Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
10-09-2021 06:52
Static task
static1
General
-
Target
3554222282dc9a11db983e995ee70f9b02eb30e732250c523f59dd8e6a040853.exe
-
Size
880KB
-
MD5
b57465cf50ff59e21b04a5dfc1c81601
-
SHA1
7e82bf20fb93acbe053921345e1127a30b53d5e4
-
SHA256
3554222282dc9a11db983e995ee70f9b02eb30e732250c523f59dd8e6a040853
-
SHA512
0bbc7a867524612bdd21f9b3c9a4192009864289f8c9b41271fb04f9bcf28bc014614142e66b17af301f44c692bc59a82e74392f705c387e0c75199ac4573ad4
Malware Config
Extracted
Family
gozi_rm3
Attributes
-
build
300981
Extracted
Family
gozi_rm3
Botnet
202108021
C2
https://haverit.xyz
Attributes
-
build
300981
-
exe_type
loader
-
non_target_locale
RU
-
server_id
12
-
url_path
index.htm
rsa_pubkey.plain
aes.plain
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904245c921a6d701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006c0b537a2bfed0479a59ffaa6613883300000000020000000000106600000001000020000000539d4db27d33cc9a3837894dabe6ff61e1bb481e49506f9b3612c1aeee56d1c8000000000e800000000200002000000067171a4cf0541bf02581d32ff24525ab1814d4d818d421612fa0f595c973144620000000fc7d0f9fedc23dbf59d6098981d3a37713e670bf995f7ad2b3a9055d5337c1dd40000000b16868ca5231d0f1fe0423c30ef42b6e561ccaea64cd96535b5debfb6ca625d81588ff78949cf879cffd82105bf077897d6ab8b46d40b50c304da627147fec7c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006c0b537a2bfed0479a59ffaa6613883300000000020000000000106600000001000020000000242d8835ee17b2353fcf22fe1917e9b32f7550435359ac2170d4e99bff83100a000000000e8000000002000020000000cebfa44a8e75e35ec7abd3b127abc07c2b5a6b8627562f08932b1fc14375f246200000005571edf33d2a3c87b8602d0e1cc4d07ada7ce6422782fa033f425834d65805ad400000001cbeb7030bf9d23853644b582954e20cc98b7a63b4c6d913c1173133d5d86f3543457b3c0ad56f90cde581c29c218a029bbc0b074c02bffb2cf445c74ef6ae70 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 008043eb21a6d701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F66B8B9-1215-11EC-B2DB-4E3A6605C0D3} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006c0b537a2bfed0479a59ffaa661388330000000002000000000010660000000100002000000095d1eb7393cda92d308b0ca15e8c7f4a6519d5d4d56bd61ab001a1e32a5b874d000000000e80000000020000200000007ce26b798a10cb8cc5ec6c4fc5b9558dbce71fa8f0456ed3489e130dc307790720000000c934e68ba17aafd08300f5ffd28b11881d6526ca470209ad70f71377e24a061b4000000024773c91f25ca709bdb20b78e4056264bbe434d686eb51dbc7ac2d889cb106fe9d4bd93954decdb093684a02b447f11634f11e7e6986605a27e6f717dbd9dffc iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A5A7638-1215-11EC-B2DB-4E3A6605C0D3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF61DEBD-1214-11EC-B2DB-4E3A6605C0D3} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30909985" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC3BF906-1214-11EC-B2DB-4E3A6605C0D3} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 703c3df221a6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006c0b537a2bfed0479a59ffaa66138833000000000200000000001066000000010000200000009199199380fcf6574daa814556e68ceeb99608bffbb632e36c01fda01e17cb52000000000e8000000002000020000000999bef65df3da256e2156551d268818837c7c926fcbc0a45e172f4cf7dc69bec20000000da157ae852a79233b1c5d5f29bfb52f9e79600e624efebb503fec137608eb2a840000000994c99cac4f743efd130e60c89a821d64375291ded359100b372c64af7d2f8b6edf73566232f6e6a9427c9379e2826c3aa5ce5ee0d669d58f3ac7bc933208c98 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09742e421a6d701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006c0b537a2bfed0479a59ffaa6613883300000000020000000000106600000001000020000000f7e4e7ef850d28c1a4f7bf22beebe926eefc1ff4532f71ad7693798c7758b44a000000000e800000000200002000000019129fc32168e01285d272a20617c9f13d95d5478898b59eaaad44282c3772952000000085fe9211f9c926e90e0e4b1a897ec1cf7b8b7da6980b93f7a062b1f0da95075940000000275a2be419627cbafa2efe5eb785e38fba8ce66d8e19b814c5b2279300669009b3c8b3e3cb6ce08f0346adf8de67eb2bc70b66ef403864d534999d45b537e162 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f02a46d021a6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06593B3E-1215-11EC-B2DB-4E3A6605C0D3} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2158FD70-1215-11EC-B2DB-4E3A6605C0D3} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 1788 iexplore.exe 200 iexplore.exe 1604 iexplore.exe 3196 iexplore.exe 2244 iexplore.exe 1828 iexplore.exe 1768 iexplore.exe 2848 iexplore.exe -
Suspicious use of SetWindowsHookEx 32 IoCs
pid Process 1788 iexplore.exe 1788 iexplore.exe 3172 IEXPLORE.EXE 3172 IEXPLORE.EXE 200 iexplore.exe 200 iexplore.exe 584 IEXPLORE.EXE 584 IEXPLORE.EXE 1604 iexplore.exe 1604 iexplore.exe 3752 IEXPLORE.EXE 3752 IEXPLORE.EXE 3196 iexplore.exe 3196 iexplore.exe 512 IEXPLORE.EXE 512 IEXPLORE.EXE 2244 iexplore.exe 2244 iexplore.exe 2192 IEXPLORE.EXE 2192 IEXPLORE.EXE 1828 iexplore.exe 1828 iexplore.exe 2660 IEXPLORE.EXE 2660 IEXPLORE.EXE 1768 iexplore.exe 1768 iexplore.exe 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2848 iexplore.exe 2848 iexplore.exe 736 IEXPLORE.EXE 736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1788 wrote to memory of 3172 1788 iexplore.exe 82 PID 1788 wrote to memory of 3172 1788 iexplore.exe 82 PID 1788 wrote to memory of 3172 1788 iexplore.exe 82 PID 200 wrote to memory of 584 200 iexplore.exe 84 PID 200 wrote to memory of 584 200 iexplore.exe 84 PID 200 wrote to memory of 584 200 iexplore.exe 84 PID 1604 wrote to memory of 3752 1604 iexplore.exe 86 PID 1604 wrote to memory of 3752 1604 iexplore.exe 86 PID 1604 wrote to memory of 3752 1604 iexplore.exe 86 PID 3196 wrote to memory of 512 3196 iexplore.exe 88 PID 3196 wrote to memory of 512 3196 iexplore.exe 88 PID 3196 wrote to memory of 512 3196 iexplore.exe 88 PID 2244 wrote to memory of 2192 2244 iexplore.exe 90 PID 2244 wrote to memory of 2192 2244 iexplore.exe 90 PID 2244 wrote to memory of 2192 2244 iexplore.exe 90 PID 1828 wrote to memory of 2660 1828 iexplore.exe 92 PID 1828 wrote to memory of 2660 1828 iexplore.exe 92 PID 1828 wrote to memory of 2660 1828 iexplore.exe 92 PID 1768 wrote to memory of 2148 1768 iexplore.exe 94 PID 1768 wrote to memory of 2148 1768 iexplore.exe 94 PID 1768 wrote to memory of 2148 1768 iexplore.exe 94 PID 2848 wrote to memory of 736 2848 iexplore.exe 96 PID 2848 wrote to memory of 736 2848 iexplore.exe 96 PID 2848 wrote to memory of 736 2848 iexplore.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\3554222282dc9a11db983e995ee70f9b02eb30e732250c523f59dd8e6a040853.exe"C:\Users\Admin\AppData\Local\Temp\3554222282dc9a11db983e995ee70f9b02eb30e732250c523f59dd8e6a040853.exe"1⤵PID:808
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1788 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:3172
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:200 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:584
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1604 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:3752
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3196 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:512
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2192
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1828 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2660
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:2148
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:736
-