Analysis
-
max time kernel
151s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2024 11:57
Static task
static1
Behavioral task
behavioral1
Sample
826018a8692aa093515ed26e2cf89183.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
826018a8692aa093515ed26e2cf89183.dll
Resource
win10v2004-20231215-en
General
-
Target
826018a8692aa093515ed26e2cf89183.dll
-
Size
252KB
-
MD5
826018a8692aa093515ed26e2cf89183
-
SHA1
79a7efc1b84b0370e902582249abff0b3b6a2966
-
SHA256
b857fd19f10b780f97e3c70cf521ff8a6e442031090f8eab963fac9d17dd9fef
-
SHA512
35ad7d9a4c1d72529657c35f3cdba742625625b3dfa86176b6ec421550504bd675f3f605778b60488516fc02402d44ec5ea836e1183d0cc824e66055de339a3c
-
SSDEEP
6144:dgsjyzscw0ah/ByAVxr62CLFJO6qpAJNzr:dZjw1w0aJBT4BJTJF
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer Protected Mode 1 TTPs 15 IoCs
Processes:
rundll32.exenotepad.exenotepad.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" notepad.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 3 IoCs
Processes:
rundll32.exenotepad.exenotepad.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" notepad.exe -
Processes:
explorer.exeiexplore.exeIEXPLORE.EXErundll32.exenotepad.exenotepad.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e504bd7353da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4d347bde384c849be64bb2f1c358fef000000000200000000001066000000010000200000005541b45f1d286008a53e9113deef4210ec052a51981ecbf0f8d340989e987426000000000e8000000002000020000000f061dd06163d0821c3c759faf117d4c8865a16d9d147fa024f813e9ea872b71720000000d0720649e4605756d86dcd9f8c703c1a5689735d5f49e08c3f943e36d0ab32c2400000007419c9b4183e9f37cc00dcbe2bd30c8d6dc2e2158a0fee698e93eaf4d3d46d14c2e2e3ece5315015a8b92a06ca122b344c8c8e1e19e7599646d7ac1ffd83719f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31085427" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4d347bde384c849be64bb2f1c358fef00000000020000000000106600000001000020000000aa6543d5d8742a1f15b711496e07f613546255d667d8d6075a570d8508fbcc2c000000000e800000000200002000000000763d73aeef62f9d625f38e9fdca516c85610fba295d24a68fa848946be6cc620000000fdf2f184e143353eef499a9b214571abe632813cbf462de89848ac9ef9bb6797400000006ef876aa43606fa0b5b659f3445ed483568a389a2e67f00a6c69dd7bf03c2ed85eb212373faa00ad4c5090e38569a34e52af2e7311e3406f89cbaef2eac5ad8d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D8D70518-BF66-11EE-B6AD-524326B4BB5C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413380874" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2920440612" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0688abd7353da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main notepad.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31085427" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2957628198" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2920440612" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31085427" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Modifies registry class 8 IoCs
Processes:
explorer.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
explorer.exepid process 532 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exenotepad.exenotepad.exepid process 4904 rundll32.exe 4904 rundll32.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 4656 notepad.exe 4656 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 4904 rundll32.exe 4904 rundll32.exe 4904 rundll32.exe 4904 rundll32.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe 632 notepad.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
iexplore.exepid process 224 iexplore.exe 224 iexplore.exe 224 iexplore.exe 224 iexplore.exe 224 iexplore.exe 224 iexplore.exe 224 iexplore.exe 224 iexplore.exe 224 iexplore.exe 224 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
explorer.exeiexplore.exeIEXPLORE.EXEpid process 532 explorer.exe 532 explorer.exe 224 iexplore.exe 224 iexplore.exe 3684 IEXPLORE.EXE 3684 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
rundll32.exerundll32.exeiexplore.exedescription pid process target process PID 4116 wrote to memory of 4904 4116 rundll32.exe rundll32.exe PID 4116 wrote to memory of 4904 4116 rundll32.exe rundll32.exe PID 4116 wrote to memory of 4904 4116 rundll32.exe rundll32.exe PID 4904 wrote to memory of 1196 4904 rundll32.exe explorer.exe PID 4904 wrote to memory of 1196 4904 rundll32.exe explorer.exe PID 4904 wrote to memory of 1196 4904 rundll32.exe explorer.exe PID 4904 wrote to memory of 632 4904 rundll32.exe notepad.exe PID 4904 wrote to memory of 632 4904 rundll32.exe notepad.exe PID 4904 wrote to memory of 632 4904 rundll32.exe notepad.exe PID 4904 wrote to memory of 632 4904 rundll32.exe notepad.exe PID 4904 wrote to memory of 4656 4904 rundll32.exe notepad.exe PID 4904 wrote to memory of 4656 4904 rundll32.exe notepad.exe PID 4904 wrote to memory of 4656 4904 rundll32.exe notepad.exe PID 224 wrote to memory of 3684 224 iexplore.exe IEXPLORE.EXE PID 224 wrote to memory of 3684 224 iexplore.exe IEXPLORE.EXE PID 224 wrote to memory of 3684 224 iexplore.exe IEXPLORE.EXE PID 4904 wrote to memory of 4656 4904 rundll32.exe notepad.exe PID 4904 wrote to memory of 224 4904 rundll32.exe iexplore.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\826018a8692aa093515ed26e2cf89183.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\826018a8692aa093515ed26e2cf89183.dll,#12⤵
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:224 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD51a510f2f7741e35ecc097c2ec95bc582
SHA1a5887323cb4fb1d9f56ad03f5b75eb118b1a9835
SHA256cb17dcee72c9437d911849bf754e0740541492400218c5f258660e4dd029a707
SHA5126a40efa9eb07c20891a61887d08f70c84cde60c2de23d81d1c0289c4fa6f948ca19b11ed9b9f7cc85254d887a59aa03274c011d9d89288a798672b4bbc23122c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD579f452d07c63ff895389f0ed4b9f59e5
SHA1dde75a0380a7e1f41d2bbdecb1d54a45f5f9b10b
SHA25621883198f4df8094c36f8788133895ac4da74b829a1bdc289c41ad05e2a979ff
SHA512988ce998a13f4534981f1859683531c5dc6b09396bce49daea0c95a0f68b60e10723568495e7f922cf1ce9a69c9267a06c135f09e6fb3201408b64b23c1b350d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Z0UNWU5J\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
memory/632-14-0x0000000003FC0000-0x0000000003FF0000-memory.dmpFilesize
192KB
-
memory/632-4-0x0000000003F10000-0x0000000003F40000-memory.dmpFilesize
192KB
-
memory/632-5-0x0000000003F40000-0x0000000003F82000-memory.dmpFilesize
264KB
-
memory/632-6-0x0000000003FC0000-0x0000000003FF0000-memory.dmpFilesize
192KB
-
memory/632-7-0x0000000003FC0000-0x0000000003FF0000-memory.dmpFilesize
192KB
-
memory/632-8-0x0000000003FC0000-0x0000000003FF0000-memory.dmpFilesize
192KB
-
memory/632-15-0x0000000003FC0000-0x0000000003FF0000-memory.dmpFilesize
192KB
-
memory/4656-9-0x0000000004110000-0x0000000004140000-memory.dmpFilesize
192KB
-
memory/4656-11-0x00000000041C0000-0x00000000041F0000-memory.dmpFilesize
192KB
-
memory/4656-10-0x0000000004140000-0x0000000004182000-memory.dmpFilesize
264KB
-
memory/4656-21-0x00000000041C0000-0x00000000041F0000-memory.dmpFilesize
192KB
-
memory/4904-12-0x00000000021F0000-0x0000000002220000-memory.dmpFilesize
192KB
-
memory/4904-13-0x0000000002170000-0x00000000021B2000-memory.dmpFilesize
264KB
-
memory/4904-0-0x0000000002140000-0x0000000002170000-memory.dmpFilesize
192KB
-
memory/4904-2-0x00000000021F0000-0x0000000002220000-memory.dmpFilesize
192KB
-
memory/4904-1-0x0000000002170000-0x00000000021B2000-memory.dmpFilesize
264KB