Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:05
Static task
static1
Behavioral task
behavioral1
Sample
74ee07e8c3d31f9c19db520fa767fefa.exe
Resource
win7-20231215-en
General
-
Target
74ee07e8c3d31f9c19db520fa767fefa.exe
-
Size
72KB
-
MD5
74ee07e8c3d31f9c19db520fa767fefa
-
SHA1
f5ef3a6d93961399e1030738239fcb0f9bdaaa9e
-
SHA256
b7ebb9d5356830be5c1aa87fde192e3096776c9dc7916f63b9756e300a84de62
-
SHA512
0705a5758bce58414945557c6f228d33f92c51b8d542824749c35f440f6c1896b30132a3c101b4ee88ffe12eb6b61eed0e66f91729173c3da1c1a379dcdd79fc
-
SSDEEP
768:/L+bL0dtaki8sQpvsWhJA2DDgZumooiszPeBItv8P5+l+S9C:/4ma+sQpvsPuDgZ5ooFDeBIZ8x+l+KC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
servicesc.exepid process 2432 servicesc.exe -
Loads dropped DLL 2 IoCs
Processes:
74ee07e8c3d31f9c19db520fa767fefa.exepid process 2312 74ee07e8c3d31f9c19db520fa767fefa.exe 2312 74ee07e8c3d31f9c19db520fa767fefa.exe -
Processes:
74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main 74ee07e8c3d31f9c19db520fa767fefa.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main 74ee07e8c3d31f9c19db520fa767fefa.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main 74ee07e8c3d31f9c19db520fa767fefa.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main 74ee07e8c3d31f9c19db520fa767fefa.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main 74ee07e8c3d31f9c19db520fa767fefa.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main 74ee07e8c3d31f9c19db520fa767fefa.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main 74ee07e8c3d31f9c19db520fa767fefa.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main 74ee07e8c3d31f9c19db520fa767fefa.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main 74ee07e8c3d31f9c19db520fa767fefa.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main 74ee07e8c3d31f9c19db520fa767fefa.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main 74ee07e8c3d31f9c19db520fa767fefa.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main 74ee07e8c3d31f9c19db520fa767fefa.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main 74ee07e8c3d31f9c19db520fa767fefa.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
servicesc.exepid process 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe 2432 servicesc.exe -
Suspicious use of SetWindowsHookEx 40 IoCs
Processes:
74ee07e8c3d31f9c19db520fa767fefa.exeservicesc.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exepid process 2312 74ee07e8c3d31f9c19db520fa767fefa.exe 2312 74ee07e8c3d31f9c19db520fa767fefa.exe 2312 74ee07e8c3d31f9c19db520fa767fefa.exe 2432 servicesc.exe 2564 74ee07e8c3d31f9c19db520fa767fefa.exe 2564 74ee07e8c3d31f9c19db520fa767fefa.exe 2564 74ee07e8c3d31f9c19db520fa767fefa.exe 564 74ee07e8c3d31f9c19db520fa767fefa.exe 564 74ee07e8c3d31f9c19db520fa767fefa.exe 564 74ee07e8c3d31f9c19db520fa767fefa.exe 1864 74ee07e8c3d31f9c19db520fa767fefa.exe 1864 74ee07e8c3d31f9c19db520fa767fefa.exe 1864 74ee07e8c3d31f9c19db520fa767fefa.exe 1988 74ee07e8c3d31f9c19db520fa767fefa.exe 1988 74ee07e8c3d31f9c19db520fa767fefa.exe 1988 74ee07e8c3d31f9c19db520fa767fefa.exe 2856 74ee07e8c3d31f9c19db520fa767fefa.exe 2856 74ee07e8c3d31f9c19db520fa767fefa.exe 2856 74ee07e8c3d31f9c19db520fa767fefa.exe 2956 74ee07e8c3d31f9c19db520fa767fefa.exe 2956 74ee07e8c3d31f9c19db520fa767fefa.exe 2956 74ee07e8c3d31f9c19db520fa767fefa.exe 1776 74ee07e8c3d31f9c19db520fa767fefa.exe 1776 74ee07e8c3d31f9c19db520fa767fefa.exe 1776 74ee07e8c3d31f9c19db520fa767fefa.exe 1720 74ee07e8c3d31f9c19db520fa767fefa.exe 1720 74ee07e8c3d31f9c19db520fa767fefa.exe 1720 74ee07e8c3d31f9c19db520fa767fefa.exe 2772 74ee07e8c3d31f9c19db520fa767fefa.exe 2772 74ee07e8c3d31f9c19db520fa767fefa.exe 2772 74ee07e8c3d31f9c19db520fa767fefa.exe 1980 74ee07e8c3d31f9c19db520fa767fefa.exe 1980 74ee07e8c3d31f9c19db520fa767fefa.exe 1980 74ee07e8c3d31f9c19db520fa767fefa.exe 2404 74ee07e8c3d31f9c19db520fa767fefa.exe 2404 74ee07e8c3d31f9c19db520fa767fefa.exe 2404 74ee07e8c3d31f9c19db520fa767fefa.exe 2520 74ee07e8c3d31f9c19db520fa767fefa.exe 2520 74ee07e8c3d31f9c19db520fa767fefa.exe 2520 74ee07e8c3d31f9c19db520fa767fefa.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
74ee07e8c3d31f9c19db520fa767fefa.exeservicesc.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exe74ee07e8c3d31f9c19db520fa767fefa.exedescription pid process target process PID 2312 wrote to memory of 832 2312 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2312 wrote to memory of 832 2312 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2312 wrote to memory of 832 2312 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2312 wrote to memory of 832 2312 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2312 wrote to memory of 2432 2312 74ee07e8c3d31f9c19db520fa767fefa.exe servicesc.exe PID 2312 wrote to memory of 2432 2312 74ee07e8c3d31f9c19db520fa767fefa.exe servicesc.exe PID 2312 wrote to memory of 2432 2312 74ee07e8c3d31f9c19db520fa767fefa.exe servicesc.exe PID 2312 wrote to memory of 2432 2312 74ee07e8c3d31f9c19db520fa767fefa.exe servicesc.exe PID 2432 wrote to memory of 2564 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 2564 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 2564 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 2564 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2564 wrote to memory of 2020 2564 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2564 wrote to memory of 2020 2564 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2564 wrote to memory of 2020 2564 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2564 wrote to memory of 2020 2564 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2432 wrote to memory of 564 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 564 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 564 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 564 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 564 wrote to memory of 1144 564 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 564 wrote to memory of 1144 564 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 564 wrote to memory of 1144 564 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 564 wrote to memory of 1144 564 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2432 wrote to memory of 1864 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 1864 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 1864 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 1864 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 1864 wrote to memory of 1528 1864 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 1864 wrote to memory of 1528 1864 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 1864 wrote to memory of 1528 1864 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 1864 wrote to memory of 1528 1864 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2432 wrote to memory of 1988 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 1988 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 1988 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 1988 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 1988 wrote to memory of 1772 1988 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 1988 wrote to memory of 1772 1988 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 1988 wrote to memory of 1772 1988 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 1988 wrote to memory of 1772 1988 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2432 wrote to memory of 2856 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 2856 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 2856 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 2856 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2856 wrote to memory of 2696 2856 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2856 wrote to memory of 2696 2856 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2856 wrote to memory of 2696 2856 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2856 wrote to memory of 2696 2856 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2432 wrote to memory of 2956 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 2956 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 2956 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 2956 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2956 wrote to memory of 800 2956 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2956 wrote to memory of 800 2956 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2956 wrote to memory of 800 2956 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2956 wrote to memory of 800 2956 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 2432 wrote to memory of 1776 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 1776 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 1776 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 2432 wrote to memory of 1776 2432 servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe PID 1776 wrote to memory of 1692 1776 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 1776 wrote to memory of 1692 1776 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 1776 wrote to memory of 1692 1776 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe PID 1776 wrote to memory of 1692 1776 74ee07e8c3d31f9c19db520fa767fefa.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exe"C:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exe"1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /v wavemapper /t reg_sz /d "msaom32.drv" /f2⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\servicesc.exeC:\Users\Admin\AppData\Local\Temp\servicesc.exe 74ee07e8c3d31f9c19db520fa767fefa.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exeC:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exe3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /v wavemapper /t reg_sz /d "msaom32.drv" /f4⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exeC:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exe3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /v wavemapper /t reg_sz /d "msaom32.drv" /f4⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exeC:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exe3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /v wavemapper /t reg_sz /d "msaom32.drv" /f4⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exeC:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exe3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /v wavemapper /t reg_sz /d "msaom32.drv" /f4⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exeC:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exe3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /v wavemapper /t reg_sz /d "msaom32.drv" /f4⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exeC:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exe3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /v wavemapper /t reg_sz /d "msaom32.drv" /f4⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exeC:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exe3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /v wavemapper /t reg_sz /d "msaom32.drv" /f4⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exeC:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exe3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1720 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /v wavemapper /t reg_sz /d "msaom32.drv" /f4⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exeC:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exe3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2772 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /v wavemapper /t reg_sz /d "msaom32.drv" /f4⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exeC:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exe3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1980 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /v wavemapper /t reg_sz /d "msaom32.drv" /f4⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exeC:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exe3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2404 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /v wavemapper /t reg_sz /d "msaom32.drv" /f4⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exeC:\Users\Admin\AppData\Local\Temp\74ee07e8c3d31f9c19db520fa767fefa.exe3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2520 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /v wavemapper /t reg_sz /d "msaom32.drv" /f4⤵PID:1748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\ErrorPageTemplate[2]Filesize
2KB
MD5f4fe1cb77e758e1ba56b8a8ec20417c5
SHA1f4eda06901edb98633a686b11d02f4925f827bf0
SHA2568d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f
SHA51262514ab345b6648c5442200a8e9530dfb88a0355e262069e0a694289c39a4a1c06c6143e5961074bfac219949102a416c09733f24e8468984b96843dc222b436
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\NewErrorPageTemplate[1]Filesize
1KB
MD5cdf81e591d9cbfb47a7f97a2bcdb70b9
SHA18f12010dfaacdecad77b70a3e781c707cf328496
SHA256204d95c6fb161368c795bb63e538fe0b11f9e406494bb5758b3b0d60c5f651bd
SHA512977dcc2c6488acaf0e5970cef1a7a72c9f9dc6bb82da54f057e0853c8e939e4ab01b163eb7a5058e093a8bc44ecad9d06880fdc883e67e28ac67fee4d070a4cc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\navcancl[1]Filesize
2KB
MD54bcfe9f8db04948cddb5e31fe6a7f984
SHA142464c70fc16f3f361c2419751acd57d51613cdf
SHA256bee0439fcf31de76d6e2d7fd377a24a34ac8763d5bf4114da5e1663009e24228
SHA512bb0ef3d32310644285f4062ad5f27f30649c04c5a442361a5dbe3672bd8cb585160187070872a31d9f30b70397d81449623510365a371e73bda580e00eef0e4e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E324WJ9A\bullet[1]Filesize
447B
MD526f971d87ca00e23bd2d064524aef838
SHA17440beff2f4f8fabc9315608a13bf26cabad27d9
SHA2561d8e5fd3c1fd384c0a7507e7283c7fe8f65015e521b84569132a7eabedc9d41d
SHA512c62eb51be301bb96c80539d66a73cd17ca2021d5d816233853a37db72e04050271e581cc99652f3d8469b390003ca6c62dad2a9d57164c620b7777ae99aa1b15
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\background_gradient[1]Filesize
453B
MD520f0110ed5e4e0d5384a496e4880139b
SHA151f5fc61d8bf19100df0f8aadaa57fcd9c086255
SHA2561471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b
SHA5125f52c117e346111d99d3b642926139178a80b9ec03147c00e27f07aab47fe38e9319fe983444f3e0e36def1e86dd7c56c25e44b14efdc3f13b45ededa064db5a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\errorPageStrings[1]Filesize
2KB
MD5e3e4a98353f119b80b323302f26b78fa
SHA120ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA2569466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\info_48[1]Filesize
4KB
MD55565250fcc163aa3a79f0b746416ce69
SHA1b97cc66471fcdee07d0ee36c7fb03f342c231f8f
SHA25651129c6c98a82ea491f89857c31146ecec14c4af184517450a7a20c699c84859
SHA512e60ea153b0fece4d311769391d3b763b14b9a140105a36a13dad23c2906735eaab9092236deb8c68ef078e8864d6e288bef7ef1731c1e9f1ad9b0170b95ac134
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\dnserrordiagoff[1]Filesize
1KB
MD547f581b112d58eda23ea8b2e08cf0ff0
SHA16ec1df5eaec1439573aef0fb96dabfc953305e5b
SHA256b1c947d00db5fce43314c56c663dbeae0ffa13407c9c16225c17ccefc3afa928
SHA512187383eef3d646091e9f68eff680a11c7947b3d9b54a78cc6de4a04629d7037e9c97673ac054a6f1cf591235c110ca181a6b69ecba0e5032168f56f4486fff92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\httpErrorPagesScripts[1]Filesize
8KB
MD53f57b781cb3ef114dd0b665151571b7b
SHA1ce6a63f996df3a1cccb81720e21204b825e0238c
SHA25646e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA5128cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa
-
\Users\Admin\AppData\Local\Temp\servicesc.exeFilesize
28KB
MD5d5e5cf7d25a9efd10833ebdf2e18048f
SHA1a05c3eb3ba2426f0c3c4e8f7fd9fa5f2c75ed91b
SHA2561a965dc6a9768bb9ffce3cca6dd79ac93d9fe30dd3a8208f9f369fa99d809bd7
SHA512ba4bf57291b94bc0faa6b796bc0a5446afceab324fca9136124e2f2be58ee754fbe61240409bfd423e7c0939edb7587a6d43d36c83c6a9375a2f8f2eff223708
-
memory/564-92-0x0000000004C90000-0x00000000050A2000-memory.dmpFilesize
4.1MB
-
memory/564-85-0x0000000003720000-0x0000000004782000-memory.dmpFilesize
16.4MB
-
memory/1776-268-0x0000000003740000-0x00000000047A2000-memory.dmpFilesize
16.4MB
-
memory/1864-122-0x0000000003800000-0x0000000004862000-memory.dmpFilesize
16.4MB
-
memory/1988-158-0x00000000036F0000-0x0000000004752000-memory.dmpFilesize
16.4MB
-
memory/1988-165-0x0000000004C80000-0x0000000005092000-memory.dmpFilesize
4.1MB
-
memory/2312-19-0x0000000004DE0000-0x00000000051F2000-memory.dmpFilesize
4.1MB
-
memory/2312-12-0x0000000003860000-0x00000000048C2000-memory.dmpFilesize
16.4MB
-
memory/2404-414-0x0000000003890000-0x00000000048F2000-memory.dmpFilesize
16.4MB
-
memory/2520-450-0x0000000003700000-0x0000000004762000-memory.dmpFilesize
16.4MB
-
memory/2564-49-0x0000000003700000-0x0000000004762000-memory.dmpFilesize
16.4MB
-
memory/2772-341-0x0000000003760000-0x00000000047C2000-memory.dmpFilesize
16.4MB
-
memory/2856-195-0x0000000003770000-0x00000000047D2000-memory.dmpFilesize
16.4MB
-
memory/2956-231-0x00000000037A0000-0x0000000004802000-memory.dmpFilesize
16.4MB