Analysis
-
max time kernel
160s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
09-02-2022 14:48
Static task
static1
Behavioral task
behavioral1
Sample
TeamViewer_Setup.exe
Resource
win7-en-20211208
General
-
Target
TeamViewer_Setup.exe
-
Size
30.6MB
-
MD5
9d21ffb20e6811ced753e5ba0ce3d10d
-
SHA1
b9c22130c185388470ab8125f5bb5004d997406a
-
SHA256
f971c06c3cf16467d90652e57b72c53b273a1360f1af1fc377d6158e772b6a70
-
SHA512
0394818b212faf1aa487d3cab6c4a579d32d3eef06379c4e0a2f49211938854bde7622d170a58e16a9a61a8208a653116ebd43395b1f9ac28616b6eb6b284966
Malware Config
Extracted
gozi_rm3
-
exe_type
loader
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
TeamViewer_.exepid process 1784 TeamViewer_.exe -
Loads dropped DLL 23 IoCs
Processes:
TeamViewer_Setup.exeTeamViewer_.exepid process 2668 TeamViewer_Setup.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe 1784 TeamViewer_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEiexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9B96ABB7-89C0-11EC-82D0-E6101B3923D5} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "892811787" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cce5a29beacafa47833fc2d72883fdda00000000020000000000106600000001000020000000f76976cb9b8c91b2bf3a28966f8db14fe2753a669138b81dac55eeadf5493fcc000000000e8000000002000020000000adc5b757d7700955cb94878b363a4958bd9e16e0d986d7ae6922fac2530b6ab520000000ae64179da705d0336510c14a29a6afa609f7b6ae7b4f276055f6b4410c14b5d940000000e7cb5559b93ba5b7ddc7f57901c2de9e70f105eee90ff4246cc623d524a249a5d7c9dce867711ba17bbc3d2c01041dfbf5be80894e676c067db1e83e9dcd76f7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30940621" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f02ae95ecd1dd801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8C95BD55-89C0-11EC-82D0-E6101B3923D5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cce5a29beacafa47833fc2d72883fdda0000000002000000000010660000000100002000000029cd75ffa7dacf86bf64af924a1884d94e0f7aa26ca664159a562ed7affd1079000000000e800000000200002000000067cf945396911feb303ca110a65735b58e23346131f75c896917de14edacf0d7200000001b5ba2b82e8e5b58602b139d420eb066413deda5d2dfe51e6e74709518257ceb400000003e80b725e126d024f9d12ab253b0139e3dc0b1c76d297b87c2a8787d319e4c7783f82e40aca51bc9f2b450164c9c175499f8192e919d9d2bd83f1fdcac4a1a95 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{940B7AD2-89C0-11EC-82D0-E6101B3923D5} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 101d5257cd1dd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cce5a29beacafa47833fc2d72883fdda0000000002000000000010660000000100002000000032ca58e69046a47780e9d0fb9b2575b9fbc57cc28e5be0c7be161919b0a4598d000000000e8000000002000020000000020253bdd0b99e3ce071ae2d83d8186de468c79ac1ca38f7056c38f38ddbba7c20000000918b700600611384a6d6a305d7c4a07c6100e58b8ba11f50042a01242e04ec7840000000774cc94227ba0254b54204e255db679aa55d45785ff1549e4042f350f189c1f9cd6f9c7edbbd6ec30dd12c289425c81671bdc1c6fbe769495fd0e5fcc4c13e76 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5097aa6ccd1dd801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30940621" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A92F9315-89C0-11EC-82D0-E6101B3923D5} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5076ae4dcd1dd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exepid process 1144 iexplore.exe 3628 iexplore.exe 1884 iexplore.exe 2592 iexplore.exe 4008 iexplore.exe 2700 iexplore.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEpid process 1144 iexplore.exe 1144 iexplore.exe 536 IEXPLORE.EXE 536 IEXPLORE.EXE 3628 iexplore.exe 3628 iexplore.exe 3796 IEXPLORE.EXE 3796 IEXPLORE.EXE 1884 iexplore.exe 1884 iexplore.exe 1004 IEXPLORE.EXE 1004 IEXPLORE.EXE 2592 iexplore.exe 2592 iexplore.exe 1244 IEXPLORE.EXE 1244 IEXPLORE.EXE 4008 iexplore.exe 4008 iexplore.exe 532 IEXPLORE.EXE 532 IEXPLORE.EXE 2700 iexplore.exe 2700 iexplore.exe 3896 IEXPLORE.EXE 3896 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
TeamViewer_Setup.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exedescription pid process target process PID 2668 wrote to memory of 1784 2668 TeamViewer_Setup.exe TeamViewer_.exe PID 2668 wrote to memory of 1784 2668 TeamViewer_Setup.exe TeamViewer_.exe PID 2668 wrote to memory of 1784 2668 TeamViewer_Setup.exe TeamViewer_.exe PID 1144 wrote to memory of 536 1144 iexplore.exe IEXPLORE.EXE PID 1144 wrote to memory of 536 1144 iexplore.exe IEXPLORE.EXE PID 1144 wrote to memory of 536 1144 iexplore.exe IEXPLORE.EXE PID 3628 wrote to memory of 3796 3628 iexplore.exe IEXPLORE.EXE PID 3628 wrote to memory of 3796 3628 iexplore.exe IEXPLORE.EXE PID 3628 wrote to memory of 3796 3628 iexplore.exe IEXPLORE.EXE PID 1884 wrote to memory of 1004 1884 iexplore.exe IEXPLORE.EXE PID 1884 wrote to memory of 1004 1884 iexplore.exe IEXPLORE.EXE PID 1884 wrote to memory of 1004 1884 iexplore.exe IEXPLORE.EXE PID 2592 wrote to memory of 1244 2592 iexplore.exe IEXPLORE.EXE PID 2592 wrote to memory of 1244 2592 iexplore.exe IEXPLORE.EXE PID 2592 wrote to memory of 1244 2592 iexplore.exe IEXPLORE.EXE PID 4008 wrote to memory of 532 4008 iexplore.exe IEXPLORE.EXE PID 4008 wrote to memory of 532 4008 iexplore.exe IEXPLORE.EXE PID 4008 wrote to memory of 532 4008 iexplore.exe IEXPLORE.EXE PID 2700 wrote to memory of 3896 2700 iexplore.exe IEXPLORE.EXE PID 2700 wrote to memory of 3896 2700 iexplore.exe IEXPLORE.EXE PID 2700 wrote to memory of 3896 2700 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:3784
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1144 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:536
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3368
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵PID:1460
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3628 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3796
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1884 CREDAT:17410 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1004
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2592 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1244
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4008 CREDAT:17410 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:532
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3896
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
54e9306f95f32e50ccd58af19753d929
SHA1eab9457321f34d4dcf7d4a0ac83edc9131bf7c57
SHA25645f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72
SHA5128711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f
-
MD5
2f653a788f187f0c57f53856f36e46f1
SHA11efb24ada3dd48c54681debf3220ba5dd2ebee7c
SHA25630968cbb3604111b2818bb21fc0005dc49e09abde58421bd25a8fc1776fefb41
SHA51276ef41f84faaaf95a60d902107dbee1b4fd47777f3a577e201ab6bfde4f917e59aa2ff536598e91eac42c75d9d4d69854c6813c58b5d3a1b18172be22763c2df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
MD5e2f4d7934d053d8708d8c443a8604a4b
SHA1473a5d2fe5aa15addeb8d0227f352078776db1f4
SHA25677c9ad79c855b846a0c6bf4e2e3c2df639eac2df3ec0627804cc3081f0c02328
SHA5128ad78377f07772775752685bfcb9a1e192a44e3e36589f73a47126f7502adf9f9b6f0b6697fc24a63a5ef7582936af245ac26e91ab156e17d3e9176fd753f76d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEE0CCFF84BA1E9121EE261796CAE1A7
MD5b8f5e4bcd8542693cf07fa696cd55af7
SHA10c7d23b7dddaca7362641e4f34821c841d9d4142
SHA25645560634f239576d29f9530c74c2672a2baa8ac3db0848c23b5af773d7f8d83d
SHA512bcdadebb23dc974b38463ddc4c98d4c95f46157ec2af42357765d0fb0a33d19a4cc658758817d773fe8a270eb0ee5072037aa7923022cd71a374fd297fa6345a
-
MD5
6beb92614435557ead728bfc739b1ada
SHA18b74f34b7cff0bd2bc4369adf7b594fe8869c3f9
SHA2566b92739bf2bc25cd2a41d8cce0ae9815279d8c4b36ddad1617f5fe6b3d1b7ed6
SHA512d804a8049434916f126a00385fe97208a00282bff574fd93eb35296d6a97e3c9751898b1261e93415049e5c2f1c17f3d0f0a550405c69412ef65643727be4ea2
-
MD5
6beb92614435557ead728bfc739b1ada
SHA18b74f34b7cff0bd2bc4369adf7b594fe8869c3f9
SHA2566b92739bf2bc25cd2a41d8cce0ae9815279d8c4b36ddad1617f5fe6b3d1b7ed6
SHA512d804a8049434916f126a00385fe97208a00282bff574fd93eb35296d6a97e3c9751898b1261e93415049e5c2f1c17f3d0f0a550405c69412ef65643727be4ea2
-
MD5
acd6cd3df0f488a6571d5a4723b32115
SHA1552cd3eec0561fc5f58b974b3a381ef90b9a63f7
SHA256cdbb63b7564a66278d31af41f9c22a9b7d2bb2a0f186d3f7ec01cf65ac5d4614
SHA512549713a40e3d4aa4ab8a08fc005d5a6a9547e12b9291c548ee9f8b7bd4bfcb0ea92d4f0a646777ad37ac4137705540ba21b56d8ca32646f96c6e1a0ee4293ddf
-
MD5
465ad8b483c5e8bbfee17aa15ea3b488
SHA1ad984431df286cd6c10796b49c248e6afb4d55bf
SHA256943149b2cf028bbe593375e255ed834c129f97ed2dab9c3779d871446dc177df
SHA5128c137cff4aeeee2556233a07d7df9c183c38a36c40d904a89f22d73cc13b3941d71708da89dfe908f335f6c39e4c70b376dd437924e15ac697876f612bdf01d6
-
MD5
033ee34c40e8fa85bf2739bcb2f3e186
SHA12ca942f35f77f37df3fc6097acac34f2e77341b7
SHA256c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
SHA5122204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
-
MD5
033ee34c40e8fa85bf2739bcb2f3e186
SHA12ca942f35f77f37df3fc6097acac34f2e77341b7
SHA256c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
SHA5122204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
-
MD5
033ee34c40e8fa85bf2739bcb2f3e186
SHA12ca942f35f77f37df3fc6097acac34f2e77341b7
SHA256c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
SHA5122204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
-
MD5
033ee34c40e8fa85bf2739bcb2f3e186
SHA12ca942f35f77f37df3fc6097acac34f2e77341b7
SHA256c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
SHA5122204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
-
MD5
033ee34c40e8fa85bf2739bcb2f3e186
SHA12ca942f35f77f37df3fc6097acac34f2e77341b7
SHA256c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
SHA5122204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
-
MD5
033ee34c40e8fa85bf2739bcb2f3e186
SHA12ca942f35f77f37df3fc6097acac34f2e77341b7
SHA256c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
SHA5122204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
-
MD5
033ee34c40e8fa85bf2739bcb2f3e186
SHA12ca942f35f77f37df3fc6097acac34f2e77341b7
SHA256c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
SHA5122204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
-
MD5
033ee34c40e8fa85bf2739bcb2f3e186
SHA12ca942f35f77f37df3fc6097acac34f2e77341b7
SHA256c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
SHA5122204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
-
MD5
033ee34c40e8fa85bf2739bcb2f3e186
SHA12ca942f35f77f37df3fc6097acac34f2e77341b7
SHA256c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
SHA5122204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
-
MD5
033ee34c40e8fa85bf2739bcb2f3e186
SHA12ca942f35f77f37df3fc6097acac34f2e77341b7
SHA256c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
SHA5122204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
-
MD5
0ff2d70cfdc8095ea99ca2dabbec3cd7
SHA110c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA256982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
SHA512cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
-
MD5
b9e0c430596b2435971079edd15d3f0c
SHA1fc214c6757e3539729e42f754c6b9768fd44a942
SHA256c1ec07d1faf59ecdc0c8c1cd258b2feb6d41321471a8c1b10b00100c7106bd7e
SHA51293dc70fc6fcc4c0f4bc5fc5819446dc465360ef459a0be408bd07a78229f297da12d602b0667145d9716514e8f3da3582b1c4c0e3e9524e39c4a0c8fe7d4e25b
-
MD5
b9e0c430596b2435971079edd15d3f0c
SHA1fc214c6757e3539729e42f754c6b9768fd44a942
SHA256c1ec07d1faf59ecdc0c8c1cd258b2feb6d41321471a8c1b10b00100c7106bd7e
SHA51293dc70fc6fcc4c0f4bc5fc5819446dc465360ef459a0be408bd07a78229f297da12d602b0667145d9716514e8f3da3582b1c4c0e3e9524e39c4a0c8fe7d4e25b
-
MD5
b9e0c430596b2435971079edd15d3f0c
SHA1fc214c6757e3539729e42f754c6b9768fd44a942
SHA256c1ec07d1faf59ecdc0c8c1cd258b2feb6d41321471a8c1b10b00100c7106bd7e
SHA51293dc70fc6fcc4c0f4bc5fc5819446dc465360ef459a0be408bd07a78229f297da12d602b0667145d9716514e8f3da3582b1c4c0e3e9524e39c4a0c8fe7d4e25b
-
MD5
b9e0c430596b2435971079edd15d3f0c
SHA1fc214c6757e3539729e42f754c6b9768fd44a942
SHA256c1ec07d1faf59ecdc0c8c1cd258b2feb6d41321471a8c1b10b00100c7106bd7e
SHA51293dc70fc6fcc4c0f4bc5fc5819446dc465360ef459a0be408bd07a78229f297da12d602b0667145d9716514e8f3da3582b1c4c0e3e9524e39c4a0c8fe7d4e25b
-
MD5
b9e0c430596b2435971079edd15d3f0c
SHA1fc214c6757e3539729e42f754c6b9768fd44a942
SHA256c1ec07d1faf59ecdc0c8c1cd258b2feb6d41321471a8c1b10b00100c7106bd7e
SHA51293dc70fc6fcc4c0f4bc5fc5819446dc465360ef459a0be408bd07a78229f297da12d602b0667145d9716514e8f3da3582b1c4c0e3e9524e39c4a0c8fe7d4e25b
-
MD5
9b0db6a6056e8e51ac35e602aeab769f
SHA1b541c6d2635141cdc3a74f59d55db8df4a92e7ac
SHA256925d80c31702a95d58ede91ee97fd842de78ca6dde69156a6c1a755fba93cd5c
SHA51283fe9d346835940a37e0e0a18d041c9d13fc95a0e9ece3bc18e555cf0e8e7ddf7b42dba422b1e55ace31db3c9fc807e0b44e93b8f07f5acb943eaaf77b4f0ac6
-
MD5
9b0db6a6056e8e51ac35e602aeab769f
SHA1b541c6d2635141cdc3a74f59d55db8df4a92e7ac
SHA256925d80c31702a95d58ede91ee97fd842de78ca6dde69156a6c1a755fba93cd5c
SHA51283fe9d346835940a37e0e0a18d041c9d13fc95a0e9ece3bc18e555cf0e8e7ddf7b42dba422b1e55ace31db3c9fc807e0b44e93b8f07f5acb943eaaf77b4f0ac6
-
MD5
9b0db6a6056e8e51ac35e602aeab769f
SHA1b541c6d2635141cdc3a74f59d55db8df4a92e7ac
SHA256925d80c31702a95d58ede91ee97fd842de78ca6dde69156a6c1a755fba93cd5c
SHA51283fe9d346835940a37e0e0a18d041c9d13fc95a0e9ece3bc18e555cf0e8e7ddf7b42dba422b1e55ace31db3c9fc807e0b44e93b8f07f5acb943eaaf77b4f0ac6
-
MD5
9b0db6a6056e8e51ac35e602aeab769f
SHA1b541c6d2635141cdc3a74f59d55db8df4a92e7ac
SHA256925d80c31702a95d58ede91ee97fd842de78ca6dde69156a6c1a755fba93cd5c
SHA51283fe9d346835940a37e0e0a18d041c9d13fc95a0e9ece3bc18e555cf0e8e7ddf7b42dba422b1e55ace31db3c9fc807e0b44e93b8f07f5acb943eaaf77b4f0ac6
-
MD5
4ac3f0ab2e423515ed9c575333342054
SHA1a3e4f2b2135157f964d471564044b023a64f2532
SHA256f223d6c72f86544b358a6301daf60ccdd86198f32e3447a1860acf3f59f2dae9
SHA5128fbd5b4989be51c27fa15af155d2921bea9aa5d0557a22d4224256e678dfe7dcaa5f80917a748c31dc9c9a91573e4618e2497ccfd47eefd7a0fa08c12366a1e5
-
MD5
4ac3f0ab2e423515ed9c575333342054
SHA1a3e4f2b2135157f964d471564044b023a64f2532
SHA256f223d6c72f86544b358a6301daf60ccdd86198f32e3447a1860acf3f59f2dae9
SHA5128fbd5b4989be51c27fa15af155d2921bea9aa5d0557a22d4224256e678dfe7dcaa5f80917a748c31dc9c9a91573e4618e2497ccfd47eefd7a0fa08c12366a1e5