Analysis
-
max time kernel
123s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
13-12-2021 23:56
Static task
static1
Behavioral task
behavioral1
Sample
RT.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
RT.msi
-
Size
2.2MB
-
MD5
55b75999aeba3ccfd5309b39d7880baa
-
SHA1
293a2c7cd6ab5851563d868d549e9a2dfd00842c
-
SHA256
e07e5f0295deb4c8a77519cf41d915046d6962db92b7e667f68267d30e0b8399
-
SHA512
59a8bad2040260f13ec4171e5ce6f28b04b1d6705aed4d7c9a9270c472062095bd4ec8cdc38fe962a55b8f8bc0b8f5afc4565d99f3dffee87dc12b107f9fd76f
Malware Config
Signatures
-
Detect Numando Payload 3 IoCs
resource yara_rule behavioral1/files/0x00060000000131fe-79.dat family_numando behavioral1/files/0x00060000000131fe-80.dat family_numando behavioral1/memory/912-81-0x00000000005B0000-0x0000000000EBF000-memory.dmp family_numando -
Blocklisted process makes network request 7 IoCs
flow pid Process 5 1528 MsiExec.exe 7 1528 MsiExec.exe 9 1528 MsiExec.exe 11 1528 MsiExec.exe 13 1528 MsiExec.exe 15 1528 MsiExec.exe 17 1528 MsiExec.exe -
Executes dropped EXE 2 IoCs
pid Process 1632 MSI1FEB.tmp 912 Object.exe -
Loads dropped DLL 11 IoCs
pid Process 1528 MsiExec.exe 1528 MsiExec.exe 1528 MsiExec.exe 1528 MsiExec.exe 1528 MsiExec.exe 1528 MsiExec.exe 1528 MsiExec.exe 1528 MsiExec.exe 912 Object.exe 912 Object.exe 912 Object.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Object.exe = "C:\\Users\\Admin\\AppData\\Roaming\\WEFHWE0-FWEUY-F9WUEFWWEF\\BND0WEPWEJFC-9UEWFF\\Object.exe" Object.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI15D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1EDF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1FEB.tmp msiexec.exe File created C:\Windows\Installer\f75f04a.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF884.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2F6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF103.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF7B8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFBFE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI20A.tmp msiexec.exe File opened for modification C:\Windows\Installer\f75f04a.ipi msiexec.exe File created C:\Windows\Installer\f75f048.msi msiexec.exe File opened for modification C:\Windows\Installer\f75f048.msi msiexec.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "47" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "848" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "90" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "28" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "848" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "47" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "75" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "848" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "9" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "28" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "90" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "28" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "75" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AEC2DDC1-5C78-11EC-8489-4AB3DBA4690F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "9" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "90" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "75" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "47" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 572 msiexec.exe 572 msiexec.exe 912 Object.exe 912 Object.exe 912 Object.exe 912 Object.exe -
Suspicious use of AdjustPrivilegeToken 62 IoCs
description pid Process Token: SeShutdownPrivilege 1924 msiexec.exe Token: SeIncreaseQuotaPrivilege 1924 msiexec.exe Token: SeRestorePrivilege 572 msiexec.exe Token: SeTakeOwnershipPrivilege 572 msiexec.exe Token: SeSecurityPrivilege 572 msiexec.exe Token: SeCreateTokenPrivilege 1924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1924 msiexec.exe Token: SeLockMemoryPrivilege 1924 msiexec.exe Token: SeIncreaseQuotaPrivilege 1924 msiexec.exe Token: SeMachineAccountPrivilege 1924 msiexec.exe Token: SeTcbPrivilege 1924 msiexec.exe Token: SeSecurityPrivilege 1924 msiexec.exe Token: SeTakeOwnershipPrivilege 1924 msiexec.exe Token: SeLoadDriverPrivilege 1924 msiexec.exe Token: SeSystemProfilePrivilege 1924 msiexec.exe Token: SeSystemtimePrivilege 1924 msiexec.exe Token: SeProfSingleProcessPrivilege 1924 msiexec.exe Token: SeIncBasePriorityPrivilege 1924 msiexec.exe Token: SeCreatePagefilePrivilege 1924 msiexec.exe Token: SeCreatePermanentPrivilege 1924 msiexec.exe Token: SeBackupPrivilege 1924 msiexec.exe Token: SeRestorePrivilege 1924 msiexec.exe Token: SeShutdownPrivilege 1924 msiexec.exe Token: SeDebugPrivilege 1924 msiexec.exe Token: SeAuditPrivilege 1924 msiexec.exe Token: SeSystemEnvironmentPrivilege 1924 msiexec.exe Token: SeChangeNotifyPrivilege 1924 msiexec.exe Token: SeRemoteShutdownPrivilege 1924 msiexec.exe Token: SeUndockPrivilege 1924 msiexec.exe Token: SeSyncAgentPrivilege 1924 msiexec.exe Token: SeEnableDelegationPrivilege 1924 msiexec.exe Token: SeManageVolumePrivilege 1924 msiexec.exe Token: SeImpersonatePrivilege 1924 msiexec.exe Token: SeCreateGlobalPrivilege 1924 msiexec.exe Token: SeRestorePrivilege 572 msiexec.exe Token: SeTakeOwnershipPrivilege 572 msiexec.exe Token: SeRestorePrivilege 572 msiexec.exe Token: SeTakeOwnershipPrivilege 572 msiexec.exe Token: SeRestorePrivilege 572 msiexec.exe Token: SeTakeOwnershipPrivilege 572 msiexec.exe Token: SeRestorePrivilege 572 msiexec.exe Token: SeTakeOwnershipPrivilege 572 msiexec.exe Token: SeRestorePrivilege 572 msiexec.exe Token: SeTakeOwnershipPrivilege 572 msiexec.exe Token: SeRestorePrivilege 572 msiexec.exe Token: SeTakeOwnershipPrivilege 572 msiexec.exe Token: SeRestorePrivilege 572 msiexec.exe Token: SeTakeOwnershipPrivilege 572 msiexec.exe Token: SeRestorePrivilege 572 msiexec.exe Token: SeTakeOwnershipPrivilege 572 msiexec.exe Token: SeRestorePrivilege 572 msiexec.exe Token: SeTakeOwnershipPrivilege 572 msiexec.exe Token: SeRestorePrivilege 572 msiexec.exe Token: SeTakeOwnershipPrivilege 572 msiexec.exe Token: SeRestorePrivilege 572 msiexec.exe Token: SeTakeOwnershipPrivilege 572 msiexec.exe Token: SeRestorePrivilege 572 msiexec.exe Token: SeTakeOwnershipPrivilege 572 msiexec.exe Token: SeRestorePrivilege 572 msiexec.exe Token: SeTakeOwnershipPrivilege 572 msiexec.exe Token: SeRestorePrivilege 572 msiexec.exe Token: SeTakeOwnershipPrivilege 572 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1924 msiexec.exe 1924 msiexec.exe 904 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 904 iexplore.exe 904 iexplore.exe 1048 IEXPLORE.EXE 1048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 572 wrote to memory of 1528 572 msiexec.exe 28 PID 572 wrote to memory of 1528 572 msiexec.exe 28 PID 572 wrote to memory of 1528 572 msiexec.exe 28 PID 572 wrote to memory of 1528 572 msiexec.exe 28 PID 572 wrote to memory of 1528 572 msiexec.exe 28 PID 572 wrote to memory of 1528 572 msiexec.exe 28 PID 572 wrote to memory of 1528 572 msiexec.exe 28 PID 572 wrote to memory of 1632 572 msiexec.exe 32 PID 572 wrote to memory of 1632 572 msiexec.exe 32 PID 572 wrote to memory of 1632 572 msiexec.exe 32 PID 572 wrote to memory of 1632 572 msiexec.exe 32 PID 572 wrote to memory of 1632 572 msiexec.exe 32 PID 572 wrote to memory of 1632 572 msiexec.exe 32 PID 572 wrote to memory of 1632 572 msiexec.exe 32 PID 912 wrote to memory of 904 912 Object.exe 34 PID 912 wrote to memory of 904 912 Object.exe 34 PID 912 wrote to memory of 904 912 Object.exe 34 PID 912 wrote to memory of 904 912 Object.exe 34 PID 904 wrote to memory of 1048 904 iexplore.exe 35 PID 904 wrote to memory of 1048 904 iexplore.exe 35 PID 904 wrote to memory of 1048 904 iexplore.exe 35 PID 904 wrote to memory of 1048 904 iexplore.exe 35
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\RT.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1924
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 865C2E740EE9A156BBE9A5176E1C00632⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1528
-
-
C:\Windows\Installer\MSI1FEB.tmp"C:\Windows\Installer\MSI1FEB.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\WEFHWE0-FWEUY-F9WUEFWWEF\BND0WEPWEJFC-9UEWFF\Object.exe"2⤵
- Executes dropped EXE
PID:1632
-
-
C:\Users\Admin\AppData\Roaming\WEFHWE0-FWEUY-F9WUEFWWEF\BND0WEPWEJFC-9UEWFF\Object.exe"C:\Users\Admin\AppData\Roaming\WEFHWE0-FWEUY-F9WUEFWWEF\BND0WEPWEJFC-9UEWFF\Object.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" %1 "https://bit.ly/3DvoVCc"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:904 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1048
-
-