Analysis
-
max time kernel
297s -
max time network
324s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
12-09-2021 05:03
Static task
static1
General
-
Target
PiSUfsy.exe
-
Size
880KB
-
MD5
ddb8cc4e8e2ec81904a1407409d2e868
-
SHA1
5f594f30bcf6b00213916e5aa987db98d764fbb2
-
SHA256
e0f81b847c0c02e0352607f852bdfb651925c35655ebf0be9b4fd2ef034661f3
-
SHA512
70e1ff1b5aa7a5ff7408f4520adece23fbb9df4f3ac9d5aded9baad30fe485c47a2f8cce6b2d500ab6705a18ce20f90c193092c4f943053c67c1cff8b51a5738
Malware Config
Extracted
Family
gozi_rm3
Attributes
-
build
300981
Extracted
Family
gozi_rm3
Botnet
202108021
C2
https://haverit.xyz
Attributes
-
build
300981
-
exe_type
loader
-
non_target_locale
RU
-
server_id
12
-
url_path
index.htm
rsa_pubkey.plain
aes.plain
Signatures
-
win_isfb_auto 3 IoCs
Detects win.isfb.
resource yara_rule behavioral1/memory/2000-61-0x0000000001000000-0x00000000010F4000-memory.dmp win_isfb_auto behavioral1/memory/2000-62-0x0000000000220000-0x0000000000221000-memory.dmp win_isfb_auto behavioral1/memory/2000-64-0x0000000000230000-0x0000000000240000-memory.dmp win_isfb_auto -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B653741-1398-11EC-97F9-FAA569F8A986} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C5C4001-1398-11EC-97F9-FAA569F8A986} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91AF0F41-1398-11EC-97F9-FAA569F8A986} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bcc40eeded585c40aa055df6ad61b349000000000200000000001066000000010000200000006c9d91962fb62c4106c39c04b0d1ec90ac164fbd11b07e9a5e148b17ff46f5ce000000000e80000000020000200000007b3dcbd9807a877c7ef2cdb64a66adf24a5f16aef0ea617d39ddffc11213e4ee900000002b52da30bf177469a602753f1bef9b174ab0579ac49d1b1a3d539e067401fe009d88d8f04bfad2913d7de0037f2e2d6a614079807798490230dc2719768765672bfcd15fdcf143de936c816d456907e71590a1cc3ee5d7369a98cd707c55d538fa898cc1936be4f840c816371e2454a79422b862871691631e93f7cf81eb007eafc47a8581211f7ac1780cc524c4a6974000000031c2f146aeaca356ee3df1172d983ca2e339ce6e9b8a0a067f8cf456c78295487e7686f63bb9cde118eb8353e23ece66fb21ef96348c3eb82473c37641866a19 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C0CC6661-1398-11EC-97F9-FAA569F8A986} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 13 IoCs
pid Process 368 iexplore.exe 1384 iexplore.exe 868 iexplore.exe 568 iexplore.exe 1664 iexplore.exe 932 iexplore.exe 748 iexplore.exe 2020 iexplore.exe 1384 iexplore.exe 1708 iexplore.exe 1628 iexplore.exe 964 iexplore.exe 1996 iexplore.exe -
Suspicious use of SetWindowsHookEx 52 IoCs
pid Process 368 iexplore.exe 368 iexplore.exe 1076 IEXPLORE.EXE 1076 IEXPLORE.EXE 1384 iexplore.exe 1384 iexplore.exe 936 IEXPLORE.EXE 936 IEXPLORE.EXE 868 iexplore.exe 868 iexplore.exe 1764 IEXPLORE.EXE 1764 IEXPLORE.EXE 568 iexplore.exe 568 iexplore.exe 1412 IEXPLORE.EXE 1412 IEXPLORE.EXE 1664 iexplore.exe 1664 iexplore.exe 1768 IEXPLORE.EXE 1768 IEXPLORE.EXE 932 iexplore.exe 932 iexplore.exe 324 IEXPLORE.EXE 324 IEXPLORE.EXE 748 iexplore.exe 748 iexplore.exe 864 IEXPLORE.EXE 864 IEXPLORE.EXE 2020 iexplore.exe 2020 iexplore.exe 1476 IEXPLORE.EXE 1476 IEXPLORE.EXE 1384 iexplore.exe 1384 iexplore.exe 588 IEXPLORE.EXE 588 IEXPLORE.EXE 1708 iexplore.exe 1708 iexplore.exe 1376 IEXPLORE.EXE 1376 IEXPLORE.EXE 1628 iexplore.exe 1628 iexplore.exe 1016 IEXPLORE.EXE 1016 IEXPLORE.EXE 964 iexplore.exe 964 iexplore.exe 2040 IEXPLORE.EXE 2040 IEXPLORE.EXE 1996 iexplore.exe 1996 iexplore.exe 1876 IEXPLORE.EXE 1876 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 368 wrote to memory of 1076 368 iexplore.exe 34 PID 368 wrote to memory of 1076 368 iexplore.exe 34 PID 368 wrote to memory of 1076 368 iexplore.exe 34 PID 368 wrote to memory of 1076 368 iexplore.exe 34 PID 1384 wrote to memory of 936 1384 iexplore.exe 37 PID 1384 wrote to memory of 936 1384 iexplore.exe 37 PID 1384 wrote to memory of 936 1384 iexplore.exe 37 PID 1384 wrote to memory of 936 1384 iexplore.exe 37 PID 868 wrote to memory of 1764 868 iexplore.exe 40 PID 868 wrote to memory of 1764 868 iexplore.exe 40 PID 868 wrote to memory of 1764 868 iexplore.exe 40 PID 868 wrote to memory of 1764 868 iexplore.exe 40 PID 568 wrote to memory of 1412 568 iexplore.exe 43 PID 568 wrote to memory of 1412 568 iexplore.exe 43 PID 568 wrote to memory of 1412 568 iexplore.exe 43 PID 568 wrote to memory of 1412 568 iexplore.exe 43 PID 1664 wrote to memory of 1768 1664 iexplore.exe 46 PID 1664 wrote to memory of 1768 1664 iexplore.exe 46 PID 1664 wrote to memory of 1768 1664 iexplore.exe 46 PID 1664 wrote to memory of 1768 1664 iexplore.exe 46 PID 932 wrote to memory of 324 932 iexplore.exe 49 PID 932 wrote to memory of 324 932 iexplore.exe 49 PID 932 wrote to memory of 324 932 iexplore.exe 49 PID 932 wrote to memory of 324 932 iexplore.exe 49 PID 748 wrote to memory of 864 748 iexplore.exe 52 PID 748 wrote to memory of 864 748 iexplore.exe 52 PID 748 wrote to memory of 864 748 iexplore.exe 52 PID 748 wrote to memory of 864 748 iexplore.exe 52 PID 2020 wrote to memory of 1476 2020 iexplore.exe 55 PID 2020 wrote to memory of 1476 2020 iexplore.exe 55 PID 2020 wrote to memory of 1476 2020 iexplore.exe 55 PID 2020 wrote to memory of 1476 2020 iexplore.exe 55 PID 1384 wrote to memory of 588 1384 iexplore.exe 58 PID 1384 wrote to memory of 588 1384 iexplore.exe 58 PID 1384 wrote to memory of 588 1384 iexplore.exe 58 PID 1384 wrote to memory of 588 1384 iexplore.exe 58 PID 1708 wrote to memory of 1376 1708 iexplore.exe 61 PID 1708 wrote to memory of 1376 1708 iexplore.exe 61 PID 1708 wrote to memory of 1376 1708 iexplore.exe 61 PID 1708 wrote to memory of 1376 1708 iexplore.exe 61 PID 1628 wrote to memory of 1016 1628 iexplore.exe 64 PID 1628 wrote to memory of 1016 1628 iexplore.exe 64 PID 1628 wrote to memory of 1016 1628 iexplore.exe 64 PID 1628 wrote to memory of 1016 1628 iexplore.exe 64 PID 964 wrote to memory of 2040 964 iexplore.exe 67 PID 964 wrote to memory of 2040 964 iexplore.exe 67 PID 964 wrote to memory of 2040 964 iexplore.exe 67 PID 964 wrote to memory of 2040 964 iexplore.exe 67 PID 1996 wrote to memory of 1876 1996 iexplore.exe 70 PID 1996 wrote to memory of 1876 1996 iexplore.exe 70 PID 1996 wrote to memory of 1876 1996 iexplore.exe 70 PID 1996 wrote to memory of 1876 1996 iexplore.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\PiSUfsy.exe"C:\Users\Admin\AppData\Local\Temp\PiSUfsy.exe"1⤵PID:2000
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:368 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1076
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1384 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:936
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:868 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1764
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:568 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1412
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1768
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:932 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:324
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:748 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:864
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1476
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1384 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:588
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1376
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1016
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:964 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:2040
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1876
-