Overview
overview
10Static
static
10virtual_fr...ds.ps1
windows7_x64
1virtual_fr...ds.ps1
windows10-2004_x64
1virtual_fr...es.ps1
windows7_x64
1virtual_fr...es.ps1
windows10-2004_x64
1virtual_fr...ts.ps1
windows7_x64
1virtual_fr...ts.ps1
windows10-2004_x64
1virtual_fr...ns.ps1
windows7_x64
1virtual_fr...ns.ps1
windows10-2004_x64
1virtual_fr...cts.js
windows7_x64
1virtual_fr...cts.js
windows10-2004_x64
1virtual_fr...ng.ps1
windows7_x64
1virtual_fr...ng.ps1
windows10-2004_x64
1virtual_fr...der.js
windows7_x64
1virtual_fr...der.js
windows10-2004_x64
1virtual_fr...x.html
windows7_x64
1virtual_fr...x.html
windows10-2004_x64
1virtual_fr...ck.ps1
windows7_x64
1virtual_fr...ck.ps1
windows10-2004_x64
1virtual_fr...de.pdf
windows7_x64
1virtual_fr...de.pdf
windows10-2004_x64
1virtual_fr...nks.js
windows7_x64
1virtual_fr...nks.js
windows10-2004_x64
1virtual_fr...x.html
windows7_x64
1virtual_fr...x.html
windows10-2004_x64
1virtual_fr...ler.js
windows7_x64
1virtual_fr...ler.js
windows10-2004_x64
1virtual_fr...tp.ps1
windows7_x64
1virtual_fr...tp.ps1
windows10-2004_x64
1virtual_fr...x.html
windows7_x64
1virtual_fr...x.html
windows10-2004_x64
1virtual_fr...oap.js
windows7_x64
1virtual_fr...oap.js
windows10-2004_x64
1Analysis
-
max time kernel
172s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 07:07
Behavioral task
behavioral1
Sample
virtual_freer_v1.58/back/cards.ps1
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
virtual_freer_v1.58/back/cards.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
virtual_freer_v1.58/back/categories.ps1
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
virtual_freer_v1.58/back/categories.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
virtual_freer_v1.58/back/payments.ps1
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
virtual_freer_v1.58/back/payments.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
virtual_freer_v1.58/back/plugins.ps1
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
virtual_freer_v1.58/back/plugins.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
virtual_freer_v1.58/back/products.js
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
virtual_freer_v1.58/back/products.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
virtual_freer_v1.58/back/setting.ps1
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
virtual_freer_v1.58/back/setting.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
virtual_freer_v1.58/back/template/header.js
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
virtual_freer_v1.58/back/template/header.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
virtual_freer_v1.58/back/template/index.html
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
virtual_freer_v1.58/back/template/index.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
virtual_freer_v1.58/callback.ps1
Resource
win7-20220414-en
Behavioral task
behavioral18
Sample
virtual_freer_v1.58/callback.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
virtual_freer_v1.58/guide.pdf
Resource
win7-20220414-en
Behavioral task
behavioral20
Sample
virtual_freer_v1.58/guide.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral21
Sample
virtual_freer_v1.58/include/funks.js
Resource
win7-20220414-en
Behavioral task
behavioral22
Sample
virtual_freer_v1.58/include/funks.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral23
Sample
virtual_freer_v1.58/include/index.html
Resource
win7-20220414-en
Behavioral task
behavioral24
Sample
virtual_freer_v1.58/include/index.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral25
Sample
virtual_freer_v1.58/include/libs/class.phpmailer.js
Resource
win7-20220414-en
Behavioral task
behavioral26
Sample
virtual_freer_v1.58/include/libs/class.phpmailer.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral27
Sample
virtual_freer_v1.58/include/libs/class.smtp.ps1
Resource
win7-20220414-en
Behavioral task
behavioral28
Sample
virtual_freer_v1.58/include/libs/class.smtp.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral29
Sample
virtual_freer_v1.58/include/libs/index.html
Resource
win7-20220414-en
Behavioral task
behavioral30
Sample
virtual_freer_v1.58/include/libs/index.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral31
Sample
virtual_freer_v1.58/include/libs/nusoap.js
Resource
win7-20220414-en
Behavioral task
behavioral32
Sample
virtual_freer_v1.58/include/libs/nusoap.js
Resource
win10v2004-20220414-en
General
-
Target
virtual_freer_v1.58/include/index.html
-
Size
123B
-
MD5
6b37309700ffdd85eed2431b5dfd3bb1
-
SHA1
2eaf914fe507a09f321684b8add29b94cee50db3
-
SHA256
c703afa89e7517dd5020ac2960b7e14b44d4010ef02d5e0f6e34b9629935a3ce
-
SHA512
79211ac08ef90a01c9ab0bbb2f2bc437b696c9f5b1193c1d98659428ea3ba5a1db7a6659d8b14f5c4184c577ef6caff456439654b84c986740e7a2a50bd92060
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0626BF39-D826-11EC-AC67-7A7C173711D6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4023451370" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b091500000000020000000000106600000001000020000000566e82dda1edbd323a4b5302a6c9daedf1b5378206fa4bd8d6d6ba912a7f8149000000000e800000000200002000000002916c6a46c021be7551ab925769a760cdff0454cccf00e611f9f814461dbac2200000008d9b02bc065d289cf64400f0d7363a5721a832378a5b73e48d0d59a4ef89c5c240000000b0f9237bdacc1104043a277ab528ace802f23c7d2e9a197f0fe023341a7df3984b37f4eae13d7a09b9c7972dfb603ff7631f2a3223e738a2d74b09b169cebb92 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30960690" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4023451370" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30960690" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b0915000000000200000000001066000000010000200000008ab3ae6745f22e5b4151835be3bf20a219aacdf5d24e6d490a954ce08b339c5a000000000e800000000200002000000059773ceae896459fa103e00f6701b80cbbd5a17421ccfb4b2186b4bff8de502a200000002b544c7def018b301515193ed7f9796065cabec1b295b19105691cb49fe27ce840000000e967562cb9c9049da7c8d90bef7f4257b446a888b3c44eb4977f2428c0fe10a9c6ffe95fa6cfcbc52c37cdd1ec3b96533d8ee7036d479f622630b1b545c72b0d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ed81e2326cd801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b091500000000020000000000106600000001000020000000f6ac7d95856582396b053416364c9e2360e43a4a2e8dcd11b22457bc5e8b3c24000000000e8000000002000020000000cef62b0abbe85b12e3c89de2ea4e1aa2dd54977ec37807e7644d594363728d2450000000361e6e4560959633615350d617634df4cf001461fff92678da08fa2a87172ad9f94de68383d2055a4d8f829156a7ed9a2fab52e89917773f36975ff8d21ddb531661c354c5292bb401a3fddf003088a040000000d6fde8b5cc2204afd02751957b705a7a9f8fee359107bf5b98d8f48972fc12d412fb276187276e0603b7543de3c2aa2fc8db376a8d67254712b1d9eaa42806ef iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = f982cdb29d50d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001318e3326cd801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "359806815" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b0915000000000200000000001066000000010000200000009471b300811a1799fbfd0e32082cbd95de7fa6b2f2535173386a6a049c7af7dc000000000e8000000002000020000000032599c4436c94813b8669a9dcc6a0121d169848102d79cf184e58d5f9e769031000000025c1e399d06b97ea146b17b8b21f664e400000008ccbfe647a458397f212c0e1c75342609b2da0e89b69e3cdc75819cf863104aba92e5c0546f8a1a2c74cce89d202dd970db6a5fab7f4a918965834206fa48170 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 4372 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4372 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4372 iexplore.exe 4372 iexplore.exe 4556 IEXPLORE.EXE 4556 IEXPLORE.EXE 4556 IEXPLORE.EXE 4556 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 4372 wrote to memory of 4556 4372 iexplore.exe IEXPLORE.EXE PID 4372 wrote to memory of 4556 4372 iexplore.exe IEXPLORE.EXE PID 4372 wrote to memory of 4556 4372 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\virtual_freer_v1.58\include\index.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4372 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx