Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
166s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2022, 20:59
Static task
static1
Behavioral task
behavioral1
Sample
434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe
Resource
win7-20221111-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe
-
Size
212KB
-
MD5
52d8c58d4c6e9581d4459b40b99c488c
-
SHA1
e83a1724be4af196018ec1658f9cb85a1178a7ad
-
SHA256
434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51
-
SHA512
a58d6c135028d627d4f0edffcb422dffe9fba8000f601d6ce23c1e6810452bec1f4fc07fb5cee1b35f6db8dfc00681580d2ee3a8018e7e369f60e6a17af1a77c
-
SSDEEP
6144:dcyyU/A5rZRLEhFTnRa26s+Wdz8V7Wdfwn1nbmuSDm+:dHp/urb4A1WdBfl
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1416 Program Files44S0N6.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\d.ico 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe File opened for modification \??\c:\Program Files\Common Files\t.ico 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EEB029C9-6B94-11ED-BF5F-621DF61BAEF5} = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 404144e6a1ffd801 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303a74eba1ffd801 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eef4ddb70fa9964f8bf69d510f57c1eb0000000002000000000010660000000100002000000031f5897b266a1443875e531b65bbd50c865ced5ed97f2fcdc60ed2eba7671b45000000000e800000000200002000000043959af602625ca5219d381d9d81d46ab46fc62814d598e248c4f7e4a3dd1aa020000000657ebaf13b17d597818a6847f57b35f9269c5b8be03ab59da73dfd997448261240000000c1b9d3b2c758cbc2052227980b8ad34dde566f5e0cd43450feb6944e8418a34b64f2dc004b62c2157535a351ae574123a27e220e03b7e4969877aef651ab01ed IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eef4ddb70fa9964f8bf69d510f57c1eb0000000002000000000010660000000100002000000000ea12e2a6125836274c35b063e7064329127bbb166e839fd6b16dd82a3f297a000000000e8000000002000020000000d19b9a0afc1a22999c91e803e06ccd78e5afee3b2fd840ca563031d0b4bb2b4d20000000b19ea7c4dec9f0a7ac8055567ab507d434b85c6ef1eb34c676e273f7b913002040000000c9cbc61ea5ebd6a44696f9a96209c18595abdc4a24ee0cdf63b9cb13effc4cf56a8d81d9db5699dc7a4b5673a119e771f3c7488c7140505e5400495858c27bde IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe -
Modifies registry class 60 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command\ = "IEXPLORE.EXE http://www.loliso.com/?1193" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.h35 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hli\ = "hli" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\ 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command\ = "IEXPLORE.EXE http://www.piaofang.net/?1193" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,139" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hpf\ = "hpf" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hli 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command\ = "IEXPLORE.EXE http://www.henbucuo.com/?1193" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\ 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hdh 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hyx\ = "hyx" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hpf 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon\ = "c:\\Program Files\\Common Files\\t.ico" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command\ = "IEXPLORE.EXE http://www.t17t.com/?1193" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\ 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE,0" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.h35\ = "h35" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command\ = "IEXPLORE.EXE http://taobao.loliso.com/?1193" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon\ = "c:\\Program Files\\Common Files\\d.ico" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\ 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hyx 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htb\ = "htb" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hdh\ = "hdh" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,41" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\ 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htb 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command\ = "IEXPLORE.EXE http://www.d91d.com/?1193" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\ 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,130" 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1292 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4236 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe 1416 Program Files44S0N6.exe 1292 IEXPLORE.exe 1292 IEXPLORE.exe 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4236 wrote to memory of 1416 4236 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe 84 PID 4236 wrote to memory of 1416 4236 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe 84 PID 4236 wrote to memory of 1416 4236 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe 84 PID 1416 wrote to memory of 1292 1416 Program Files44S0N6.exe 87 PID 1416 wrote to memory of 1292 1416 Program Files44S0N6.exe 87 PID 1292 wrote to memory of 2092 1292 IEXPLORE.exe 88 PID 1292 wrote to memory of 2092 1292 IEXPLORE.exe 88 PID 1292 wrote to memory of 2092 1292 IEXPLORE.exe 88 PID 1416 wrote to memory of 1284 1416 Program Files44S0N6.exe 89 PID 1416 wrote to memory of 1284 1416 Program Files44S0N6.exe 89 PID 4236 wrote to memory of 764 4236 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe 90 PID 4236 wrote to memory of 764 4236 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe 90 PID 4236 wrote to memory of 764 4236 434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe"C:\Users\Admin\AppData\Local\Temp\434c5c33590544500f75307d3e9b6fd5a7aea00ec76fc47dd957d6c4dc067a51.exe"1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\Program Files44S0N6.exe"c:\Program Files44S0N6.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/vplay.php3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1292 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092
-
-
-
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/PPTV(pplive)_forjieku_977.html3⤵
- Modifies Internet Explorer settings
PID:1284
-
-
-
C:\Windows\SysWOW64\WScript.ExeWScript.Exe jies.bak.vbs2⤵PID:764
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5b43bfb7245082ddb832d6a99d4962768
SHA1645e73c5b62904b106d4c992677a35b2ec44541a
SHA2562a522ce10973755abf804b766a0bfc6e8f5386dfdfd0aefeb1b5c580a98c405e
SHA51294a535f81c3010593106e875880e79b8b49ff7e05869b38a4a43986b7511857e55cf1232cf5e9f990c3c1e01e21c19d32e7c13a3250b8a776ac35a7b2625962d
-
Filesize
486B
MD59cc04eb9c773aac48de2cb3a8813c51b
SHA148910a6cbdae6a8e0d97887e123e92ce276e04d2
SHA2565e4956b6c3a17ea2fee006e43f48d8f99441e31e42b3333930ac087ca4256434
SHA512dcdbb164616993280e37028a58b782e0342cc55120fc92a3a509c3534989102779bd1628c81d0c6f8d5ef980835f544faf53de805411042fe67c4ae001d96bff
-
Filesize
36KB
MD5b43bfb7245082ddb832d6a99d4962768
SHA1645e73c5b62904b106d4c992677a35b2ec44541a
SHA2562a522ce10973755abf804b766a0bfc6e8f5386dfdfd0aefeb1b5c580a98c405e
SHA51294a535f81c3010593106e875880e79b8b49ff7e05869b38a4a43986b7511857e55cf1232cf5e9f990c3c1e01e21c19d32e7c13a3250b8a776ac35a7b2625962d