Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
13-12-2021 23:51
Static task
static1
Behavioral task
behavioral1
Sample
RT.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
RT.msi
-
Size
2.2MB
-
MD5
55b75999aeba3ccfd5309b39d7880baa
-
SHA1
293a2c7cd6ab5851563d868d549e9a2dfd00842c
-
SHA256
e07e5f0295deb4c8a77519cf41d915046d6962db92b7e667f68267d30e0b8399
-
SHA512
59a8bad2040260f13ec4171e5ce6f28b04b1d6705aed4d7c9a9270c472062095bd4ec8cdc38fe962a55b8f8bc0b8f5afc4565d99f3dffee87dc12b107f9fd76f
Malware Config
Signatures
-
Detect Numando Payload 3 IoCs
resource yara_rule behavioral1/files/0x000600000001321e-79.dat family_numando behavioral1/files/0x000600000001321e-80.dat family_numando behavioral1/memory/1740-81-0x00000000005B0000-0x0000000000EBF000-memory.dmp family_numando -
Blocklisted process makes network request 7 IoCs
flow pid Process 5 1480 MsiExec.exe 7 1480 MsiExec.exe 9 1480 MsiExec.exe 11 1480 MsiExec.exe 13 1480 MsiExec.exe 15 1480 MsiExec.exe 17 1480 MsiExec.exe -
Executes dropped EXE 2 IoCs
pid Process 776 MSICEDE.tmp 1740 Object.exe -
Loads dropped DLL 11 IoCs
pid Process 1480 MsiExec.exe 1480 MsiExec.exe 1480 MsiExec.exe 1480 MsiExec.exe 1480 MsiExec.exe 1480 MsiExec.exe 1480 MsiExec.exe 1480 MsiExec.exe 1740 Object.exe 1740 Object.exe 1740 Object.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Object.exe = "C:\\Users\\Admin\\AppData\\Roaming\\WEFHWE0-FWEUY-F9WUEFWWEF\\BND0WEPWEJFC-9UEWFF\\Object.exe" Object.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSICEDE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB37B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB3AB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAD52.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB409.tmp msiexec.exe File created C:\Windows\Installer\f75a88f.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIABBC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAB6D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB488.tmp msiexec.exe File created C:\Windows\Installer\f75a891.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSICDF2.tmp msiexec.exe File opened for modification C:\Windows\Installer\f75a891.ipi msiexec.exe File opened for modification C:\Windows\Installer\f75a88f.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA91B.tmp msiexec.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "48" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "845" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "48" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "9" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "76" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "845" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "91" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "29" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "845" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4A27C01-5C6F-11EC-A1D5-56E7B8E0DA42} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "29" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "76" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "76" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "91" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "91" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "29" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "48" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "9" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "0" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 520 msiexec.exe 520 msiexec.exe 1740 Object.exe 1740 Object.exe 1740 Object.exe 1740 Object.exe -
Suspicious use of AdjustPrivilegeToken 62 IoCs
description pid Process Token: SeShutdownPrivilege 1400 msiexec.exe Token: SeIncreaseQuotaPrivilege 1400 msiexec.exe Token: SeRestorePrivilege 520 msiexec.exe Token: SeTakeOwnershipPrivilege 520 msiexec.exe Token: SeSecurityPrivilege 520 msiexec.exe Token: SeCreateTokenPrivilege 1400 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1400 msiexec.exe Token: SeLockMemoryPrivilege 1400 msiexec.exe Token: SeIncreaseQuotaPrivilege 1400 msiexec.exe Token: SeMachineAccountPrivilege 1400 msiexec.exe Token: SeTcbPrivilege 1400 msiexec.exe Token: SeSecurityPrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe Token: SeLoadDriverPrivilege 1400 msiexec.exe Token: SeSystemProfilePrivilege 1400 msiexec.exe Token: SeSystemtimePrivilege 1400 msiexec.exe Token: SeProfSingleProcessPrivilege 1400 msiexec.exe Token: SeIncBasePriorityPrivilege 1400 msiexec.exe Token: SeCreatePagefilePrivilege 1400 msiexec.exe Token: SeCreatePermanentPrivilege 1400 msiexec.exe Token: SeBackupPrivilege 1400 msiexec.exe Token: SeRestorePrivilege 1400 msiexec.exe Token: SeShutdownPrivilege 1400 msiexec.exe Token: SeDebugPrivilege 1400 msiexec.exe Token: SeAuditPrivilege 1400 msiexec.exe Token: SeSystemEnvironmentPrivilege 1400 msiexec.exe Token: SeChangeNotifyPrivilege 1400 msiexec.exe Token: SeRemoteShutdownPrivilege 1400 msiexec.exe Token: SeUndockPrivilege 1400 msiexec.exe Token: SeSyncAgentPrivilege 1400 msiexec.exe Token: SeEnableDelegationPrivilege 1400 msiexec.exe Token: SeManageVolumePrivilege 1400 msiexec.exe Token: SeImpersonatePrivilege 1400 msiexec.exe Token: SeCreateGlobalPrivilege 1400 msiexec.exe Token: SeRestorePrivilege 520 msiexec.exe Token: SeTakeOwnershipPrivilege 520 msiexec.exe Token: SeRestorePrivilege 520 msiexec.exe Token: SeTakeOwnershipPrivilege 520 msiexec.exe Token: SeRestorePrivilege 520 msiexec.exe Token: SeTakeOwnershipPrivilege 520 msiexec.exe Token: SeRestorePrivilege 520 msiexec.exe Token: SeTakeOwnershipPrivilege 520 msiexec.exe Token: SeRestorePrivilege 520 msiexec.exe Token: SeTakeOwnershipPrivilege 520 msiexec.exe Token: SeRestorePrivilege 520 msiexec.exe Token: SeTakeOwnershipPrivilege 520 msiexec.exe Token: SeRestorePrivilege 520 msiexec.exe Token: SeTakeOwnershipPrivilege 520 msiexec.exe Token: SeRestorePrivilege 520 msiexec.exe Token: SeTakeOwnershipPrivilege 520 msiexec.exe Token: SeRestorePrivilege 520 msiexec.exe Token: SeTakeOwnershipPrivilege 520 msiexec.exe Token: SeRestorePrivilege 520 msiexec.exe Token: SeTakeOwnershipPrivilege 520 msiexec.exe Token: SeRestorePrivilege 520 msiexec.exe Token: SeTakeOwnershipPrivilege 520 msiexec.exe Token: SeRestorePrivilege 520 msiexec.exe Token: SeTakeOwnershipPrivilege 520 msiexec.exe Token: SeRestorePrivilege 520 msiexec.exe Token: SeTakeOwnershipPrivilege 520 msiexec.exe Token: SeRestorePrivilege 520 msiexec.exe Token: SeTakeOwnershipPrivilege 520 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1400 msiexec.exe 1400 msiexec.exe 1012 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1012 iexplore.exe 1012 iexplore.exe 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 520 wrote to memory of 1480 520 msiexec.exe 28 PID 520 wrote to memory of 1480 520 msiexec.exe 28 PID 520 wrote to memory of 1480 520 msiexec.exe 28 PID 520 wrote to memory of 1480 520 msiexec.exe 28 PID 520 wrote to memory of 1480 520 msiexec.exe 28 PID 520 wrote to memory of 1480 520 msiexec.exe 28 PID 520 wrote to memory of 1480 520 msiexec.exe 28 PID 520 wrote to memory of 776 520 msiexec.exe 32 PID 520 wrote to memory of 776 520 msiexec.exe 32 PID 520 wrote to memory of 776 520 msiexec.exe 32 PID 520 wrote to memory of 776 520 msiexec.exe 32 PID 520 wrote to memory of 776 520 msiexec.exe 32 PID 520 wrote to memory of 776 520 msiexec.exe 32 PID 520 wrote to memory of 776 520 msiexec.exe 32 PID 1740 wrote to memory of 1012 1740 Object.exe 34 PID 1740 wrote to memory of 1012 1740 Object.exe 34 PID 1740 wrote to memory of 1012 1740 Object.exe 34 PID 1740 wrote to memory of 1012 1740 Object.exe 34 PID 1012 wrote to memory of 1676 1012 iexplore.exe 35 PID 1012 wrote to memory of 1676 1012 iexplore.exe 35 PID 1012 wrote to memory of 1676 1012 iexplore.exe 35 PID 1012 wrote to memory of 1676 1012 iexplore.exe 35
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\RT.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1400
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7DDEC1C2030F712422DC95A7911885312⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1480
-
-
C:\Windows\Installer\MSICEDE.tmp"C:\Windows\Installer\MSICEDE.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\WEFHWE0-FWEUY-F9WUEFWWEF\BND0WEPWEJFC-9UEWFF\Object.exe"2⤵
- Executes dropped EXE
PID:776
-
-
C:\Users\Admin\AppData\Roaming\WEFHWE0-FWEUY-F9WUEFWWEF\BND0WEPWEJFC-9UEWFF\Object.exe"C:\Users\Admin\AppData\Roaming\WEFHWE0-FWEUY-F9WUEFWWEF\BND0WEPWEJFC-9UEWFF\Object.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" %1 "https://bit.ly/3DvoVCc"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1012 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1676
-
-