Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 23:12
Static task
static1
Behavioral task
behavioral1
Sample
6976a152e57713286649d7b0f0f4368630f8ba92076a35be68436d4a0505650d.dll
Resource
win7-20220812-en
General
-
Target
6976a152e57713286649d7b0f0f4368630f8ba92076a35be68436d4a0505650d.dll
-
Size
1.0MB
-
MD5
91e44b8441750665ec9555b85eb829a6
-
SHA1
8a1b06c84327675fac5f062be08f4b725a3466fb
-
SHA256
6976a152e57713286649d7b0f0f4368630f8ba92076a35be68436d4a0505650d
-
SHA512
a4cf552b7fb3a0a59b8485dd1b512a9a52590a890a8d6f74bd4e8510c4c1ece19e561434b3a8909a80c0721f511de015d41f9c980f801340f1358e86bcb88a1d
-
SSDEEP
12288:895fV5eE+ecfmq8yAKwGslW++O4G3C+fb+WhlPwtWewUAf:mfD+eqD8yAKwGslW+QGyYbEtWi
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1216 regsvr32Srv.exe 5088 DesktopLayer.exe -
resource yara_rule behavioral2/files/0x0006000000022e1e-134.dat upx behavioral2/files/0x0006000000022e1e-135.dat upx behavioral2/files/0x0007000000022e1f-137.dat upx behavioral2/memory/1216-138-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/files/0x0007000000022e1f-139.dat upx behavioral2/memory/5088-142-0x0000000000400000-0x000000000042C000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32Srv.exe regsvr32.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px225D.tmp regsvr32Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe regsvr32Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe regsvr32Srv.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "894897507" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993752" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993752" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374006571" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "894897507" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{609A0C30-594B-11ED-89AC-466E527D41B2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.AiODeviceIO.1\ = "CHPAiODeviceIO Class (CUE)" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.AiOIOSockets\CLSID\ = "{697F5204-0494-11d6-A2B0-0060B0FBD872}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5119-0494-11D6-A2B0-0060B0FBD872}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697F520D-0494-11d6-A2B0-0060B0FBD872}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HPAiO.DevInit.1\ = "HPAiODevInit Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5109-0494-11D6-A2B0-0060B0FBD872}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5111-0494-11D6-A2B0-0060B0FBD872}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5127-0494-11D6-A2B0-0060B0FBD872}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0ABEEC7-1039-40F4-8256-EAD57ECD85EE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0ABEEC7-1039-40F4-8256-EAD57ECD85EE}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B9E3E545-41FC-4723-B126-E04531BD55B5}\TypeLib\ = "{697F5000-0494-11D6-A2B0-0060B0FBD872}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697F5213-0494-11d6-A2B0-0060B0FBD872}\VersionIndependentProgID\ = "HPCUE.AiO1284IDStr" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6FECCAFF-94DE-4E21-9CC1-F67EA3CFE328}\ = "HPAiODevFileNames Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{697F5110-0494-11D6-A2B0-0060B0FBD872}\TypeLib\ = "{697F5000-0494-11D6-A2B0-0060B0FBD872}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5112-0494-11D6-A2B0-0060B0FBD872}\TypeLib\ = "{697F5000-0494-11D6-A2B0-0060B0FBD872}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{697F5125-0494-11D6-A2B0-0060B0FBD872}\TypeLib\ = "{697F5000-0494-11D6-A2B0-0060B0FBD872}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F512C-0494-11D6-A2B0-0060B0FBD872}\TypeLib\ = "{697F5000-0494-11D6-A2B0-0060B0FBD872}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{07AB484F-548E-4B54-8C4C-501DDEEFAC60} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697F5214-0494-11d6-A2B0-0060B0FBD872}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5122-0494-11D6-A2B0-0060B0FBD872} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697F5209-0494-11d6-A2B0-0060B0FBD872}\ = "HPAiOScanToDests Class (CUE)" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697F5208-0494-11d6-A2B0-0060B0FBD872} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{697F5122-0494-11D6-A2B0-0060B0FBD872} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{216E4798-B6CF-4F0E-9A8C-244464129F50}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8B9978D-B7B8-41AD-B8EC-A8D12C2B5F02}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697F520D-0494-11d6-A2B0-0060B0FBD872}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.AiODevFaxLogs\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{697F510D-0494-11D6-A2B0-0060B0FBD872} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5113-0494-11D6-A2B0-0060B0FBD872}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{697F5118-0494-11D6-A2B0-0060B0FBD872}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5119-0494-11D6-A2B0-0060B0FBD872} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F511E-0494-11D6-A2B0-0060B0FBD872}\ = "DIHPAiOFWCntrs" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5101-0494-11D6-A2B0-0060B0FBD872} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0ABEEC7-1039-40F4-8256-EAD57ECD85EE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.AiOScanToDest.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HPAiO.DevFileNames.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD98B706-B1FD-442F-AA9B-81E7A89B7E28}\TypeLib\ = "{697F5000-0494-11D6-A2B0-0060B0FBD872}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A62AB45-F524-4F55-8CCA-CCE41FFC54D6}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.AiOJunkFaxes\ = "HPAiOJunkFaxes Class (CUE)" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697F520D-0494-11d6-A2B0-0060B0FBD872}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HPAiO.DevFileNames regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{697F5120-0494-11D6-A2B0-0060B0FBD872}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5120-0494-11D6-A2B0-0060B0FBD872}\TypeLib\ = "{697F5000-0494-11D6-A2B0-0060B0FBD872}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D42E8141-B517-4128-AC8A-F37855A4A7BA}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5106-0494-11D6-A2B0-0060B0FBD872}\ = "DIHPAiOIOSockets" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{697F510B-0494-11D6-A2B0-0060B0FBD872}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A6C0328-9D50-4111-AE4F-5675145221CE}\ = "DIHPAiOFWCntr2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{697F511D-0494-11D6-A2B0-0060B0FBD872} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5120-0494-11D6-A2B0-0060B0FBD872} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{697F512B-0494-11D6-A2B0-0060B0FBD872}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0ABEEC7-1039-40F4-8256-EAD57ECD85EE}\TypeLib\ = "{697F5000-0494-11D6-A2B0-0060B0FBD872}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5108-0494-11D6-A2B0-0060B0FBD872}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{697F5109-0494-11D6-A2B0-0060B0FBD872}\TypeLib\ = "{697F5000-0494-11D6-A2B0-0060B0FBD872}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D38C196B-2241-4831-8673-1889DE73A8FF}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A6C0328-9D50-4111-AE4F-5675145221CE}\TypeLib\ = "{697F5000-0494-11D6-A2B0-0060B0FBD872}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{697F5122-0494-11D6-A2B0-0060B0FBD872}\TypeLib\ = "{697F5000-0494-11D6-A2B0-0060B0FBD872}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5127-0494-11D6-A2B0-0060B0FBD872}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5002-0494-11D6-A2B0-0060B0FBD872}\TypeLib\ = "{697F5000-0494-11D6-A2B0-0060B0FBD872}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{52F49B50-B2DE-4852-B5A1-6336A7BCC002}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{697F5116-0494-11D6-A2B0-0060B0FBD872}\ = "DIHPAiOJunkFaxes" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5123-0494-11D6-A2B0-0060B0FBD872}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5110-0494-11D6-A2B0-0060B0FBD872}\TypeLib\ = "{697F5000-0494-11D6-A2B0-0060B0FBD872}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{697F5116-0494-11D6-A2B0-0060B0FBD872}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697F5129-0494-11D6-A2B0-0060B0FBD872}\ProxyStubClsid32 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5088 DesktopLayer.exe 5088 DesktopLayer.exe 5088 DesktopLayer.exe 5088 DesktopLayer.exe 5088 DesktopLayer.exe 5088 DesktopLayer.exe 5088 DesktopLayer.exe 5088 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4476 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4476 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4476 iexplore.exe 4476 iexplore.exe 1292 IEXPLORE.EXE 1292 IEXPLORE.EXE 1292 IEXPLORE.EXE 1292 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1436 wrote to memory of 4388 1436 regsvr32.exe 78 PID 1436 wrote to memory of 4388 1436 regsvr32.exe 78 PID 1436 wrote to memory of 4388 1436 regsvr32.exe 78 PID 4388 wrote to memory of 1216 4388 regsvr32.exe 79 PID 4388 wrote to memory of 1216 4388 regsvr32.exe 79 PID 4388 wrote to memory of 1216 4388 regsvr32.exe 79 PID 1216 wrote to memory of 5088 1216 regsvr32Srv.exe 80 PID 1216 wrote to memory of 5088 1216 regsvr32Srv.exe 80 PID 1216 wrote to memory of 5088 1216 regsvr32Srv.exe 80 PID 5088 wrote to memory of 4476 5088 DesktopLayer.exe 81 PID 5088 wrote to memory of 4476 5088 DesktopLayer.exe 81 PID 4476 wrote to memory of 1292 4476 iexplore.exe 82 PID 4476 wrote to memory of 1292 4476 iexplore.exe 82 PID 4476 wrote to memory of 1292 4476 iexplore.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6976a152e57713286649d7b0f0f4368630f8ba92076a35be68436d4a0505650d.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\6976a152e57713286649d7b0f0f4368630f8ba92076a35be68436d4a0505650d.dll2⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\regsvr32Srv.exeC:\Windows\SysWOW64\regsvr32Srv.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4476 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1292
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD583f5a64a268f21c7c6d6dd54ce8a88c2
SHA161376a625d7d389c5c1646aa534f1ef3135da2f4
SHA256c0b96c44a00557b60df0fa0ac9b129ac07d5b93c669f4a3c98276d113ff6962c
SHA5124cddbd07e10c93d23efd1560084f0482520f90f252d6e90380222f0d13ac3bf3587fbddb3033a6b06d550838731db072001197cb3283e4686f5b8bd5b6d894f1
-
Filesize
56KB
MD583f5a64a268f21c7c6d6dd54ce8a88c2
SHA161376a625d7d389c5c1646aa534f1ef3135da2f4
SHA256c0b96c44a00557b60df0fa0ac9b129ac07d5b93c669f4a3c98276d113ff6962c
SHA5124cddbd07e10c93d23efd1560084f0482520f90f252d6e90380222f0d13ac3bf3587fbddb3033a6b06d550838731db072001197cb3283e4686f5b8bd5b6d894f1
-
Filesize
56KB
MD583f5a64a268f21c7c6d6dd54ce8a88c2
SHA161376a625d7d389c5c1646aa534f1ef3135da2f4
SHA256c0b96c44a00557b60df0fa0ac9b129ac07d5b93c669f4a3c98276d113ff6962c
SHA5124cddbd07e10c93d23efd1560084f0482520f90f252d6e90380222f0d13ac3bf3587fbddb3033a6b06d550838731db072001197cb3283e4686f5b8bd5b6d894f1
-
Filesize
56KB
MD583f5a64a268f21c7c6d6dd54ce8a88c2
SHA161376a625d7d389c5c1646aa534f1ef3135da2f4
SHA256c0b96c44a00557b60df0fa0ac9b129ac07d5b93c669f4a3c98276d113ff6962c
SHA5124cddbd07e10c93d23efd1560084f0482520f90f252d6e90380222f0d13ac3bf3587fbddb3033a6b06d550838731db072001197cb3283e4686f5b8bd5b6d894f1