Analysis
-
max time kernel
150s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 15:54
Behavioral task
behavioral1
Sample
89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe
-
Size
290KB
-
MD5
8b006397b2bfa549489c892db33adafc
-
SHA1
037ffe883a1e13f265ea388f50a2f51732819fe1
-
SHA256
89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0
-
SHA512
b02e4522cd39de2b2bc3fb8aa4415ab04c760edb32d485b52a50b9a78c85e404c8ad696cd0d8ead9bf36e8c86fa2f434ad24f4470e459ffa54257ce0ae495f4f
-
SSDEEP
6144:5y0X3p1xbLtQAFcHj+bWURfT1OQiBLpBF/mZH1TQEuvLWNSNWQ5a3Ws9:BXDliAuHjItfT1hiBLpBFs5qQ8WIad9
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377122120" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da0000000002000000000010660000000100002000000070269bd53aa5529c06e03d1295b64e140f34da47f9c18f024d68bb50ed78e5fe000000000e8000000002000020000000c0fccd9268f37fc4e399a007707399c13c6d166ac9863a74a809cb2465606f24200000003f7d182de2d2dd838e9e12ac38646f39795a193e121dad9cb077905548b4cf4f40000000ebbb2dd8c5295283c667147285d3284ac0afb7b8a11a28f3d73978e34bf5f58ee71d025a94461703eb144f3bebb823416ef2f87310420c04f974abd66903c1fd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d5ae59ae09d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da00000000020000000000106600000001000020000000283c890256d4027f15adb45496310171c664991c25237ea11897778887768ca4000000000e8000000002000020000000211a2af9bf21f93303c38f0aafebebdd270571103d38de37dbcba5cc868a81c490000000377f5040ddd072fd5a8207eb0c4c16443cd3290504dedb367f0be51d4a27b166d06dbb4b4fd50140beaed43b2c5254e982de0d06b513979f7994a272a97233eef8a0ba376f5b94dae2a786db7d0977aef66dc81f072c6046ec787e372a6de076ee34007a616f209a43881db95c59f826de08e190b7e6a8a306e237c96ac2a4af87f1e651d82233f2c6abd5647a115b5040000000bc44d3320597e7cf2fe462102868bcceb386c535614439b6e28657b198cfa0186c425f902d10da551b686c6dd0485df866062e38bc9856e4e2c3815e14ed3bf0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{512C65D1-75A1-11ED-AD63-CED6325FB9F2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2024 iexplore.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 2024 iexplore.exe 2024 iexplore.exe 1788 IEXPLORE.EXE 1788 IEXPLORE.EXE 1788 IEXPLORE.EXE 1788 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2024 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 28 PID 2040 wrote to memory of 2024 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 28 PID 2040 wrote to memory of 2024 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 28 PID 2040 wrote to memory of 2024 2040 89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe 28 PID 2024 wrote to memory of 1788 2024 iexplore.exe 30 PID 2024 wrote to memory of 1788 2024 iexplore.exe 30 PID 2024 wrote to memory of 1788 2024 iexplore.exe 30 PID 2024 wrote to memory of 1788 2024 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe"C:\Users\Admin\AppData\Local\Temp\89acd39cf81b19adf88a148067e4bae6125fa598413ae184fcf7acaffef36ec0.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.k25.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1788
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD5f1d2be0aca735524382c7f41764aa63c
SHA155ee7b9c57a0ddc8415eb8d8db6e78f1874adeb2
SHA2562a824d4ef243ccd2c51c8497e57f0cbfcd9293b8bfab10732113efb71d031fbe
SHA512701c93b8a9c8559b29cd74f624a25eee7b25cfe0c2087bbd7e3b0d7a972969a2356d3399e063227be27fcbc1dc759119c26ebcd0a92eea11bc091240956b1642