4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac

Analysis

max time kernel
127s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Size

1.2MB
MD5

924db19b444d0416158d90bca8f62cb1
SHA1

4571b8ae2f24c9a13efc0435ccb1281ef34ff8ce
SHA256

4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac
SHA512

f7ac4b33676b06780a75b7365fa2c9cf45e47a359786ec6949883e6bfd91b0ae489a806dbc6eaf57e6bcb706ce3bcebe1829b09bcd9522f132a3ec3bd25dbcc0
SSDEEP

12288:/DMnvPg/Cr+jeEfijSpRoFRQa2Z7yqZX6kYud+ZPVPPDWV+hJ5Yf:L8A/6cRfij0ol2ttNYud+ZPp7p

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373995869"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993727"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{76507A50-5932-11ED-89AC-520B3B914C01} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1526205216"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1327611638"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1526362188"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993727"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993727"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1327611638"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993727"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{777A3083-06F7-4AD3-940E-82D5BAA2C5DA}\1.0\HELPDIR	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{777A3083-06F7-4AD3-940E-82D5BAA2C5DA}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C2BD2E3C-E05F-49D8-A0AC-A7DB58DED9B8}\TypeLib\Version = "1.0"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7DA33DE-2392-4663-A99D-D4F13F7C7839}	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68C01328-523A-48CE-A249-A5D057309121}\ProxyStubClsid32	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{777A3083-06F7-4AD3-940E-82D5BAA2C5DA}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2BD2E3C-E05F-49D8-A0AC-A7DB58DED9B8}\TypeLib	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7DA33DE-2392-4663-A99D-D4F13F7C7839}\TypeLib\Version = "1.0"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\runapp.veApi\Clsid	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EBF9144-C525-42FF-B499-C496C909FD83}\ProgID	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{125F2A7A-A23A-46AD-BE0B-50B1C7CE2CC7}\LocalServer32	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE9E3A8C-FA3E-487D-81A8-DC26C1D113B9}	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\runapp.veApi	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A52FC39D-429C-4371-AFE7-07122D128B94}\	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\runapp.veFile\Clsid	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C2BD2E3C-E05F-49D8-A0AC-A7DB58DED9B8}	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68C01328-523A-48CE-A249-A5D057309121}\TypeLib	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{777A3083-06F7-4AD3-940E-82D5BAA2C5DA}\1.0\0	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68C01328-523A-48CE-A249-A5D057309121}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{125F2A7A-A23A-46AD-BE0B-50B1C7CE2CC7}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68C01328-523A-48CE-A249-A5D057309121}\TypeLib\Version = "1.0"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE9E3A8C-FA3E-487D-81A8-DC26C1D113B9}\ProxyStubClsid32	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE9E3A8C-FA3E-487D-81A8-DC26C1D113B9}\TypeLib\Version = "1.0"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EBF9144-C525-42FF-B499-C496C909FD83}\ProgID\ = "runapp.veApi"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{125F2A7A-A23A-46AD-BE0B-50B1C7CE2CC7}\TypeLib\ = "{777A3083-06F7-4AD3-940E-82D5BAA2C5DA}"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C2BD2E3C-E05F-49D8-A0AC-A7DB58DED9B8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7DA33DE-2392-4663-A99D-D4F13F7C7839}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7DA33DE-2392-4663-A99D-D4F13F7C7839}\TypeLib	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\runapp.veMisc	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE9E3A8C-FA3E-487D-81A8-DC26C1D113B9}\TypeLib	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EBF9144-C525-42FF-B499-C496C909FD83}\LocalServer32	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EBF9144-C525-42FF-B499-C496C909FD83}\TypeLib\ = "{777A3083-06F7-4AD3-940E-82D5BAA2C5DA}"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{125F2A7A-A23A-46AD-BE0B-50B1C7CE2CC7}\TypeLib	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7DA33DE-2392-4663-A99D-D4F13F7C7839}\TypeLib\Version = "1.0"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68C01328-523A-48CE-A249-A5D057309121}\ProxyStubClsid32	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68C01328-523A-48CE-A249-A5D057309121}	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE9E3A8C-FA3E-487D-81A8-DC26C1D113B9}\ = "IveApi"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C2BD2E3C-E05F-49D8-A0AC-A7DB58DED9B8}\TypeLib\ = "{777A3083-06F7-4AD3-940E-82D5BAA2C5DA}"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2BD2E3C-E05F-49D8-A0AC-A7DB58DED9B8}	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\runapp.veApi\	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{125F2A7A-A23A-46AD-BE0B-50B1C7CE2CC7}\ProgID\ = "runapp.veFile"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7DA33DE-2392-4663-A99D-D4F13F7C7839}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68C01328-523A-48CE-A249-A5D057309121}\TypeLib	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EBF9144-C525-42FF-B499-C496C909FD83}\Version	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EBF9144-C525-42FF-B499-C496C909FD83}\Version\ = "1.0"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\runapp.veMisc\Clsid	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\runapp.veFile	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2BD2E3C-E05F-49D8-A0AC-A7DB58DED9B8}\TypeLib\ = "{777A3083-06F7-4AD3-940E-82D5BAA2C5DA}"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EBF9144-C525-42FF-B499-C496C909FD83}\	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EBF9144-C525-42FF-B499-C496C909FD83}\TypeLib	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{80CFBE22-7CED-4A89-B601-AAD10F00C88A}\TypeLib\ = "{777A3083-06F7-4AD3-940E-82D5BAA2C5DA}"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A52FC39D-429C-4371-AFE7-07122D128B94}\TypeLib	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{125F2A7A-A23A-46AD-BE0B-50B1C7CE2CC7}\ = "veObjects Object"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{125F2A7A-A23A-46AD-BE0B-50B1C7CE2CC7}\Version\ = "1.0"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C2BD2E3C-E05F-49D8-A0AC-A7DB58DED9B8}\ = "IveFile"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2BD2E3C-E05F-49D8-A0AC-A7DB58DED9B8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE9E3A8C-FA3E-487D-81A8-DC26C1D113B9}\TypeLib	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EBF9144-C525-42FF-B499-C496C909FD83}	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7DA33DE-2392-4663-A99D-D4F13F7C7839}\TypeLib	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{80CFBE22-7CED-4A89-B601-AAD10F00C88A}\	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{80CFBE22-7CED-4A89-B601-AAD10F00C88A}\Version\ = "1.0"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A52FC39D-429C-4371-AFE7-07122D128B94}\Version	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2BD2E3C-E05F-49D8-A0AC-A7DB58DED9B8}\ = "IveFile"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68C01328-523A-48CE-A249-A5D057309121}\ = "IveMisc"	4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
4888	IEXPLORE.EXE
4888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 4888	2512	iexplore.exe	81
PID 2512 wrote to memory of 4888	2512	iexplore.exe	81
PID 2512 wrote to memory of 4888	2512	iexplore.exe	81

C:\Users\Admin\AppData\Local\Temp\4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
"C:\Users\Admin\AppData\Local\Temp\4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe"
1⤵
- Modifies registry class
PID:4512

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:5080

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
deabbdcb221537d48aed54816739f367

SHA1
9ce0f0d21d9bd08823732047e19edbbd909396bc

SHA256
494de69d83714780f68a1e6871716f3a4a10835e90b4f96e48610c3e8f39e9cf

SHA512
95a80c34ddb83e74e51e5d0884dc7433de78b956db8fb2b1fb54e0f158283991edacafd3e7653161767a69f25f9cf537cc1a654d20e3f27bbc54588b3b4bf5e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
df0dd13b4dd11d7f8044e981d3300628

SHA1
74a3db5ffdf07ee17b601ec9a07fbc86d0da4eaa

SHA256
d5efe07023590f04b206a9950a2a3ecd35a4d93d6019a1dbe3975ca799b095f5

SHA512
f68fbbdc8ed866ea9e574a127740379402b590523cff626345cf59a0cdaf32688a0613f494f405071bc7405a235ceb34d583eed5e0ce931b824ed1ce9925c69f

Download Submit