General
Target

1dc5e8254eb6cc84c1d4a29a203394ca5a5f500f0de3a6145bfab6956f580f2b.exe

Filesize

908KB

Completed

20-05-2022 07:46

Task

behavioral2

Score
10/10
MD5

96461a39c8fc2a60432164c0e9e666fa

SHA1

5f0bc7807d0dc35dc134d7a67213aafd45898e4f

SHA256

1dc5e8254eb6cc84c1d4a29a203394ca5a5f500f0de3a6145bfab6956f580f2b

SHA512

b322e7a4810e7be794b92305800a9a8b1ad834feaaffde931a674ab604c088285c1fe677c4f0ec97eae88e4447f2f2f56d178961b8b78145822f1f7276e231c7

Malware Config

Extracted

Family

gozi_rm3

Attributes
build
300854
exe_type
loader

Extracted

Family

gozi_rm3

Botnet

202004141

C2

https://devicelease.xyz

Attributes
build
300854
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12
url_path
index.htm
rsa_pubkey.plain
serpent.plain
Signatures 5

Filter: none

Defense Evasion
  • Gozi RM3

    Description

    A heavily modified version of Gozi using RM3 loader.

  • Modifies Internet Explorer settings
    iexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exeiexplore.exeIEXPLORE.EXE

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000de0a1e983134cf4e883f258c38579ff0000000000200000000001066000000010000200000007cbc3b8deb0b12e88b24b74592e793989ef538203c78c5a045bf8844a6c91b17000000000e800000000200002000000093679ba08b274e9605e871ee80c1993137e82ac9d0686d31782069a22127c76420000000ddd742fbaabc556eb9c78a53f582bb25a9d83342f44d3ef59d3b42150a1ea56640000000b43a3a797c4e82d5eaefdec324f898bc0f996db115431ffa73011b3dc473815f90d7e56175989dea312de9ece744260809e9f25b371a0338ba4ff6a9bcedaa69iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\MINIEiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\MINIEiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B03CFE06-D821-11EC-B274-F2EB97E7861D} = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0db44592e6cd801iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\MINIEiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A35BAB27-D821-11EC-B274-F2EB97E7861D} = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b41b2f2e6cd801iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000de0a1e983134cf4e883f258c38579ff000000000020000000000106600000001000020000000f2b5651e0fff416f5b8226305202b22d2bb74f33ff05861b3d1b3c7e71b6af71000000000e80000000020000200000007edad701350567e1ffbced7367b73abaa682bb6d266a2f6f1a35b60328e9811020000000f11cb99dd93d617207a8598267a97237339f816edb43fcfdb76a64cea5c81ad5400000009d033052b1106fb5ce7ee4bf1c093f83f13c202f17a5c0bffa2dc56a9510e2ed446cd6b4661fd26580c5e3d5f22457c0e4708133504fca5bcf380c45aacae258iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000de0a1e983134cf4e883f258c38579ff000000000020000000000106600000001000020000000172f1207f79bef54315538274edd5a4383e8cbdef4a4589555104b67208fc4b6000000000e800000000200002000000062790c3f17d11658fd74facafc25d7da6934d51572bfb1dc1cf7b8ef57e86fcc20000000126b707bd32fc161de78d95ad06a4844dad4443e2d9630cd929fcb04b410ce3a40000000012ae0ac2a08e55e66cf6f1e9d77e45ff8aa65b22ae7fc269a246d26b9ad295662fb9e81291556db0b9d014738bc2b6f208b0934cd89511a1eef0a1f4f5881c1iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{63C6D561-D821-11EC-B274-F2EB97E7861D} = "0"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801c1f662e6cd801iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\MINIEiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 207d6f4c2e6cd801iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{968FCBD3-D821-11EC-B274-F2EB97E7861D} = "0"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{89B33B49-D821-11EC-B274-F2EB97E7861D} = "0"iexplore.exe
  • Suspicious use of FindShellTrayWindow
    iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

    Reported IOCs

    pidprocess
    4452iexplore.exe
    4452iexplore.exe
    3376iexplore.exe
    4788iexplore.exe
    3720iexplore.exe
    3712iexplore.exe
    3972iexplore.exe
  • Suspicious use of SetWindowsHookEx
    iexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

    Reported IOCs

    pidprocess
    4452iexplore.exe
    4452iexplore.exe
    4700IEXPLORE.EXE
    4700IEXPLORE.EXE
    4452iexplore.exe
    4452iexplore.exe
    32IEXPLORE.EXE
    32IEXPLORE.EXE
    3376iexplore.exe
    3376iexplore.exe
    3160IEXPLORE.EXE
    3160IEXPLORE.EXE
    4788iexplore.exe
    4788iexplore.exe
    1304IEXPLORE.EXE
    1304IEXPLORE.EXE
    3720iexplore.exe
    3720iexplore.exe
    4012IEXPLORE.EXE
    4012IEXPLORE.EXE
    3712iexplore.exe
    3712iexplore.exe
    1404IEXPLORE.EXE
    1404IEXPLORE.EXE
    3972iexplore.exe
    3972iexplore.exe
    3380IEXPLORE.EXE
    3380IEXPLORE.EXE
  • Suspicious use of WriteProcessMemory
    iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4452 wrote to memory of 47004452iexplore.exeIEXPLORE.EXE
    PID 4452 wrote to memory of 47004452iexplore.exeIEXPLORE.EXE
    PID 4452 wrote to memory of 47004452iexplore.exeIEXPLORE.EXE
    PID 4452 wrote to memory of 324452iexplore.exeIEXPLORE.EXE
    PID 4452 wrote to memory of 324452iexplore.exeIEXPLORE.EXE
    PID 4452 wrote to memory of 324452iexplore.exeIEXPLORE.EXE
    PID 3376 wrote to memory of 31603376iexplore.exeIEXPLORE.EXE
    PID 3376 wrote to memory of 31603376iexplore.exeIEXPLORE.EXE
    PID 3376 wrote to memory of 31603376iexplore.exeIEXPLORE.EXE
    PID 4788 wrote to memory of 13044788iexplore.exeIEXPLORE.EXE
    PID 4788 wrote to memory of 13044788iexplore.exeIEXPLORE.EXE
    PID 4788 wrote to memory of 13044788iexplore.exeIEXPLORE.EXE
    PID 3720 wrote to memory of 40123720iexplore.exeIEXPLORE.EXE
    PID 3720 wrote to memory of 40123720iexplore.exeIEXPLORE.EXE
    PID 3720 wrote to memory of 40123720iexplore.exeIEXPLORE.EXE
    PID 3712 wrote to memory of 14043712iexplore.exeIEXPLORE.EXE
    PID 3712 wrote to memory of 14043712iexplore.exeIEXPLORE.EXE
    PID 3712 wrote to memory of 14043712iexplore.exeIEXPLORE.EXE
    PID 3972 wrote to memory of 33803972iexplore.exeIEXPLORE.EXE
    PID 3972 wrote to memory of 33803972iexplore.exeIEXPLORE.EXE
    PID 3972 wrote to memory of 33803972iexplore.exeIEXPLORE.EXE
Processes 15
  • C:\Users\Admin\AppData\Local\Temp\1dc5e8254eb6cc84c1d4a29a203394ca5a5f500f0de3a6145bfab6956f580f2b.exe
    "C:\Users\Admin\AppData\Local\Temp\1dc5e8254eb6cc84c1d4a29a203394ca5a5f500f0de3a6145bfab6956f580f2b.exe"
    PID:5088
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    PID:4456
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:4452
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4452 CREDAT:17410 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:4700
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4452 CREDAT:82950 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:32
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:3376
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3376 CREDAT:17410 /prefetch:2
      Suspicious use of SetWindowsHookEx
      PID:3160
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4788 CREDAT:17410 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1304
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:3720
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3720 CREDAT:17410 /prefetch:2
      Suspicious use of SetWindowsHookEx
      PID:4012
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:3712
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3712 CREDAT:17410 /prefetch:2
      Suspicious use of SetWindowsHookEx
      PID:1404
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:3972
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3972 CREDAT:17410 /prefetch:2
      Suspicious use of SetWindowsHookEx
      PID:3380
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/5088-130-0x0000000002240000-0x0000000002251000-memory.dmp

                        • memory/5088-136-0x0000000000780000-0x000000000078C000-memory.dmp

                        • memory/5088-137-0x0000000000400000-0x00000000004E5000-memory.dmp