory of 2496 1716 iexplore.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\31f5ee68e7548cd1d49720492502877466b35241cd441b48eefbddffc74a5475.exe"C:\Users\Admin\AppData\Local\Temp\31f5ee68e7548cd1d49720492502877466b35241cd441b48eefbddffc74a5475.exe"1⤵PID:664
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4052
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3636 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:504
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1564 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2276
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3568 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:3148
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1404 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:3872
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3972 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:3284
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1304 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1860
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:2496
-