Analysis
-
max time kernel
88s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
02-02-2024 00:02
Behavioral task
behavioral1
Sample
880365068d8f95218d82551fc7e02961.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
880365068d8f95218d82551fc7e02961.exe
Resource
win10v2004-20231222-en
General
-
Target
880365068d8f95218d82551fc7e02961.exe
-
Size
176KB
-
MD5
880365068d8f95218d82551fc7e02961
-
SHA1
4a6bfed49e69a2b8e8d8c4317a17358bae4c5e8c
-
SHA256
e4bfd376352e36ccb75f536bb20cf88a12766436284aae99ed98c0f91a80c0c8
-
SHA512
a7832f680acd9d4b2ef2696f7f7bc473c7a77e1ae50abdda401803b1090f479fa7603bef30545abd4dc60dbcc7aba6c1a749694f39691bc75e766ccd0921f4fd
-
SSDEEP
3072:6C8VCaeoJ4rJe7+hQE4l+Xzl4qeVXKl4S8oMqvsHiCJT73C5+UAUV+r1soutrMJ7:6C8VPJoeyC+Dl4qCXKl4SvkCCEoS6
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
880365068d8f95218d82551fc7e02961.exeWindefend.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation 880365068d8f95218d82551fc7e02961.exe Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation Windefend.exe -
Executes dropped EXE 2 IoCs
Processes:
Windefend.exeWindefend.exepid process 972 Windefend.exe 804 Windefend.exe -
Processes:
resource yara_rule behavioral2/memory/3948-0-0x0000000000400000-0x0000000000591000-memory.dmp upx behavioral2/memory/3948-6-0x0000000000400000-0x0000000000591000-memory.dmp upx C:\Windows\SysWOW64\Windefend.exe upx behavioral2/memory/972-20-0x0000000000400000-0x0000000000591000-memory.dmp upx C:\Windows\SysWOW64\Windefend.exe upx behavioral2/memory/972-28-0x0000000000400000-0x0000000000591000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Windefend.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Windows\\SysWOW64\\Windefend.exe" Windefend.exe -
Drops file in System32 directory 2 IoCs
Processes:
880365068d8f95218d82551fc7e02961.exedescription ioc process File created C:\Windows\SysWOW64\Windefend.exe 880365068d8f95218d82551fc7e02961.exe File opened for modification C:\Windows\SysWOW64\Windefend.exe 880365068d8f95218d82551fc7e02961.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
880365068d8f95218d82551fc7e02961.exeWindefend.exedescription pid process target process PID 3948 set thread context of 3608 3948 880365068d8f95218d82551fc7e02961.exe 880365068d8f95218d82551fc7e02961.exe PID 972 set thread context of 804 972 Windefend.exe Windefend.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413597148" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 0d1285d26635da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31085931" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31085931" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003c221304981e5f4bbaa9a99b1399bd8a000000000200000000001066000000010000200000000083af0bfc1c8a7b9e6f4bdadb1ddb5732f9c94d10cd07d347bd2ee3f753dcea000000000e80000000020000200000003eb429dd2bed7d86acef7d0b0bf0abbcf91ed36351717d40b2f1073b9af64c5610000000fc2e56271566359c662282f32f2eafa8400000005335a060d62f5239d2c06351eb1325613d689ab0ec52002f0efec4d77d80e78b31946eb62ddd6505876a8a7f659e0c4c6312b6cdcd9627d58fa44ac2e681cac8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1037199899" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6972675F-C15E-11EE-AA35-56EE10B1B424} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31085931" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003c221304981e5f4bbaa9a99b1399bd8a00000000020000000000106600000001000020000000a95cb64403a8f0088e656f715164cae47d8a93dd91411d923a55527889a7dcae000000000e80000000020000200000006740b3f5016656c6cf7ca9a468abb7f60447325c310cfdb62ccb6a2d70dd791f50000000f3905aa9d52b2ab6ae7e8c587d0ec17bc40b4f14cb5ba98da9f1de3f19f02afa600aaaad8ba6f9006aee22bf0ccc829a8cba24835feab14a2818a8f0a3d63323be1aa8534d45af865c5cc17ec052a4ad400000008be34bbeeec2842a2a74a6068054afac7e28563f0cf5d16725aaee1410a9695b7a06febd0d47e38e6c918459af738c6a6adbf6b1fbffa2b05e23de0962070d01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1037199899" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1038919084" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Windefend.exepid process 804 Windefend.exe 804 Windefend.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Windefend.exedescription pid process Token: SeDebugPrivilege 804 Windefend.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1924 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
880365068d8f95218d82551fc7e02961.exeWindefend.exeiexplore.exeIEXPLORE.EXEpid process 3948 880365068d8f95218d82551fc7e02961.exe 972 Windefend.exe 1924 iexplore.exe 1924 iexplore.exe 1848 IEXPLORE.EXE 1848 IEXPLORE.EXE 1848 IEXPLORE.EXE 1848 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
880365068d8f95218d82551fc7e02961.exe880365068d8f95218d82551fc7e02961.exeWindefend.exeWindefend.exeiexplore.exedescription pid process target process PID 3948 wrote to memory of 3608 3948 880365068d8f95218d82551fc7e02961.exe 880365068d8f95218d82551fc7e02961.exe PID 3948 wrote to memory of 3608 3948 880365068d8f95218d82551fc7e02961.exe 880365068d8f95218d82551fc7e02961.exe PID 3948 wrote to memory of 3608 3948 880365068d8f95218d82551fc7e02961.exe 880365068d8f95218d82551fc7e02961.exe PID 3948 wrote to memory of 3608 3948 880365068d8f95218d82551fc7e02961.exe 880365068d8f95218d82551fc7e02961.exe PID 3948 wrote to memory of 3608 3948 880365068d8f95218d82551fc7e02961.exe 880365068d8f95218d82551fc7e02961.exe PID 3948 wrote to memory of 3608 3948 880365068d8f95218d82551fc7e02961.exe 880365068d8f95218d82551fc7e02961.exe PID 3948 wrote to memory of 3608 3948 880365068d8f95218d82551fc7e02961.exe 880365068d8f95218d82551fc7e02961.exe PID 3948 wrote to memory of 3608 3948 880365068d8f95218d82551fc7e02961.exe 880365068d8f95218d82551fc7e02961.exe PID 3608 wrote to memory of 972 3608 880365068d8f95218d82551fc7e02961.exe Windefend.exe PID 3608 wrote to memory of 972 3608 880365068d8f95218d82551fc7e02961.exe Windefend.exe PID 3608 wrote to memory of 972 3608 880365068d8f95218d82551fc7e02961.exe Windefend.exe PID 972 wrote to memory of 804 972 Windefend.exe Windefend.exe PID 972 wrote to memory of 804 972 Windefend.exe Windefend.exe PID 972 wrote to memory of 804 972 Windefend.exe Windefend.exe PID 972 wrote to memory of 804 972 Windefend.exe Windefend.exe PID 972 wrote to memory of 804 972 Windefend.exe Windefend.exe PID 972 wrote to memory of 804 972 Windefend.exe Windefend.exe PID 972 wrote to memory of 804 972 Windefend.exe Windefend.exe PID 972 wrote to memory of 804 972 Windefend.exe Windefend.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 804 wrote to memory of 1924 804 Windefend.exe iexplore.exe PID 1924 wrote to memory of 1848 1924 iexplore.exe IEXPLORE.EXE PID 1924 wrote to memory of 1848 1924 iexplore.exe IEXPLORE.EXE PID 1924 wrote to memory of 1848 1924 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\880365068d8f95218d82551fc7e02961.exe"C:\Users\Admin\AppData\Local\Temp\880365068d8f95218d82551fc7e02961.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\880365068d8f95218d82551fc7e02961.exeC:\Users\Admin\AppData\Local\Temp\880365068d8f95218d82551fc7e02961.exe2⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Windefend.exe"C:\Windows\system32\Windefend.exe" rem "C:\Users\Admin\AppData\Local\Temp\880365068d8f95218d82551fc7e02961.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Windefend.exeC:\Windows\SysWOW64\Windefend.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5164c747ec05b351867ac47fb8ac89dcb
SHA1d814dbedc7356af4d274b907692c28baea48dba0
SHA256e675e63c991701c36625eb6ef0d2e009c743f7a6843192f74bd10ac641503181
SHA512895663660c26f74561154925fd7ef4c2ee7e8fe0ad25985f7ed51ceadb476d576450c8c57aa8e8ea350be398b491f0bb5fe54744d7d1e625e4ab97a93b375643
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD538b4e944ca2c6796ce21c40d2a2ef001
SHA16b85777d95d6e8b806a3cb22f0a49f806c4e1b3b
SHA256e73efa25714eda27aac4c8a2f14a16d6cf31dd78f1c7a447f7d05fcd11c0bdcb
SHA512d95024a7e4a23657ea98881ad5d38f56ab5fdf1ad13ecca351eb0e72ee36ef6f91e01a38dca58ae7c58141bb2e14a3c9f43156831b360bc9d0b109e7f0d68e3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoFilesize
4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UCK1SA0Q\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\Kno5F56.tmpFilesize
88KB
MD5002d5646771d31d1e7c57990cc020150
SHA1a28ec731f9106c252f313cca349a68ef94ee3de9
SHA2561e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f
SHA512689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6
-
C:\Windows\SysWOW64\Windefend.exeFilesize
176KB
MD5880365068d8f95218d82551fc7e02961
SHA14a6bfed49e69a2b8e8d8c4317a17358bae4c5e8c
SHA256e4bfd376352e36ccb75f536bb20cf88a12766436284aae99ed98c0f91a80c0c8
SHA512a7832f680acd9d4b2ef2696f7f7bc473c7a77e1ae50abdda401803b1090f479fa7603bef30545abd4dc60dbcc7aba6c1a749694f39691bc75e766ccd0921f4fd
-
C:\Windows\SysWOW64\Windefend.exeFilesize
140KB
MD58fd4e708972ebfabbd0fe5f2ae8a397b
SHA1d190c46689e2d8ddf5637bea2e56a6038b434956
SHA256ea7e30b685142ec54216e1e8bb701e9e96ea0a389f56f6dd5e2d3bf5d65901d6
SHA512c2cf33e7fd740ce284780bb3a6ba5cdb65858fd54d067ba808e5e391517f805871c4a0ab905f32a53a548c71d9b7cf49f5b44930d4b469b347f211fe56f8750a
-
memory/804-31-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/804-27-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/804-29-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/804-30-0x00000000004E0000-0x00000000005A9000-memory.dmpFilesize
804KB
-
memory/972-28-0x0000000000400000-0x0000000000591000-memory.dmpFilesize
1.6MB
-
memory/972-20-0x0000000000400000-0x0000000000591000-memory.dmpFilesize
1.6MB
-
memory/3608-21-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/3608-7-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/3608-5-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/3608-3-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/3948-0-0x0000000000400000-0x0000000000591000-memory.dmpFilesize
1.6MB
-
memory/3948-6-0x0000000000400000-0x0000000000591000-memory.dmpFilesize
1.6MB