737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe
Size

1001KB
MD5

6e2d9e8a2ab7cc73d535109d46f5ccb8
SHA1

5a96efe70d5bb0d38f0f7b4b25b188deb582103f
SHA256

737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce
SHA512

cf8f6d862fa620cb63fd658973b3a1f976a95a3b620e4b2712f26e54a4607b9f15caf83cd842bde9aebce60a25c75335d3d067541cb548b5ea6b2865c371f4eb
SSDEEP

24576:wBRk6WvFq9FStU4gf2EW5A2DJr/kS4vGIk6v3Hbo:wUvF4h43Dp/wPHs

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4484	Server_Setup.exe
2568	Hacker.com.cn.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\Hacker.com.cn.exe	Server_Setup.exe
File created	C:\Windows\52.gif	737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe
File opened for modification	C:\Windows\52.gif	737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe
File created	C:\Windows\58.gif	737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe
File opened for modification	C:\Windows\58.gif	737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe
File created	C:\Windows\Server_Setup.exe	737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe
File opened for modification	C:\Windows\Server_Setup.exe	737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe
File created	C:\WINDOWS\Hacker.com.cn.exe	Server_Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E1064572-7534-11ED-AECB-72E5C3FA065D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3050566368"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3090411751"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005c29b94109d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377075526"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3050566368"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000897"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000897"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000897"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3090411751"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000897"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000006412d748690249b188329170d4b78600000000020000000000106600000001000020000000f65c7bca3ca3d70ba268c4f206f5889b084e85a094321c5770895525fa35b6fa000000000e8000000002000020000000b924bfecb7353d297589790fba4aad66b0b02c51ee90d2d6077ef7f4ef9bc1a420000000c3c70aea2f0e3b446c7091f2c9fa9e7042039ac7d80acc30fba98d3248f7f28640000000afc7d0f74343819671071c1d0bf4288b4b020bb6b2f00f81996318aacf8d4d6398c1ad9bd4460553e7b55366689625dc45ea2db0c0cab7edccc3f0c9b0efc62b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000006412d748690249b188329170d4b786000000000200000000001066000000010000200000009ee71df60fac1eee27ac00c5b0d389391a94abf3bbceba0d939a15385544f054000000000e8000000002000020000000a8dfeaf86853d5848f223ca48dbc0d25311ba1eb01ebe74bf1e4f80e40e796d420000000e848c932b490cf3b37361f3f0ebd7278a5a49731c8570c386fec7f5d98a1e842400000003f4f6556d396852ba4652cfa2cecb84526a95f3ed3e1001fd88e8cd5956fa781426ffb2b4a02c922ce04a47c6258c5b7a2ada93ff69815325041a167c666b2d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000897"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30447fb94109d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3050566368"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000897"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E119598F-7534-11ED-AECB-72E5C3FA065D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3050566368"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4832	iexplore.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	Server_Setup.exe
Token: SeDebugPrivilege	2568	Hacker.com.cn.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2568	Hacker.com.cn.exe
4832	iexplore.exe
3092	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4832	iexplore.exe
4832	iexplore.exe
3092	iexplore.exe
3092	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
1232	IEXPLORE.EXE
1232	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3092	2168	737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe	79
PID 2168 wrote to memory of 3092	2168	737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe	79
PID 2168 wrote to memory of 4832	2168	737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe	80
PID 2168 wrote to memory of 4832	2168	737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe	80
PID 4832 wrote to memory of 2216	4832	iexplore.exe	81
PID 4832 wrote to memory of 2216	4832	iexplore.exe	81
PID 4832 wrote to memory of 2216	4832	iexplore.exe	81
PID 3092 wrote to memory of 1232	3092	iexplore.exe	83
PID 3092 wrote to memory of 1232	3092	iexplore.exe	83
PID 3092 wrote to memory of 1232	3092	iexplore.exe	83
PID 2168 wrote to memory of 4484	2168	737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe	82
PID 2168 wrote to memory of 4484	2168	737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe	82
PID 2168 wrote to memory of 4484	2168	737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe	82
PID 2568 wrote to memory of 3124	2568	Hacker.com.cn.exe	85
PID 2568 wrote to memory of 3124	2568	Hacker.com.cn.exe	85

C:\Users\Admin\AppData\Local\Temp\737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe
"C:\Users\Admin\AppData\Local\Temp\737c6a1212aa7f80fa49ac37872277b12c84f0dfcc2645733d2f6504fc4563ce.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Windows\52.gif
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3092 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1232
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Windows\58.gif
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4832 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2216
- C:\Windows\Server_Setup.exe
  "C:\Windows\Server_Setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4484

C:\WINDOWS\Hacker.com.cn.exe
C:\WINDOWS\Hacker.com.cn.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:3124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
ac572cbbc82d6d652cdbe2596aeac4ee

SHA1
a631b27cf33fe134f42ed411d7ea06c21df41ad5

SHA256
50b6d8f62150a7bd25fb3e462130e8e054a0f1fb619487e8c426a4c8bf6bdca8

SHA512
070095ec83e4eeccae5dcbadcb3132f08fd0aac50badbc42cb72691236b6cfcdf14ce275fb1bf5511896bb4dd25c2121e044341003c1a507be8fabc0b2b1bfff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
ac572cbbc82d6d652cdbe2596aeac4ee

SHA1
a631b27cf33fe134f42ed411d7ea06c21df41ad5

SHA256
50b6d8f62150a7bd25fb3e462130e8e054a0f1fb619487e8c426a4c8bf6bdca8

SHA512
070095ec83e4eeccae5dcbadcb3132f08fd0aac50badbc42cb72691236b6cfcdf14ce275fb1bf5511896bb4dd25c2121e044341003c1a507be8fabc0b2b1bfff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
d0841befc978ecc9c39e76282cc344c5

SHA1
04985576bd14143092b86a15ec1e939f67c5a612

SHA256
ba90ac662eaa5b61bb1048f8e18dd94cd3fc51239928746f8e1c3a34dc81a342

SHA512
61b375cdbda4246a7eb3f3b9d5db0bc8581ba97aa9bce682fa837fb88da66a6dbe9544fa9407d6e8f2e241e86f96278cc7f28995af8d866759f0f0ce827501aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
fd13cf1f67ed5c64521c42b9185fc6d5

SHA1
ebe00dcb4149589722ea0ea01daa82ebe7f2d228

SHA256
654dfe73d556664dc52abcd46ab8e6ac28c66a303db5644a24c7ea80baec35b6

SHA512
50e9df0358249f01511e2cfad0e7eedb93cebbfd941b49b11d39e17359d6f9ea0d0f4d7de33ae6c1e6afe8b0edc1cba406693af2dfe48961d54662938020ff6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E1064572-7534-11ED-AECB-72E5C3FA065D}.dat

Filesize
5KB

MD5
46aa9eed6ae6d53b5490a2284cd97b6f

SHA1
59e0f652fbd6216483da79d0cac7d96262f81445

SHA256
d3d940c2b56a76a557ca3039937ad6b61e4c3fb0780966d3498ea594743b6775

SHA512
6533b53f928a0f5bad254905d1303dec2cf4c9927d1849be9c7425a59b263de75250a5e1c537fd8b3d84c2d09da046d93453c5e5b0301049622cd45432e4ddb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E119598F-7534-11ED-AECB-72E5C3FA065D}.dat

Filesize
4KB

MD5
9edb0c78fd2c01c1419d731973239612

SHA1
5ef13324993b3543b9beea24e3cd199779152daf

SHA256
03a521db24399b6474ffce93ed088031405c300160df3682a69fd46fc73a20b1

SHA512
42ca26bca0b3ea5313160f9db27553eb2e903953e53f9526174133ca87dfc146f31fb5c7a26c8ad80bf44b08d5e42615d18ffe01b3bd9afd1097bd8c6202146a

Download Submit
C:\WINDOWS\Hacker.com.cn.exe

Filesize
743KB

MD5
d73581301782149d24383e602ea604b3

SHA1
96b73a0255647f1e5d36041c91d8333dede16aec

SHA256
70f71fbfcab11a348aec03075d768530cacc29f6fe2fcf626e0a9a1fab87cde8

SHA512
d9c4d13b1db7b9609ac5107200e786149a5db351c6cabfbb1d8f0734dfbd866a8cd8edc080ebd0d07bf23968850ed4ddb60c51d078acae9c92f8892c8bcc00fb

Download Submit
C:\Windows\52.gif

Filesize
218KB

MD5
9f8c87ada1d5384d534a30dd74a87a46

SHA1
a9afdbdf992cec7d2d305bfdf89d59d2dcd2133d

SHA256
936cbbb74fa6642ed2f6218cfd1f0d6e465e126726653445296b398aa4e8f276

SHA512
4e0a3f36d54e0f34363556fe9f06b4ea95193e879a8ab3acc12044b1e9678e58f901a3e632a3d332e10d42a83325699b85d94bb31f08f71252924165ff35d6e1

Download Submit
C:\Windows\58.gif

Filesize
17KB

MD5
41bbaf8278772dc824bb8ea9fdbc154f

SHA1
4fac07e27ac17a67374a083e5a907ca4d5314729

SHA256
150adea695face4e177ab81a93e0ec557df23cf7a842edd0a1e9edf54ce902f8

SHA512
365acbe1d88023fc541c8f0083a88c20d9c5ff5171f1838c012fc4202870a8ff678e8d8e0b7eabd7b924a7857c2b20b8111ff6a2d28c5993f5e099210cde82af

Download Submit
C:\Windows\Hacker.com.cn.exe

Filesize
743KB

MD5
d73581301782149d24383e602ea604b3

SHA1
96b73a0255647f1e5d36041c91d8333dede16aec

SHA256
70f71fbfcab11a348aec03075d768530cacc29f6fe2fcf626e0a9a1fab87cde8

SHA512
d9c4d13b1db7b9609ac5107200e786149a5db351c6cabfbb1d8f0734dfbd866a8cd8edc080ebd0d07bf23968850ed4ddb60c51d078acae9c92f8892c8bcc00fb

Download Submit
C:\Windows\Server_Setup.exe

Filesize
743KB

MD5
d73581301782149d24383e602ea604b3

SHA1
96b73a0255647f1e5d36041c91d8333dede16aec

SHA256
70f71fbfcab11a348aec03075d768530cacc29f6fe2fcf626e0a9a1fab87cde8

SHA512
d9c4d13b1db7b9609ac5107200e786149a5db351c6cabfbb1d8f0734dfbd866a8cd8edc080ebd0d07bf23968850ed4ddb60c51d078acae9c92f8892c8bcc00fb

Download Submit
C:\Windows\Server_Setup.exe

Filesize
743KB

MD5
d73581301782149d24383e602ea604b3

SHA1
96b73a0255647f1e5d36041c91d8333dede16aec

SHA256
70f71fbfcab11a348aec03075d768530cacc29f6fe2fcf626e0a9a1fab87cde8

SHA512
d9c4d13b1db7b9609ac5107200e786149a5db351c6cabfbb1d8f0734dfbd866a8cd8edc080ebd0d07bf23968850ed4ddb60c51d078acae9c92f8892c8bcc00fb

Download Submit