Analysis
-
max time kernel
112s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
26-03-2022 08:46
Static task
static1
Behavioral task
behavioral1
Sample
805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe
Resource
win10v2004-en-20220113
General
-
Target
805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe
-
Size
831KB
-
MD5
4a12053ca1064f8b6e00112a0ba82847
-
SHA1
5d376b0314575c2d30f38ce6d3e3cc05f584daa2
-
SHA256
805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4
-
SHA512
7db505c09c41578e5ced3129266608804fd13cdfb4c48f17d461be73d8a69fafc2c87daf82a3d3ba0832211793e76ac1d5be5237fb3b0e461514f64261e40ec1
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 448 set thread context of 1824 448 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 87 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4480 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1824 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1824 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 1824 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 1824 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 1824 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 4288 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 3940 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 448 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1824 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1824 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 4288 wrote to memory of 4008 4288 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 81 PID 4288 wrote to memory of 4008 4288 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 81 PID 4288 wrote to memory of 4008 4288 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 81 PID 4288 wrote to memory of 3284 4288 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 82 PID 4288 wrote to memory of 3284 4288 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 82 PID 4288 wrote to memory of 3284 4288 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 82 PID 4288 wrote to memory of 3940 4288 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 83 PID 4288 wrote to memory of 3940 4288 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 83 PID 4288 wrote to memory of 3940 4288 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 83 PID 3940 wrote to memory of 2384 3940 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 84 PID 3940 wrote to memory of 2384 3940 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 84 PID 3940 wrote to memory of 2384 3940 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 84 PID 4008 wrote to memory of 4480 4008 cmd.exe 86 PID 4008 wrote to memory of 4480 4008 cmd.exe 86 PID 4008 wrote to memory of 4480 4008 cmd.exe 86 PID 3940 wrote to memory of 448 3940 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 85 PID 3940 wrote to memory of 448 3940 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 85 PID 3940 wrote to memory of 448 3940 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 85 PID 448 wrote to memory of 1824 448 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 87 PID 448 wrote to memory of 1824 448 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 87 PID 448 wrote to memory of 1824 448 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 87 PID 448 wrote to memory of 1824 448 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe 87 -
outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe -
outlook_win_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe"C:\Users\Admin\AppData\Local\Temp\805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.execmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\73e9eb5fb3c345c4ac116502bcc76332.xml"2⤵
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\73e9eb5fb3c345c4ac116502bcc76332.xml"3⤵
- Creates scheduled task(s)
PID:4480
-
-
-
C:\Users\Admin\AppData\Local\Temp\805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe"C:\Users\Admin\AppData\Local\Temp\805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe"2⤵PID:3284
-
-
C:\Users\Admin\AppData\Local\Temp\805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe"C:\Users\Admin\AppData\Local\Temp\805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe"C:\Users\Admin\AppData\Local\Temp\805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe"3⤵PID:2384
-
-
C:\Users\Admin\AppData\Local\Temp\805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe"C:\Users\Admin\AppData\Local\Temp\805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe"C:\Users\Admin\AppData\Local\Temp\805ecde4c728771f0da5ba23cd49865e2ce75910b7e1f68e4cb040ce5949d4e4.exe"4⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1824
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c673ecc050b1038f727be09aa61cb4b1
SHA1d2960b6d62810ce8745f6353d6924ae79af01e7e
SHA2568f2648a15094c455e21cab1ba01133d9d9d17caaab1bb2ee782da160898880e4
SHA512d6b75c8068c3d9208585413f7a799f69b05e141446d09925f9aae34ac65c0745f37196ec3aeb369e2c8dea6ddfcc55c07fe8f227a06d79dfa408f3d2315c29e6