Analysis
-
max time kernel
201s -
max time network
217s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:37
Static task
static1
Behavioral task
behavioral1
Sample
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe
Resource
win10v2004-20220812-en
General
-
Target
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe
-
Size
5.7MB
-
MD5
f55559f66229a8cfb591e0bcaa54c109
-
SHA1
17006709ee364b356e564a01fd70107c69691573
-
SHA256
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8
-
SHA512
2ae90705029c37b3cead09d64cfd18bffb5507cd7def80b4a87a4f8759f205b4b9cbb86bfea090a71b98948b638c0ea35026da3925a5a5be082087791c3089de
-
SSDEEP
98304:J2llez/udrnJll4dP5aSGie4udyO4Okjsstz8V8bHxLcIm:J2lUzYIoSGz4ud11/qiupm
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ÄæսĩÈÕ¸¨Öú.exepid process 4188 ÄæսĩÈÕ¸¨Öú.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ÄæսĩÈÕ¸¨Öú.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation ÄæսĩÈÕ¸¨Öú.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
Processes:
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exepid process 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe -
Drops file in Windows directory 1 IoCs
Processes:
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exedescription ioc process File created C:\WINDOWS\ÄæսĩÈÕ¸¨Öú.exe 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2825914361" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C6961C5F-6D49-11ED-B696-5E3721E937B7} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376204899" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998870" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2825914361" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998870" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000091990383a8230041b5b727ebdf90234f00000000020000000000106600000001000020000000ffb4395c543f15a85c5ca38d2c0ed8a6b048322945ec12fc68aca0da03b61e44000000000e8000000002000020000000c3633110b2ff41e9afb827d9c73869a47fbde4cf60911ef726ad4b8f36d3e02a2000000000671294878ab7d2c9f02151d25da1854dd12ef24aed7a17a77a8f76e54e8c814000000023e7957d059c2645c8c23a5e65470bf4d2101b5b774ce1cb46cccf323fb316214616f88b6035538129de962dfa0bab9124c335b7ea2449e9f7109a22c914ee12 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000091990383a8230041b5b727ebdf90234f00000000020000000000106600000001000020000000ba3733823cb152c7440edcd618217a0b8c3ec8d7775c5c1e2997cccd21f2daf3000000000e80000000020000200000001012cd695009a4f8e11da37291826ad3b30f98bbd21ba2cc5a26ad4d5069eb2720000000b502626bec96254df9f7b78627fca4bd483e3bfb8b493e2cf14a89f89f2840f940000000f0b94bfc9338d9cc4db3ee426f00addbbdd3f1d3d8c138d77062598ded77d10ede8133fcffe89d160db9b9feb27239ed3e17d94e4ec64dc59733eeb8e50674c2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c49ea95601d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2846384086" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2846539815" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998870" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07daea25601d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998870" IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1220 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exedescription pid process Token: 33 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe Token: SeIncBasePriorityPrivilege 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1220 iexplore.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exeÄæսĩÈÕ¸¨Öú.exeiexplore.exeIEXPLORE.EXEpid process 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 4188 ÄæսĩÈÕ¸¨Öú.exe 4188 ÄæսĩÈÕ¸¨Öú.exe 4188 ÄæսĩÈÕ¸¨Öú.exe 4188 ÄæսĩÈÕ¸¨Öú.exe 4188 ÄæսĩÈÕ¸¨Öú.exe 1220 iexplore.exe 1220 iexplore.exe 4648 IEXPLORE.EXE 4648 IEXPLORE.EXE 4648 IEXPLORE.EXE 4648 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exeÄæսĩÈÕ¸¨Öú.exeiexplore.exedescription pid process target process PID 996 wrote to memory of 4188 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe ÄæսĩÈÕ¸¨Öú.exe PID 996 wrote to memory of 4188 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe ÄæսĩÈÕ¸¨Öú.exe PID 996 wrote to memory of 4188 996 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe ÄæսĩÈÕ¸¨Öú.exe PID 4188 wrote to memory of 1220 4188 ÄæսĩÈÕ¸¨Öú.exe iexplore.exe PID 4188 wrote to memory of 1220 4188 ÄæսĩÈÕ¸¨Öú.exe iexplore.exe PID 1220 wrote to memory of 4648 1220 iexplore.exe IEXPLORE.EXE PID 1220 wrote to memory of 4648 1220 iexplore.exe IEXPLORE.EXE PID 1220 wrote to memory of 4648 1220 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe"C:\Users\Admin\AppData\Local\Temp\2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\WINDOWS\ÄæսĩÈÕ¸¨Öú.exeC:\WINDOWS\ÄæսĩÈÕ¸¨Öú.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.moriwg.net3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1220 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4648
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5a42abb21be3940a88a73771b18ed0f35
SHA1de12f2f619852ef135ee726614c43c2033ec5743
SHA256edaf1fb1f6ca2a0caf5f4d85b3f13507bd5df4971fa9ea8a6e08c1227f1ec667
SHA512c1f775deb2bcb2e0c48ed74dec1cd95f34690ca16d6465175d52d60ae45e746201cc608a58b6f8f080b7e6a7893993b61093c7d9ff63fa735ebaba61ddd0ebf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
434B
MD53f310b3c8e7421988801b40d7be46666
SHA1e5ddaf1d23c899d69bb0412d1098c040b2cf84cf
SHA25665f156a1bd559b3406153a8f7c8754685e048052953445bd5962223367e469eb
SHA5127e6d7cfdc88682275154d213dcbf806c9c278382727c6ca22a7391ff1bdcc659139b550ccbc2b5078b1a06e80c09c2d82b264b6d347f356768c62d9e8901657b
-
C:\WINDOWS\ÄæսĩÈÕ¸¨Öú.exeFilesize
1.5MB
MD591c1583ee24aa5791e4cf2a54cf802d7
SHA1b54d05d7be32a5595aa1fb1941cc77e3712a3013
SHA256c30acd06f8aa69501b9ef174dd7ba0f32fde4f48a94a7b21e998a133280797d7
SHA5127f9a46dab0fcf7deaeabef50689d834dacd650d83bcc6cbacb3e3b398c352d9499858e736f0342b2acae1ace6adcf7d9cd8624d4643930ec8d4d4eccbc778f77
-
C:\Windows\ÄæսĩÈÕ¸¨Öú.exeFilesize
1.5MB
MD591c1583ee24aa5791e4cf2a54cf802d7
SHA1b54d05d7be32a5595aa1fb1941cc77e3712a3013
SHA256c30acd06f8aa69501b9ef174dd7ba0f32fde4f48a94a7b21e998a133280797d7
SHA5127f9a46dab0fcf7deaeabef50689d834dacd650d83bcc6cbacb3e3b398c352d9499858e736f0342b2acae1ace6adcf7d9cd8624d4643930ec8d4d4eccbc778f77
-
memory/996-136-0x0000000076F00000-0x00000000770A0000-memory.dmpFilesize
1.6MB
-
memory/996-1481-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/996-1482-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/996-137-0x0000000075DE0000-0x0000000075E5A000-memory.dmpFilesize
488KB
-
memory/996-132-0x0000000000400000-0x00000000009B5000-memory.dmpFilesize
5.7MB
-
memory/996-1486-0x0000000000400000-0x00000000009B5000-memory.dmpFilesize
5.7MB
-
memory/996-134-0x0000000075800000-0x0000000075A15000-memory.dmpFilesize
2.1MB
-
memory/996-133-0x00000000776E0000-0x0000000077883000-memory.dmpFilesize
1.6MB
-
memory/4188-1483-0x0000000000000000-mapping.dmp