Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en -
submitted
10-09-2021 05:27
Static task
static1
General
-
Target
e7ca9a9dba1a2139657c10c02aa20472e0153edb32d81f67565b2d14448a6e52.exe
-
Size
880KB
-
MD5
3b0e21f94503d720bfe21b558b55ac5f
-
SHA1
561ef7a78405191dd551a0e811d7a80d2f7580f1
-
SHA256
e7ca9a9dba1a2139657c10c02aa20472e0153edb32d81f67565b2d14448a6e52
-
SHA512
6476a0be547a0a0d84d32cc972038e094f70019a9d5f496d1fbeb3e699d83a4efe378577bfa4c5d0b5a3ea15db7d17cf4d16491eed771d0921b2e42f7f1202a2
Malware Config
Extracted
Family
gozi_rm3
Attributes
-
build
300981
Extracted
Family
gozi_rm3
Botnet
202108021
C2
https://haverit.xyz
Attributes
-
build
300981
-
exe_type
loader
-
non_target_locale
RU
-
server_id
12
-
url_path
index.htm
rsa_pubkey.plain
aes.plain
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d46100000000020000000000106600000001000020000000983bb9c9b0b39960c27a8794c2f6b98f58fd6984142f6f9c85498fd0b5137f85000000000e8000000002000020000000f19cbcab099b944aba53776b5cd9ea05c675bffd5060b48d8d8ca135f558c44620000000e3fe759ef54ee21f9e5e3b8ea703dffa5025bf01ee769e2a20595e934b669c3f400000003659affaa8751bd33074714e597c862c48f0a3e078c4a05f452b951aada5d4deae1f1c6cccd4a53b1a635696de84dec3a0d3014de175f50ab140d2ba9f3d4c0f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C16EFE7-11F7-11EC-A248-D2E3FA6D7576} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d46100000000020000000000106600000001000020000000997bd7aaa86c58742e8b42b8ec5a40f40e087ede1a9e9d6afea9c4e914341c56000000000e8000000002000020000000d4b22c3460d958f11f852a2a11c57e976657f43e42aae319d8e6e60da751d77e200000002a3957aa4e93b03568acdeb233ad8efb5c0ff8a403bacf0fa2b0d2204da6f045400000001b5e88669d5e8ba54f326517223b8743c0dd007754370353eda6b233de402590769171ccbb3557e2cc64582602de0844a944dc367c13806c498b58313d1dca94 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "763099187" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d08a905e04a6d701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d461000000000200000000001066000000010000200000000532715e54ad08c7c2b60d5e885373f13a08d4d7db7a70dc89fbc08fce75042a000000000e80000000020000200000006de62bfd41d34d5d6c9b41c601989ea22630f4b81ea28ce0037b99562364a2da20000000386564d6a1ea976c823c438367aca72b737a0e025dcfd9ed12dfb13ccd5697f440000000245dc71c5960186b1234e4a568e410a2737815a7aaee4300465a5cdf31838e62b4e01b822a7ae888ea159895a0496e05f0c5b4dc78e331f2bcacb613f5b59810 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 209cae5704a6d701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0aee82e04a6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "763099187" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d46100000000020000000000106600000001000020000000f598ef81af4f6e3196c717c43a588c0fd9457ab75e64b548841caf00541dc80c000000000e8000000002000020000000318f4a85e4a0d0564fcaf5bfb813e07c7f5aad834b8e9b4fa94addc73d126e3520000000f9a08892e8294f9d8e8cf24cb8ffdc1a2029ca7dd6d94f54031ab0726ae30b4140000000b3ddfe8e10052a23c1d6c0706971ee73d72524908ce3fdd65b28ecdd0a26114882a8f0d23f4f846c0ef68c7726e505cff5ca7277056a07c796dbf6078beeaa80 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58FA9594-11F7-11EC-A248-D2E3FA6D7576} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d46100000000020000000000106600000001000020000000810155ae5f3c11b0681eb4167f76d32fb49f9479437cdfce553b2580d76cbc4b000000000e8000000002000020000000eddb5209b5a2e29e8af236870380fcf7818a9d5239b3e518880cf26aaf839269200000005e5e104d3e09cbc496a9ca5e00f9ebb79a4ec28e3d880239dc218394d284361740000000554e98182fa1f3284d0e449934b44c9a77a53dfbaf6100302f2bae25f5cb40de52d934feb4c99b9ba410cde54e560b5843c70df789a1d15877b240ec173c1b6e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 4008 iexplore.exe 2764 iexplore.exe 2328 iexplore.exe 1688 iexplore.exe 1896 iexplore.exe 1824 iexplore.exe 1152 iexplore.exe 3892 iexplore.exe -
Suspicious use of SetWindowsHookEx 32 IoCs
pid Process 4008 iexplore.exe 4008 iexplore.exe 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 2764 iexplore.exe 2764 iexplore.exe 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE 2328 iexplore.exe 2328 iexplore.exe 1472 IEXPLORE.EXE 1472 IEXPLORE.EXE 1688 iexplore.exe 1688 iexplore.exe 3136 IEXPLORE.EXE 3136 IEXPLORE.EXE 1896 iexplore.exe 1896 iexplore.exe 1040 IEXPLORE.EXE 1040 IEXPLORE.EXE 1824 iexplore.exe 1824 iexplore.exe 2064 IEXPLORE.EXE 2064 IEXPLORE.EXE 1152 iexplore.exe 1152 iexplore.exe 3476 IEXPLORE.EXE 3476 IEXPLORE.EXE 3892 iexplore.exe 3892 iexplore.exe 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4008 wrote to memory of 3216 4008 iexplore.exe 82 PID 4008 wrote to memory of 3216 4008 iexplore.exe 82 PID 4008 wrote to memory of 3216 4008 iexplore.exe 82 PID 2764 wrote to memory of 1816 2764 iexplore.exe 84 PID 2764 wrote to memory of 1816 2764 iexplore.exe 84 PID 2764 wrote to memory of 1816 2764 iexplore.exe 84 PID 2328 wrote to memory of 1472 2328 iexplore.exe 86 PID 2328 wrote to memory of 1472 2328 iexplore.exe 86 PID 2328 wrote to memory of 1472 2328 iexplore.exe 86 PID 1688 wrote to memory of 3136 1688 iexplore.exe 88 PID 1688 wrote to memory of 3136 1688 iexplore.exe 88 PID 1688 wrote to memory of 3136 1688 iexplore.exe 88 PID 1896 wrote to memory of 1040 1896 iexplore.exe 90 PID 1896 wrote to memory of 1040 1896 iexplore.exe 90 PID 1896 wrote to memory of 1040 1896 iexplore.exe 90 PID 1824 wrote to memory of 2064 1824 iexplore.exe 92 PID 1824 wrote to memory of 2064 1824 iexplore.exe 92 PID 1824 wrote to memory of 2064 1824 iexplore.exe 92 PID 1152 wrote to memory of 3476 1152 iexplore.exe 94 PID 1152 wrote to memory of 3476 1152 iexplore.exe 94 PID 1152 wrote to memory of 3476 1152 iexplore.exe 94 PID 3892 wrote to memory of 3216 3892 iexplore.exe 96 PID 3892 wrote to memory of 3216 3892 iexplore.exe 96 PID 3892 wrote to memory of 3216 3892 iexplore.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7ca9a9dba1a2139657c10c02aa20472e0153edb32d81f67565b2d14448a6e52.exe"C:\Users\Admin\AppData\Local\Temp\e7ca9a9dba1a2139657c10c02aa20472e0153edb32d81f67565b2d14448a6e52.exe"1⤵PID:3332
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4008 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:3216
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1816
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1472
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3136
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1896 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1040
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1824 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2064
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3476
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3892 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3216
-