Analysis
-
max time kernel
154s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2022 16:50
Static task
static1
Behavioral task
behavioral1
Sample
61970452081816271072dd600d435d6e352bd25e119d93a85332772d4275f216.exe
Resource
win7-20220718-en
windows7-x64
5 signatures
150 seconds
General
-
Target
61970452081816271072dd600d435d6e352bd25e119d93a85332772d4275f216.exe
-
Size
655KB
-
MD5
b1dec78a1ea2ac66cdc5b14f1b628fa1
-
SHA1
2a9506c5c02a2ab8e3d31d5059e8299b25eb5cc0
-
SHA256
61970452081816271072dd600d435d6e352bd25e119d93a85332772d4275f216
-
SHA512
d3283b7e506ba64dba74bad43a0428f2aa77a33b44d09e1b9f33ac5f9963874c30aedadac56b91a3e1b607c0a3ed44994e00c916814cedf125b95ae3431bd0c0
Malware Config
Extracted
Family
gozi_rm3
Attributes
-
build
300787
Extracted
Family
gozi_rm3
Botnet
201910081
C2
https://kenneyai.xyz
Attributes
-
build
300787
-
exe_type
loader
-
server_id
12
-
url_path
index.htm
rsa_pubkey.plain
serpent.plain
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0caef333aa0d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000094c858eae3d57f4bbeeb69290716aab40000000002000000000010660000000100002000000000e0c98d03bcb005aa0a0e030d85dfc3a7ea8708134a52dff32ad1a2cd5040bc000000000e8000000002000020000000f21cf35d1ed54f3fd47ac27857ce7f1c4a5c82313f85380d087524099c07b43e200000008a8c3b50f0535f6dca42654a1311adf043cb9117391729486afa0eb022da0d7740000000a56b9e3b403df32dccfb1f83b405223090e48122b479ba3b53673868c05e99a74a59d8d593c0ef230e2c84552e97ed5c7178da5b136c6a64e6485c517e80c401 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000094c858eae3d57f4bbeeb69290716aab40000000002000000000010660000000100002000000002d71d044b9cd7ec134c0eb3f119dadd360fea9079a10d1490da4b67ddf9c98f000000000e80000000020000200000001303a37ba6ea279e6b3b4a3505fc6394176152bfb6142e33ad279d52d10cd9c720000000aa30c210b9c9a0f3fa83a7c6c03ff8fa3fd29ee2242f2740d096d7cda99a5e9d40000000e8f5cf3b1262f19ae2d6ec2c205386467614133fb663b7f7810fba1eb51deff6a6fec230d97a151b2e6b9950435ed0f85a8255f1291694382cd59a0c594315b8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{95E2DCAB-0C2D-11ED-B78D-42EFB65330BC} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000094c858eae3d57f4bbeeb69290716aab4000000000200000000001066000000010000200000002b35df949550c087e75ff01a30cf16be4c759b9bcbc9fa397ad836162d9e87d1000000000e8000000002000020000000e0caab8ea835ba1a68213a455b1a1cfbc1698a323eceafa3546321da0ca3d119200000008e29d95ffa507444b022b559a81f32fe026ad4aea0c34ab747a18d3754976e214000000013c368a009e8df74ab23a0bddaf58b544642e9c755a7282f83f075c7a3242eb9cf4dff6f5998b75661be644d62347af7c6dc995cb7f0161da733c13011904750 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4D00389B-0C2D-11ED-B78D-42EFB65330BC} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8F2715AC-0C2D-11ED-B78D-42EFB65330BC} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{886B51CC-0C2D-11ED-B78D-42EFB65330BC} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{73DFCE5D-0C2D-11ED-B78D-42EFB65330BC} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ccc6513aa0d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000094c858eae3d57f4bbeeb69290716aab400000000020000000000106600000001000020000000f3d561f352af25ce0635e24bae8d1860f97cfa53832211db99f50ef18cce63b6000000000e8000000002000020000000487a26723c1f2c55434a3faedfa0a3df186eb9ac7f3b1053524fbc23ac9dab8220000000c9ea971f88ea1c05acf3cd3709770fcc5222bc0552e5ecaf7029503e4c305edd4000000010b21f9a4095ece551a8753238d0de28fd165e1e8268fcb795c7b03696f61fcaf930800f62baa839e786f68460fbd2ad106eb31e84aab1cea57e5acf2498e48a iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000094c858eae3d57f4bbeeb69290716aab40000000002000000000010660000000100002000000095c4bc15973e58105cdd5444e62461beff4d0a3fc78c5ccdf9b6467df6b160ea000000000e800000000200002000000097b07107a674f6d17f6356bdac46450c97b04b3b4a7019143406941d57786aa92000000074d47a3cc0f134c13952cc141227035de94eb4141674e3c4cd650e26159f001d400000002415e7a39d244656f9fcfde2790c0e04f38487d0febd8dc5c0959803fec826817989faac68710fa81646eb45c874b7230a8f42dadeb3b4a19730783c22b2ec5a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000094c858eae3d57f4bbeeb69290716aab4000000000200000000001066000000010000200000002c0708f09887c6a168b1b1ba47d6b74a945b14f8a784671a65f0630c0fbcb1e5000000000e800000000200002000000039f43af3c13a329f3782175504ef9b98dbf28f5f6cef1be843bd09342dacfd19200000008087c39d9834ee8757a821fecf413dc30b7a77ef82d9edef2c29fbd1b6f36ece40000000c3cbe45b78653303e73b0cd91d9a544a570e7eb5badf0e0d401186e37745444fdc12e84e2b78de53a16b5de6ff27757853fffb35d4f6c1a48a38859cbfa87d2c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a03793583aa0d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 4924 iexplore.exe 4136 iexplore.exe 2428 iexplore.exe 4744 iexplore.exe 2096 iexplore.exe 1784 iexplore.exe 1916 iexplore.exe -
Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 4924 iexplore.exe 4924 iexplore.exe 216 IEXPLORE.EXE 216 IEXPLORE.EXE 4136 iexplore.exe 4136 iexplore.exe 4668 IEXPLORE.EXE 4668 IEXPLORE.EXE 2428 iexplore.exe 2428 iexplore.exe 4604 IEXPLORE.EXE 4604 IEXPLORE.EXE 4744 iexplore.exe 4744 iexplore.exe 4880 IEXPLORE.EXE 4880 IEXPLORE.EXE 2096 iexplore.exe 2096 iexplore.exe 4868 IEXPLORE.EXE 4868 IEXPLORE.EXE 1784 iexplore.exe 1784 iexplore.exe 1988 IEXPLORE.EXE 1988 IEXPLORE.EXE 1916 iexplore.exe 1916 iexplore.exe 4016 IEXPLORE.EXE 4016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4924 wrote to memory of 216 4924 iexplore.exe 85 PID 4924 wrote to memory of 216 4924 iexplore.exe 85 PID 4924 wrote to memory of 216 4924 iexplore.exe 85 PID 4136 wrote to memory of 4668 4136 iexplore.exe 90 PID 4136 wrote to memory of 4668 4136 iexplore.exe 90 PID 4136 wrote to memory of 4668 4136 iexplore.exe 90 PID 2428 wrote to memory of 4604 2428 iexplore.exe 92 PID 2428 wrote to memory of 4604 2428 iexplore.exe 92 PID 2428 wrote to memory of 4604 2428 iexplore.exe 92 PID 4744 wrote to memory of 4880 4744 iexplore.exe 94 PID 4744 wrote to memory of 4880 4744 iexplore.exe 94 PID 4744 wrote to memory of 4880 4744 iexplore.exe 94 PID 2096 wrote to memory of 4868 2096 iexplore.exe 96 PID 2096 wrote to memory of 4868 2096 iexplore.exe 96 PID 2096 wrote to memory of 4868 2096 iexplore.exe 96 PID 1784 wrote to memory of 1988 1784 iexplore.exe 98 PID 1784 wrote to memory of 1988 1784 iexplore.exe 98 PID 1784 wrote to memory of 1988 1784 iexplore.exe 98 PID 1916 wrote to memory of 4016 1916 iexplore.exe 100 PID 1916 wrote to memory of 4016 1916 iexplore.exe 100 PID 1916 wrote to memory of 4016 1916 iexplore.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\61970452081816271072dd600d435d6e352bd25e119d93a85332772d4275f216.exe"C:\Users\Admin\AppData\Local\Temp\61970452081816271072dd600d435d6e352bd25e119d93a85332772d4275f216.exe"1⤵PID:1188
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:4476
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4924 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:216
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4136 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4668
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4604
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4744 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4880
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4868
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1784 CREDAT:17410 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1988
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4016
-