Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2023, 08:56
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe
-
Size
115KB
-
MD5
a57eaa2ea5075b1d8f2b95e6963f6100
-
SHA1
acd594d17df8533e8e70ef54c0b6133d93571239
-
SHA256
4a7777b80972e273adedcef4e8db13dc6267cf1114b23ab29e9e613a44299a9a
-
SHA512
f357caf639d9fdf3d44c8d74738f2afb1d38059a0f5267241cc65a39d71204bcdbe9b4a30ca3be75803dd9f75ef2e68b2321110b12c231418600af586bb3c227
-
SSDEEP
3072:xqBFJLzgOJJ6Ia0fe+CUGXQV8HiKxh2pvFE:wPdZxfvtGXQV8CyEfE
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe -
Deletes itself 1 IoCs
pid Process 2384 explorer.exe -
Executes dropped EXE 1 IoCs
pid Process 5088 FunshionInstall_C105806.exe -
Loads dropped DLL 18 IoCs
pid Process 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 5088 FunshionInstall_C105806.exe 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe -
Registers COM server for autorun 1 TTPs 53 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70E102B0-5556-11CE-97C0-00AA0055595A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E436EBB6-524F-11CE-9F53-0020AF0BA770}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E436EBB8-524F-11CE-9F53-0020AF0BA770}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99D54F63-1A69-41AE-AA4D-C976EB3F0713}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4444AC9E-242E-471B-A3C7-45DCD46352BC}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05589FAF-C356-11CE-BF01-00AA0055595A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{79376820-07D0-11CF-A24D-0020AFD79767}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{48025243-2D39-11CE-875D-00608CB78066}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1643E180-90F5-11CE-97D5-00AA0055595A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8DFB9A0-8A20-479F-B538-9387C5EEBA2B}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FEB50740-7BEF-11CE-9BD9-0000E202599C}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E5B4EAA0-B2CA-11CE-8D2B-0000E202599C}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBD8D00-C193-11D0-BD4E-00A0C911CE86}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06B32AEE-77DA-484B-973B-5D64F47201B0}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{336475D0-942A-11CE-A870-00AA002FEAB5}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E436EBB2-524F-11CE-9F53-0020AF0BA770}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D51BD5A5-7548-11CF-A520-0080C77EF58A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1E651CC0-B199-11D0-8212-00C04FC32C45}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8670C736-F614-427b-8ADA-BBADC587194B}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDA42200-BD88-11D0-BD4E-00A0C911CE86}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E4979309-7A32-495E-8A92-7B014AAD4961}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{944D4C00-DD52-11CE-BF0E-00AA0055595A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{301056D0-6DFF-11D2-9EEB-006008039E37}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC785860-B2CA-11CE-8D2B-0000E202599C}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6A08CF80-0E18-11CF-A24D-0020AFD79767}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B87BEB7B-8D29-423F-AE4D-6582C10175AC}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{59CE6880-ACF8-11CF-B56E-0080C7C4B68A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{060AF76C-68DD-11D0-8FC1-00C04FD9189D}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{37E92A92-D9AA-11D2-BF84-8EF2B1555AED}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E436EBB5-524F-11CE-9F53-0020AF0BA770}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E436EBB3-524F-11CE-9F53-0020AF0BA770}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3ECBC41-581A-4476-B693-A63340462D8B}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{51B4ABF3-748F-4E3B-A276-C828330E926A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B80AB0A0-7416-11D2-9EEB-006008039E37}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E436EBB1-524F-11CE-9F53-0020AF0BA770}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3588AB0-0781-11CE-B03A-0020AF0BA770}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{418AFB70-F8B8-11CE-AAC6-0020AF0B99A3}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D51BD5A2-7548-11CF-A520-0080C77EF58A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D8AA343-6E63-4663-BE90-6B80F66540A3}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07B65360-C445-11CE-AFDE-00AA006C14F4}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D51BD5A1-7548-11CF-A520-0080C77EF58A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D51BD5A3-7548-11CF-A520-0080C77EF58A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E436EBB7-524F-11CE-9F53-0020AF0BA770}\InprocServer32 regsvr32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\funshion.ini FunshionInstall_C105806.exe File opened for modification C:\Windows\SysWOW64\funshion.ini FunshionInstall_C105806.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3512 set thread context of 2384 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 142 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4cc62da77d25b48a952cb775bb65c4700000000020000000000106600000001000020000000243ec5ae9a5722ac909fc268051dede2a64220115a91b5bfb097b39c6524150b000000000e80000000020000200000007cdfc6e8a0688e15567f06ffc64be2fb74d9a25a4cdd3d24b823827648e0fd0b2000000057a3baf1c7723cc2cbd6b94e5fd6b949022727d73d3860dd4c3639e592df64d7400000006ff6f7f36b17f6c69487859359469ec30096ee0e1bfe036650f817530d219038d37de18b934627e2fb66dba068116ebe2667b10bd1055b17ad07c4ab2b119ea8 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3909170352" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d6660aec0bda01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4cc62da77d25b48a952cb775bb65c470000000002000000000010660000000100002000000025cdc4241c8d155196e319318a9b12f0fb66a8082346f7621b0656c823c6d211000000000e8000000002000020000000fa853510fc1a20485e2f7bbb64474115d3f3f59a27da811f70b99253d41c887e2000000087484f1a1f2229142d2b0dda87e77b9d3d6e5664c14e65051974382f3d1e387b40000000052813e1ac6cdd015a4804d9328507eb05484470e447163657b8ddfd0db4304af89f3ae46810017d1644a1c78ecc29eab6c7164c0a20c15a0a7879e04b586a45 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31067115" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{11827ED5-77DF-11EE-91E2-D2AF688397EA} = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4cc62da77d25b48a952cb775bb65c4700000000020000000000106600000001000020000000334f3c9c8c775f47310de56013d3657f7287dc6b6f588979f6d9c0ecde690ca2000000000e8000000002000020000000d8c6ebfa25282cc2022dddca333c7f1eba888dab124e0fd780221187ef16d5a82000000018ee35826ff41a1d2c39583a14c6d961d4e7ea26caaf8e9064b26e1b39ff769040000000a889d8acf897242d7811f993bb3a1675876c4522f8d17d259811e99c7fafcbc82852e34a3e5568d890df278a4b50543a9638306bc0d53c12b9cc9e86174ac130 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e08e59e6eb0bda01 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10399bf2eb0bda01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405516020" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402fead7eb0bda01 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31067115" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4151671101" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4cc62da77d25b48a952cb775bb65c470000000002000000000010660000000100002000000095ce4ff67d33a9f21f195ddcf9278ce62d66ce93e265d4464ef72a15404b50a6000000000e8000000002000020000000c2b8fed33d6dcbe62fecd49df6698e95174680643cd93ad3190c0517fddee7fb200000000f1dea4a3ada758451c6ced75ba1781e8742b66ae8f0cd4b368285eb395d479940000000c4164f925f166eb6dceedccc84dde19735d588335bdfd5929b99a787431968ee4edfe136754cb9a2d8bfc6695c80e02e66c5ec891db21a8ec3677d9e4e91d5ee IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0349110ec0bda01 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4cc62da77d25b48a952cb775bb65c4700000000020000000000106600000001000020000000cb8e71f1a58eb1dd42942b3306d3cf33332077762b8903a021b789990ffc0d05000000000e80000000020000200000000c6dd601e9d61c9e6cef6679e938dcef3ab4f2e759360ee64db1765b2f4b42e110000000a94126ff76134fbd7232b9b8b63b5d5c40000000c138ecd6ae87cdc6de4b5bd124bfefc65abde5c482dac8837cb5482619fabef7967c67d3faa6a99ee762f3661816447f46691968625324b4bc71ae074cdc8d3b IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4cc62da77d25b48a952cb775bb65c47000000000200000000001066000000010000200000002224dd9c15d0bf331e4bf658891a514efa6abb1b6dd61c5ae206fa0e2e2ecbc5000000000e800000000200002000000020e3300b3fa7bb685cf9f8302a39515c4968cfdd1fda039265d6c9037ba52dd22000000035c8d283f4c62132a6368da66264785e8056e51c616078b0b02b3ac7b5082d9740000000155738c8446636008904ff6a0c6dce1c9ad7246cf22b8e3259900ae33db1c61e5b988bb052d131361487bec324e7a358b480a4e039decf57decc0228c08b71e6 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3858077370" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff680000001a000000ee0400007f020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31067115" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4050264032" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 6367109fb103da01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4cc62da77d25b48a952cb775bb65c47000000000200000000001066000000010000200000004a66337a3e89a8b173eedfb054316d921e316f8170dd6eb6a579057caae57c31000000000e8000000002000020000000e47367701a18638c549ac01ec5d34aaa4fd569bd083e8c902ad1f4d273abab9720000000d7806bce150a8b14aadacd567e0151dee70d81ad6b98021a7dabe6cf4390e3be4000000029645ec5afdfea60b52fded93c751e94c32ee70b55e2db5bde8e6f58de37fb1f6a3e850d2707c06a6792adb82e7edeaedf7a2e4b108f9b648a5f29b50b944814 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff720000001a000000f80400007f020000 IEXPLORE.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E436EBB5-524F-11CE-9F53-0020AF0BA770} regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}\FilterData = 0200000001006803020000000000000030706933000000000000000003000000000000000000000030747933000000008000000090000000317479330000000080000000a0000000327479330000000080000000b0000000317069330800000000000000010000000000000000000000307479330000000080000000c00000006175647300001000800000aa00389b7180eb36e44f52ce119f530020af0ba77081eb36e44f52ce119f530020af0ba7705000000000001000800000aa00389b710100000000001000800000aa00389b71 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{E436EB85-524F-11CE-9F53-0020AF0BA770} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06B32AEE-77DA-484B-973B-5D64F47201B0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ftp regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{E06D8022-DB46-11CF-B4D1-00805F6CBBEA} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D51BD5A1-7548-11CF-A520-0080C77EF58A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05589FAF-C356-11CE-BF01-00AA0055595A}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}\CLSID = "{301056D0-6DFF-11D2-9EEB-006008039E37}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B87BEB7B-8D29-423F-AE4D-6582C10175AC}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{E436EB8C-524F-11CE-9F53-0020AF0BA770} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B80AB0A0-7416-11D2-9EEB-006008039E37}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{79376820-07D0-11CF-A24D-0020AFD79767}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E436EBB6-524F-11CE-9F53-0020AF0BA770} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E651CC0-B199-11D0-8212-00C04FC32C45} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\https regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{33FACFE0-A9BE-11D0-A520-00A0D10129C0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}\CLSID = "{D51BD5A5-7548-11CF-A520-0080C77EF58A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D51BD5A5-7548-11CF-A520-0080C77EF58A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FEB50740-7BEF-11CE-9BD9-0000E202599C}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}\FriendlyName = "AVI Splitter" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}\FriendlyName = "MJPEG Decompressor" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1643E180-90F5-11CE-97D5-00AA0055595A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{060AF76C-68DD-11D0-8FC1-00C04FD9189D}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07B65360-C445-11CE-AFDE-00AA006C14F4}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}\FriendlyName = "MPEG-I Stream Splitter" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}\CLSID = "{D51BD5A2-7548-11CF-A520-0080C77EF58A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}\CLSID = "{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}\FilterData = 0200000000006000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000700000006175647300001000800000aa00389b7100000000000000000000000000000000 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70E102B0-5556-11CE-97C0-00AA0055595A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D51BD5A2-7548-11CF-A520-0080C77EF58A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{E436EB89-524F-11CE-9F53-0020AF0BA770} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}\FriendlyName = "Wave Parser" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D51BD5A5-7548-11CF-A520-0080C77EF58A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4A2286E0-7BEF-11CE-9BD9-0000E202599C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E436EBB7-524F-11CE-9F53-0020AF0BA770} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E436EBB7-524F-11CE-9F53-0020AF0BA770}\InprocServer32 regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}\FilterData = 02000000640060000a000000000000003070693300000000000000000100000000000000000000003074793300000000a0010000b00100003170693300000000000000000100000000000000000000003074793300000000a0010000c00100003270693300000000000000000100000000000000000000003074793300000000a0010000d00100003370693300000000000000000100000000000000000000003074793300000000a0010000e00100003470693300000000000000000100000000000000000000003074793300000000a0010000f00100003570693300000000000000000100000000000000000000003074793300000000a0010000000200003670693300000000000000000100000000000000000000003074793300000000a0010000100200003770693300000000000000000100000000000000000000003074793300000000a0010000200200003870693300000000000000000100000000000000000000003074793300000000a0010000300200003970693308000000000000000100000000000000000000003074793300000000a0010000400200007669647300001000800000aa00389b714d4a504700001000800000aa00389b7154564d4a00001000800000aa00389b7157414b4500001000800000aa00389b714346434300001000800000aa00389b71494a504700001000800000aa00389b71506c756d00001000800000aa00389b714456435300001000800000aa00389b714456534400001000800000aa00389b714d44564600001000800000aa00389b7100000000000000000000000000000000 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}\FriendlyName = "VGA 16 Color Ditherer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{060AF76C-68DD-11D0-8FC1-00C04FD9189D} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{48025243-2D39-11CE-875D-00608CB78066}\FriendlyName = "Internal Script Command Renderer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B544C20-FD0B-11CE-8C63-00AA0044B51E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{E436EB85-524F-11CE-9F53-0020AF0BA770}\0 = "0, 4, , 52494646, 8, 8, , 43445841666D7420, 36, 20, FFFFFFFF00000000FFFFFFFFFFFFFFFFFFFFFFFF, 646174610000000000FFFFFFFFFFFFFFFFFFFF00" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}\CLSID = "{CF49D4E0-1115-11CE-B03A-0020AF0BA770}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99D54F63-1A69-41AE-AA4D-C976EB3F0713}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{418AFB70-F8B8-11CE-AAC6-0020AF0B99A3}\InprocServer32 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe 5088 FunshionInstall_C105806.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3216 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 1284 IEXPLORE.EXE 1284 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 5048 IEXPLORE.EXE 5048 IEXPLORE.EXE 5048 IEXPLORE.EXE 5048 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 3612 IEXPLORE.EXE 3612 IEXPLORE.EXE 3612 IEXPLORE.EXE 3612 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 4072 IEXPLORE.EXE 4072 IEXPLORE.EXE 4072 IEXPLORE.EXE 4072 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 5048 IEXPLORE.EXE 5048 IEXPLORE.EXE 5048 IEXPLORE.EXE 5048 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 4432 IEXPLORE.EXE 4432 IEXPLORE.EXE 4432 IEXPLORE.EXE 4432 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 3612 IEXPLORE.EXE 3612 IEXPLORE.EXE 3612 IEXPLORE.EXE 3612 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 4100 IEXPLORE.EXE 4100 IEXPLORE.EXE 4100 IEXPLORE.EXE 4100 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 4072 IEXPLORE.EXE 4072 IEXPLORE.EXE 4072 IEXPLORE.EXE 4072 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 532 IEXPLORE.EXE 532 IEXPLORE.EXE 532 IEXPLORE.EXE 532 IEXPLORE.EXE 3216 IEXPLORE.EXE 3216 IEXPLORE.EXE 4432 IEXPLORE.EXE 4432 IEXPLORE.EXE 4432 IEXPLORE.EXE 4432 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3512 wrote to memory of 4136 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 89 PID 3512 wrote to memory of 4136 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 89 PID 3512 wrote to memory of 4136 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 89 PID 4136 wrote to memory of 3216 4136 iexplore.exe 90 PID 4136 wrote to memory of 3216 4136 iexplore.exe 90 PID 3216 wrote to memory of 1284 3216 IEXPLORE.EXE 91 PID 3216 wrote to memory of 1284 3216 IEXPLORE.EXE 91 PID 3216 wrote to memory of 1284 3216 IEXPLORE.EXE 91 PID 3512 wrote to memory of 3812 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 92 PID 3512 wrote to memory of 3812 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 92 PID 3512 wrote to memory of 3812 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 92 PID 3812 wrote to memory of 4688 3812 iexplore.exe 93 PID 3812 wrote to memory of 4688 3812 iexplore.exe 93 PID 3216 wrote to memory of 5048 3216 IEXPLORE.EXE 94 PID 3216 wrote to memory of 5048 3216 IEXPLORE.EXE 94 PID 3216 wrote to memory of 5048 3216 IEXPLORE.EXE 94 PID 3512 wrote to memory of 3624 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 102 PID 3512 wrote to memory of 3624 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 102 PID 3512 wrote to memory of 3624 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 102 PID 3624 wrote to memory of 5028 3624 iexplore.exe 103 PID 3624 wrote to memory of 5028 3624 iexplore.exe 103 PID 3216 wrote to memory of 3612 3216 IEXPLORE.EXE 104 PID 3216 wrote to memory of 3612 3216 IEXPLORE.EXE 104 PID 3216 wrote to memory of 3612 3216 IEXPLORE.EXE 104 PID 3512 wrote to memory of 5108 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 106 PID 3512 wrote to memory of 5108 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 106 PID 3512 wrote to memory of 5108 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 106 PID 5108 wrote to memory of 4252 5108 iexplore.exe 107 PID 5108 wrote to memory of 4252 5108 iexplore.exe 107 PID 3216 wrote to memory of 4072 3216 IEXPLORE.EXE 108 PID 3216 wrote to memory of 4072 3216 IEXPLORE.EXE 108 PID 3216 wrote to memory of 4072 3216 IEXPLORE.EXE 108 PID 3512 wrote to memory of 5088 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 110 PID 3512 wrote to memory of 5088 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 110 PID 3512 wrote to memory of 5088 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 110 PID 5088 wrote to memory of 1684 5088 FunshionInstall_C105806.exe 112 PID 5088 wrote to memory of 1684 5088 FunshionInstall_C105806.exe 112 PID 5088 wrote to memory of 2660 5088 FunshionInstall_C105806.exe 111 PID 5088 wrote to memory of 2660 5088 FunshionInstall_C105806.exe 111 PID 5088 wrote to memory of 2660 5088 FunshionInstall_C105806.exe 111 PID 3512 wrote to memory of 3752 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 113 PID 3512 wrote to memory of 3752 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 113 PID 3512 wrote to memory of 3752 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 113 PID 3752 wrote to memory of 1148 3752 iexplore.exe 114 PID 3752 wrote to memory of 1148 3752 iexplore.exe 114 PID 3512 wrote to memory of 2088 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 115 PID 3512 wrote to memory of 2088 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 115 PID 3512 wrote to memory of 2088 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 115 PID 2088 wrote to memory of 1684 2088 iexplore.exe 116 PID 2088 wrote to memory of 1684 2088 iexplore.exe 116 PID 3216 wrote to memory of 4432 3216 IEXPLORE.EXE 117 PID 3216 wrote to memory of 4432 3216 IEXPLORE.EXE 117 PID 3216 wrote to memory of 4432 3216 IEXPLORE.EXE 117 PID 3512 wrote to memory of 4192 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 119 PID 3512 wrote to memory of 4192 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 119 PID 3512 wrote to memory of 4192 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 119 PID 4192 wrote to memory of 1104 4192 iexplore.exe 120 PID 4192 wrote to memory of 1104 4192 iexplore.exe 120 PID 3512 wrote to memory of 3920 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 121 PID 3512 wrote to memory of 3920 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 121 PID 3512 wrote to memory of 3920 3512 NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe 121 PID 3920 wrote to memory of 4960 3920 iexplore.exe 122 PID 3920 wrote to memory of 4960 3920 iexplore.exe 122 PID 3216 wrote to memory of 4100 3216 IEXPLORE.EXE 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://dsdc.myffn.info:251/?t=1031&i=ie&8d410e0e6cb31a36551526eea307649c00e85527=8d410e0e6cb31a36551526eea307649c00e85527&uu=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855272⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://dsdc.myffn.info:251/?t=1031&i=ie&8d410e0e6cb31a36551526eea307649c00e85527=8d410e0e6cb31a36551526eea307649c00e85527&uu=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855273⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3216 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1284
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3216 CREDAT:82948 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5048
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3216 CREDAT:17420 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3612
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3216 CREDAT:82960 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4072
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3216 CREDAT:17440 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4432
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3216 CREDAT:17454 /prefetch:24⤵
- Suspicious use of SetWindowsHookEx
PID:4100
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3216 CREDAT:17468 /prefetch:24⤵
- Suspicious use of SetWindowsHookEx
PID:532
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3216 CREDAT:17486 /prefetch:24⤵
- Modifies Internet Explorer settings
PID:1760
-
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a1&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855272⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a1&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855273⤵
- Modifies Internet Explorer settings
PID:4688
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a2&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855272⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a2&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855273⤵PID:5028
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a3&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855272⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a3&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855273⤵PID:4252
-
-
-
C:\Users\Admin\AppData\Local\Temp\FunshionInstall_C105806.exeC:\Users\Admin\AppData\Local\Temp\FunshionInstall_C105806.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Windows\system32\quartz.dll"3⤵
- Modifies registry class
PID:2660
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Windows\system32\quartz.dll"3⤵
- Registers COM server for autorun
- Modifies registry class
PID:1684
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a4&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855272⤵
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a4&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855273⤵PID:1148
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a5&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855272⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a5&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855273⤵
- Modifies Internet Explorer settings
PID:1684
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a6&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855272⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a6&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855273⤵
- Modifies Internet Explorer settings
PID:1104
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a7&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855272⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a7&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855273⤵
- Modifies Internet Explorer settings
PID:4960
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a8&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855272⤵PID:1848
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a8&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855273⤵PID:2384
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a9&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855272⤵PID:2636
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a9&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855273⤵PID:4580
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a10&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855272⤵PID:1636
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a10&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855273⤵PID:1104
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a11&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855272⤵PID:2248
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.myffn.info:251/rfrfrfrfrf.php?gg=a11&tt=1031&ur=a57eaa2ea5075b1d8f2b95e6963f6100&8d410e0e6cb31a36551526eea307649c00e855273⤵
- Modifies Internet Explorer settings
PID:4680
-
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- Deletes itself
PID:2384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
1KB
MD5dfeabde84792228093a5a270352395b6
SHA1e41258c9576721025926326f76063c2305586f76
SHA25677b138ab5d0a90ff04648c26addd5e414cc178165e3b54a4cb3739da0f58e075
SHA512e256f603e67335151bb709294749794e2e3085f4063c623461a0b3decbcca8e620807b707ec9bcbe36dcd7d639c55753da0495be85b4ae5fb6bfc52ab4b284fd
-
Filesize
748B
MD5c4f558c4c8b56858f15c09037cd6625a
SHA1ee497cc061d6a7a59bb66defea65f9a8145ba240
SHA25639e7de847c9f731eaa72338ad9053217b957859de27b50b6474ec42971530781
SHA512d60353d3fbea2992d96795ba30b20727b022b9164b2094b922921d33ca7ce1634713693ac191f8f5708954544f7648f4840bcd5b62cb6a032ef292a8b0e52a44
-
Filesize
4KB
MD5d65ec06f21c379c87040b83cc1abac6b
SHA1208d0a0bb775661758394be7e4afb18357e46c8b
SHA256a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f
SHA5128a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
2KB
MD52dc61eb461da1436f5d22bce51425660
SHA1e1b79bcab0f073868079d807faec669596dc46c1
SHA256acdeb4966289b6ce46ecc879531f85e9c6f94b718aab521d38e2e00f7f7f7993
SHA512a88becb4fbddc5afc55e4dc0135af714a3eec4a63810ae5a989f2cecb824a686165d3cedb8cbd8f35c7e5b9f4136c29dea32736aabb451fe8088b978b493ac6d
-
Filesize
11KB
MD59234071287e637f85d721463c488704c
SHA1cca09b1e0fba38ba29d3972ed8dcecefdef8c152
SHA25665cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649
SHA51287d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384
-
Filesize
11.4MB
MD527e431909ee69665f003456ce3296aaa
SHA179655635a89e055f7594228dfbef3aa6bf8e381f
SHA25622a2407ae9f95e79f2efa8516b92c9e89530ab2005ab308904484e3600d992fe
SHA5124fdcacfde714c65964ceb1c9c3b8bb7e2ea94b0b285231facf43fcf2466a0e2741130c7ba04585ec5b6a673c40885f24627c372b6bcc3f18c8aaa5c882440b4f
-
Filesize
11.4MB
MD527e431909ee69665f003456ce3296aaa
SHA179655635a89e055f7594228dfbef3aa6bf8e381f
SHA25622a2407ae9f95e79f2efa8516b92c9e89530ab2005ab308904484e3600d992fe
SHA5124fdcacfde714c65964ceb1c9c3b8bb7e2ea94b0b285231facf43fcf2466a0e2741130c7ba04585ec5b6a673c40885f24627c372b6bcc3f18c8aaa5c882440b4f
-
Filesize
88KB
MD5002d5646771d31d1e7c57990cc020150
SHA1a28ec731f9106c252f313cca349a68ef94ee3de9
SHA2561e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f
SHA512689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6
-
Filesize
484KB
MD50f35c14ffe3f0425e77099b618d6ebae
SHA16261ef267c3ea44a3698b73f207bc1f78f98c89d
SHA2565a5a180569b9dc51e0a80405ee875e202a464cbe2ed712c86f3e79c0b61599ea
SHA5127a166e8c79fb24e9b02f7f9e464d75c05dbfc6a428ce6067475520afaa84b999c4f9b701be91193b302eb3f024d6a2390c0fa4af5ec635ab6812aeb834dbde4f
-
Filesize
335B
MD56cbd3b1e3627f1fc087397aafc3fffaa
SHA1971bf4948ac5492aff49b9988b788a2a3f4cc6e5
SHA2565100467b6b5dc160fe9ff51f913f47e4545912cd6b2a61275546882913400eb8
SHA512fad9a174c20f50107df357f1ac17b3977035c8b9a4b476d8b13380aeb7781c515936dc0effe474fea9646a2fde89c267765e3bd845bd48bcc30afe5d2ead2fc4
-
Filesize
18KB
MD5994669c5737b25c26642c94180e92fa2
SHA1d8a1836914a446b0e06881ce1be8631554adafde
SHA256bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
SHA512d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
-
Filesize
18KB
MD5994669c5737b25c26642c94180e92fa2
SHA1d8a1836914a446b0e06881ce1be8631554adafde
SHA256bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
SHA512d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
-
Filesize
18KB
MD5994669c5737b25c26642c94180e92fa2
SHA1d8a1836914a446b0e06881ce1be8631554adafde
SHA256bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
SHA512d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
-
Filesize
18KB
MD5994669c5737b25c26642c94180e92fa2
SHA1d8a1836914a446b0e06881ce1be8631554adafde
SHA256bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
SHA512d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
-
Filesize
18KB
MD5994669c5737b25c26642c94180e92fa2
SHA1d8a1836914a446b0e06881ce1be8631554adafde
SHA256bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
SHA512d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
-
Filesize
18KB
MD5994669c5737b25c26642c94180e92fa2
SHA1d8a1836914a446b0e06881ce1be8631554adafde
SHA256bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
SHA512d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
-
Filesize
18KB
MD5994669c5737b25c26642c94180e92fa2
SHA1d8a1836914a446b0e06881ce1be8631554adafde
SHA256bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
SHA512d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
-
Filesize
66KB
MD59eb6cecdd0df9fe32027fcdb51c625af
SHA152b5b054ff6e7325c3087822901ea2f2c4f9572a
SHA25654cf1572ed47f614b0ffb886c99fc5725f454ef7ff919fbb2fd13d1cbe270560
SHA512864742ec6f74f94057b54cd9b09707c0125ac8db4844fa80af201e8b72a811bb68276c993e75bce67e5ece4f83644572edbdee5e963634c5a37839615faea97a
-
Filesize
66KB
MD59eb6cecdd0df9fe32027fcdb51c625af
SHA152b5b054ff6e7325c3087822901ea2f2c4f9572a
SHA25654cf1572ed47f614b0ffb886c99fc5725f454ef7ff919fbb2fd13d1cbe270560
SHA512864742ec6f74f94057b54cd9b09707c0125ac8db4844fa80af201e8b72a811bb68276c993e75bce67e5ece4f83644572edbdee5e963634c5a37839615faea97a
-
Filesize
66KB
MD59eb6cecdd0df9fe32027fcdb51c625af
SHA152b5b054ff6e7325c3087822901ea2f2c4f9572a
SHA25654cf1572ed47f614b0ffb886c99fc5725f454ef7ff919fbb2fd13d1cbe270560
SHA512864742ec6f74f94057b54cd9b09707c0125ac8db4844fa80af201e8b72a811bb68276c993e75bce67e5ece4f83644572edbdee5e963634c5a37839615faea97a
-
Filesize
4KB
MD55e14f6774c43bdff6ffe0afb0d51c47f
SHA1fb1e7b6e63afa6db6aa2033b5e7e90f1f4ba5e27
SHA2567cb51ccf21655e9590a6c3232920b16a3dfef15ffe9df7b8e71f487ca8c24da9
SHA5126ac533c0485156a68bd1460d8219acf7539b766590910cd646f4d7d4572c072f45369712d88d4e698f4e94aead8082abcbfacc3d6fe890046898f6c6d85274e3
-
Filesize
4KB
MD55e14f6774c43bdff6ffe0afb0d51c47f
SHA1fb1e7b6e63afa6db6aa2033b5e7e90f1f4ba5e27
SHA2567cb51ccf21655e9590a6c3232920b16a3dfef15ffe9df7b8e71f487ca8c24da9
SHA5126ac533c0485156a68bd1460d8219acf7539b766590910cd646f4d7d4572c072f45369712d88d4e698f4e94aead8082abcbfacc3d6fe890046898f6c6d85274e3
-
Filesize
4KB
MD55e14f6774c43bdff6ffe0afb0d51c47f
SHA1fb1e7b6e63afa6db6aa2033b5e7e90f1f4ba5e27
SHA2567cb51ccf21655e9590a6c3232920b16a3dfef15ffe9df7b8e71f487ca8c24da9
SHA5126ac533c0485156a68bd1460d8219acf7539b766590910cd646f4d7d4572c072f45369712d88d4e698f4e94aead8082abcbfacc3d6fe890046898f6c6d85274e3
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
Filesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
Filesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
Filesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
Filesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
Filesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
Filesize
10KB
MD538977533750fe69979b2c2ac801f96e6
SHA174643c30cda909e649722ed0c7f267903558e92a
SHA256b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
SHA512e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53
-
Filesize
10KB
MD538977533750fe69979b2c2ac801f96e6
SHA174643c30cda909e649722ed0c7f267903558e92a
SHA256b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
SHA512e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53
-
Filesize
10KB
MD538977533750fe69979b2c2ac801f96e6
SHA174643c30cda909e649722ed0c7f267903558e92a
SHA256b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
SHA512e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53
-
Filesize
484KB
MD50f35c14ffe3f0425e77099b618d6ebae
SHA16261ef267c3ea44a3698b73f207bc1f78f98c89d
SHA2565a5a180569b9dc51e0a80405ee875e202a464cbe2ed712c86f3e79c0b61599ea
SHA5127a166e8c79fb24e9b02f7f9e464d75c05dbfc6a428ce6067475520afaa84b999c4f9b701be91193b302eb3f024d6a2390c0fa4af5ec635ab6812aeb834dbde4f
-
Filesize
16KB
MD59ffcf967410609eab508f254e7ca6aa2
SHA1061671a355104728137c16cdec077b7312545f36
SHA256a3ec8754d1131e7e3f9e35a5ea52257b5cae7686f3f4355da048ac16f4a30e98
SHA51211d215e25afe2eb70c54c54c6b4e3125382c842324889ffc15e1b9f0e333c04473e9a8eed6fbda0c09478693811ef46efe97a16d08209ef00496b98afd6b6973
-
Filesize
94B
MD5b4f140b7b8dfc222ea5adaac897c3a58
SHA13a761b2bf00929f199c2d2effbc287ed1eb84852
SHA256d25cf3031a378e91b9195e5383af7407010afbbd346de569547b20bbc0db6eba
SHA512044e5e12f075bfdf98f902488ca06e51da3ecac25e373058672dde62d277e552680f9ae31ed080d41d0fd542762e53ac1004fc03f8c6b0a5c845c816ededa444