Overview
overview
10Static
static
101c50e838ff...8c.exe
windows7-x64
81c50e838ff...8c.exe
windows10-2004-x64
81d3c6d6b27...34.exe
windows7-x64
101d3c6d6b27...34.exe
windows10-2004-x64
1022f524abc9...92.exe
windows7-x64
1022f524abc9...92.exe
windows10-2004-x64
103759265786...d0.exe
windows7-x64
83759265786...d0.exe
windows10-2004-x64
839c853575c...e3.exe
windows7-x64
1039c853575c...e3.exe
windows10-2004-x64
106969c45198...dc.exe
windows7-x64
86969c45198...dc.exe
windows10-2004-x64
896c5607aa1...7a.exe
windows7-x64
896c5607aa1...7a.exe
windows10-2004-x64
8a8d0ac5762...96.exe
windows7-x64
10a8d0ac5762...96.exe
windows10-2004-x64
10c86e66ff92...5d.exe
windows7-x64
10c86e66ff92...5d.exe
windows10-2004-x64
10fca1bb147c...66.exe
windows7-x64
1fca1bb147c...66.exe
windows10-2004-x64
7Analysis
-
max time kernel
97s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-09-2022 09:11
Behavioral task
behavioral1
Sample
1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288c.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334.exe
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
22f524abc98f958705febd3761bedc85ec1ae859316a653b67c0c01327533092.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
22f524abc98f958705febd3761bedc85ec1ae859316a653b67c0c01327533092.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0.exe
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7a.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7a.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral15
Sample
a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96.exe
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exe
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral19
Sample
fca1bb147cee65edf9ef821063fe3899d5ab3da1ca5310c9efe9913204675366.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
fca1bb147cee65edf9ef821063fe3899d5ab3da1ca5310c9efe9913204675366.exe
Resource
win10v2004-20220812-en
General
-
Target
6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe
-
Size
117KB
-
MD5
083b5b2003bc9b2c4cd423b086ad5265
-
SHA1
9fff262f74d9ecf446eabbb2e9136f1bd6c521d4
-
SHA256
6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc
-
SHA512
23999df69b89b2ead229daddbb4d76637c42e7db6b004401f10631fcfe437d40e70af18a92b7d8105610568f6311f9899398aec6296a74a3a932f8d1fdacdcc5
-
SSDEEP
1536:zPFAoF9649rqWOQMg7AQxfrtJlIactudzEIe7nii2nf4ljawM/0ZAmhQuz:Dx64CrsnxWhudIzioaz/YQuz
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exepid process 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe upx \Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe upx C:\Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe upx behavioral11/memory/980-64-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral11/memory/980-65-0x0000000000400000-0x000000000045D000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exepid process 1696 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe 1696 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96052E01-3F0D-11ED-A20B-4279513DF160} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371121285" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96068D91-3F0D-11ED-A20B-4279513DF160} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exepid process 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exedescription pid process Token: SeDebugPrivilege 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 1960 iexplore.exe 644 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 1960 iexplore.exe 1960 iexplore.exe 644 iexplore.exe 644 iexplore.exe 572 IEXPLORE.EXE 572 IEXPLORE.EXE 1324 IEXPLORE.EXE 1324 IEXPLORE.EXE 572 IEXPLORE.EXE 572 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exeiexplore.exeiexplore.exedescription pid process target process PID 1696 wrote to memory of 980 1696 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe PID 1696 wrote to memory of 980 1696 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe PID 1696 wrote to memory of 980 1696 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe PID 1696 wrote to memory of 980 1696 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe PID 980 wrote to memory of 644 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe iexplore.exe PID 980 wrote to memory of 644 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe iexplore.exe PID 980 wrote to memory of 644 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe iexplore.exe PID 980 wrote to memory of 644 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe iexplore.exe PID 980 wrote to memory of 1960 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe iexplore.exe PID 980 wrote to memory of 1960 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe iexplore.exe PID 980 wrote to memory of 1960 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe iexplore.exe PID 980 wrote to memory of 1960 980 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe iexplore.exe PID 1960 wrote to memory of 572 1960 iexplore.exe IEXPLORE.EXE PID 1960 wrote to memory of 572 1960 iexplore.exe IEXPLORE.EXE PID 1960 wrote to memory of 572 1960 iexplore.exe IEXPLORE.EXE PID 1960 wrote to memory of 572 1960 iexplore.exe IEXPLORE.EXE PID 644 wrote to memory of 1324 644 iexplore.exe IEXPLORE.EXE PID 644 wrote to memory of 1324 644 iexplore.exe IEXPLORE.EXE PID 644 wrote to memory of 1324 644 iexplore.exe IEXPLORE.EXE PID 644 wrote to memory of 1324 644 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe"C:\Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exeC:\Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:644 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{96052E01-3F0D-11ED-A20B-4279513DF160}.datFilesize
3KB
MD5f17f992d9d6cc3f8f9605385025c427c
SHA19333b3bcb069a9ccb5c87c7d126839e86fa76fe4
SHA2567a11c4676706939b35c1d2daf042ab2fd9189641ce4a0f4e6dc7f06005dddea7
SHA5128844007510cbc5182a5162ef9bc2c137265f878cc820fd6583af3099ec5e2cfeb4e0753f9910a7fd9b22792200afd7479e5e32e41ca4e5260f9c244c45d2c19a
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{96068D91-3F0D-11ED-A20B-4279513DF160}.datFilesize
3KB
MD596c98723c7aa7f082c53406472ee60c4
SHA1c5b8fe2a619c05caeff1f2516510b855893e4536
SHA256621604816aab9a1c83b17904469719af2a9f94ef23387a6e2e6c484b1af510fb
SHA5125d7b62adb59ebcbd99583d5f7c0815a758d6e03feabd69d2bee8bd18d4dd4b0584af59117a72f3fdd2587e3c210f492cab280fc85e37acd3595fcf0b9dd757e3
-
C:\Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exeFilesize
105KB
MD53235c81e22fad625ce09ae351091f7cc
SHA11a670de8ab6014928459f0c1631db644f7d7526e
SHA25685d274964f8e3cba910a4922bdbdc0ed3b064c0045db18c85d8d2a853d00e7a6
SHA51295797149ba60dc13795798549d566f309796ac7daad849c5295516855f53617c92e29a119d93a5da87d50a16d6a34308b3b0b0d0b3974b899fe2f21ca83f041b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\T0NUVL6M.txtFilesize
603B
MD5db3eae449bd214077434096b2775e3af
SHA117ddd62a034415a9d8d2ad77dc665aaafa04191b
SHA2569576274ea60d5472a94e8b46d47250480bc358fdf346c5c541bb779b42ee2aa5
SHA5124cca37cecfc9146078e54ed2cd54979e57d6f2ebecacc0209f6208981b8ce568530e88abbbb7e058c7d66b55e3309c04042603ac7d854f49862559b6d22e58f9
-
\Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exeFilesize
105KB
MD53235c81e22fad625ce09ae351091f7cc
SHA11a670de8ab6014928459f0c1631db644f7d7526e
SHA25685d274964f8e3cba910a4922bdbdc0ed3b064c0045db18c85d8d2a853d00e7a6
SHA51295797149ba60dc13795798549d566f309796ac7daad849c5295516855f53617c92e29a119d93a5da87d50a16d6a34308b3b0b0d0b3974b899fe2f21ca83f041b
-
\Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exeFilesize
105KB
MD53235c81e22fad625ce09ae351091f7cc
SHA11a670de8ab6014928459f0c1631db644f7d7526e
SHA25685d274964f8e3cba910a4922bdbdc0ed3b064c0045db18c85d8d2a853d00e7a6
SHA51295797149ba60dc13795798549d566f309796ac7daad849c5295516855f53617c92e29a119d93a5da87d50a16d6a34308b3b0b0d0b3974b899fe2f21ca83f041b
-
memory/980-57-0x0000000000000000-mapping.dmp
-
memory/980-64-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/980-65-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/1696-62-0x00000000000F0000-0x000000000014D000-memory.dmpFilesize
372KB
-
memory/1696-63-0x00000000000F0000-0x000000000014D000-memory.dmpFilesize
372KB
-
memory/1696-61-0x0000000000340000-0x0000000000361000-memory.dmpFilesize
132KB
-
memory/1696-66-0x00000000000F0000-0x000000000014D000-memory.dmpFilesize
372KB
-
memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmpFilesize
8KB