Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/10/2024, 18:51
Static task
static1
Behavioral task
behavioral1
Sample
14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe
Resource
win10v2004-20241007-en
General
-
Target
14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe
-
Size
622KB
-
MD5
4b025c5ceb5fca6da9bc97826731662e
-
SHA1
0007aee151ee1c121ae495cb1a748b0cbdc12bd7
-
SHA256
14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8
-
SHA512
438517b2fd026079385958fdf477f5bf85b8290253c47c876e99810805d2b05bf37eef9f9ca7e5a6c7dd6f540a56d4c4d258c36c1b58c6cdd097c0adc4d1b0e3
-
SSDEEP
12288:6Sq7BGgknkKQ/+AgEwDO4EwF2eNQ7m1C1+u88:6SWBhknJQ/+kMNh1w+O
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation acrotray.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation acrotray .exe -
Executes dropped EXE 4 IoCs
pid Process 4112 acrotray.exe 1124 acrotray.exe 1652 acrotray .exe 4088 acrotray .exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "C:\\Program Files (x86)\\Adobe\\acrotray.exe" 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\acrotray .exe 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe File created C:\Program Files (x86)\Adobe\acrotray.exe 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acrotray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ielowutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acrotray .exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E3A9DB3C-8CB8-11EF-A7EA-E24E87F0D14E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31137989" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31137989" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008110495d4aa4cb41b6757eb2472c6e510000000002000000000010660000000100002000000030eaa52284c1246be743441b6cbaa09f84aa61175579a2cddc3398886adfe4be000000000e8000000002000020000000f1ae1f8439c16d321589ea39ae5dd1ab5929f66631c474f814d022436642c3cb20000000b3dda5e2182adf1a64e256417c9e3619e8ee9ada7d4500ff3c36fa975e6f7b7d40000000116a0d2934e8949f6884c40b30868eeed75228b80496bc545673733deb51da75097c254496f9d96080d713c969b5d8547b355b43c2bf6ccbb914fff750b30c94 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3087185555" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008110495d4aa4cb41b6757eb2472c6e5100000000020000000000106600000001000020000000e316068c878c8d3802150aa267d7a83a3ca8fc7e53190df18442956e7452ae26000000000e8000000002000020000000b3a4d2c5e4fcc0ec65b53625341d73f3715029269d52debb714d7cae6476566e20000000f39380550629f9d1e520002c011e862f98e7ffb115c15648836e966ba94d39bf400000007bde8aaaf680bd659f803b79f0f4c65fe7bd2cd68340e0dab88adf05d40ba4637464191a83a57cf7fbeccc548df949f9bb357839202fe0ab399ff7356ae49a36 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3087185555" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e111b7c520db01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e981bfc520db01 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3660 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 3660 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 3660 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 3660 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 3660 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 3660 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 2208 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 2208 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 2208 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 2208 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 4112 acrotray.exe 4112 acrotray.exe 4112 acrotray.exe 4112 acrotray.exe 4112 acrotray.exe 4112 acrotray.exe 1652 acrotray .exe 1652 acrotray .exe 1652 acrotray .exe 1652 acrotray .exe 1124 acrotray.exe 1124 acrotray.exe 1124 acrotray.exe 1124 acrotray.exe 1652 acrotray .exe 1652 acrotray .exe 4088 acrotray .exe 4088 acrotray .exe 4088 acrotray .exe 4088 acrotray .exe 2208 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 2208 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 1124 acrotray.exe 1124 acrotray.exe 4088 acrotray .exe 4088 acrotray .exe 2208 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 2208 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 1124 acrotray.exe 1124 acrotray.exe 4088 acrotray .exe 4088 acrotray .exe 2208 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 2208 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 1124 acrotray.exe 1124 acrotray.exe 4088 acrotray .exe 4088 acrotray .exe 2208 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 2208 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 1124 acrotray.exe 1124 acrotray.exe 4088 acrotray .exe 4088 acrotray .exe 2208 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 2208 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 1124 acrotray.exe 1124 acrotray.exe 4088 acrotray .exe 4088 acrotray .exe 2208 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 2208 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 1124 acrotray.exe 1124 acrotray.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3660 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe Token: SeDebugPrivilege 2208 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe Token: SeDebugPrivilege 4112 acrotray.exe Token: SeDebugPrivilege 1652 acrotray .exe Token: SeDebugPrivilege 1124 acrotray.exe Token: SeDebugPrivilege 4088 acrotray .exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 5000 iexplore.exe 5000 iexplore.exe 3796 IEXPLORE.EXE 3796 IEXPLORE.EXE 5000 iexplore.exe 5000 iexplore.exe 768 IEXPLORE.EXE 768 IEXPLORE.EXE 5000 iexplore.exe 5000 iexplore.exe 4300 IEXPLORE.EXE 4300 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3660 wrote to memory of 2208 3660 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 87 PID 3660 wrote to memory of 2208 3660 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 87 PID 3660 wrote to memory of 2208 3660 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 87 PID 3660 wrote to memory of 4112 3660 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 99 PID 3660 wrote to memory of 4112 3660 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 99 PID 3660 wrote to memory of 4112 3660 14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe 99 PID 4112 wrote to memory of 1124 4112 acrotray.exe 102 PID 4112 wrote to memory of 1124 4112 acrotray.exe 102 PID 4112 wrote to memory of 1124 4112 acrotray.exe 102 PID 4112 wrote to memory of 1652 4112 acrotray.exe 103 PID 4112 wrote to memory of 1652 4112 acrotray.exe 103 PID 4112 wrote to memory of 1652 4112 acrotray.exe 103 PID 5000 wrote to memory of 3796 5000 iexplore.exe 104 PID 5000 wrote to memory of 3796 5000 iexplore.exe 104 PID 5000 wrote to memory of 3796 5000 iexplore.exe 104 PID 1652 wrote to memory of 4088 1652 acrotray .exe 106 PID 1652 wrote to memory of 4088 1652 acrotray .exe 106 PID 1652 wrote to memory of 4088 1652 acrotray .exe 106 PID 5000 wrote to memory of 768 5000 iexplore.exe 112 PID 5000 wrote to memory of 768 5000 iexplore.exe 112 PID 5000 wrote to memory of 768 5000 iexplore.exe 112 PID 5000 wrote to memory of 4300 5000 iexplore.exe 113 PID 5000 wrote to memory of 4300 5000 iexplore.exe 113 PID 5000 wrote to memory of 4300 5000 iexplore.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe"C:\Users\Admin\AppData\Local\Temp\14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe"C:\Users\Admin\AppData\Local\Temp\14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe" C:\Users\Admin\AppData\Local\Temp\14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2208
-
-
C:\Program Files (x86)\Adobe\acrotray.exe"C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Program Files (x86)\Adobe\acrotray.exe"C:\Program Files (x86)\Adobe\acrotray.exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1124
-
-
C:\Program Files (x86)\Adobe\acrotray .exe"C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Program Files (x86)\Adobe\acrotray .exe"C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\14b86f70c28d4aab03957c0c643d197aea7d04afe9b1c73f0e7d6baf3acf39d8.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4088
-
-
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:4808
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5000 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3796
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5000 CREDAT:17416 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:768
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5000 CREDAT:17424 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
637KB
MD5a592fbe2d3f2553332281ff1f9ff1bed
SHA141dc03f1ab390225530cc17bb013986ed1e36eae
SHA256c507abb3bf4b292a0412513215e89464386496cb3316651e34c0b5b4797b0c75
SHA512308cfbf9cd77040f8e9515ae21bf29b987e184bcaa475b6d249f2e92d9707e5d7eba3d753763c7ab2cae22572ae8422be390e555ceced20ca08f2612a8c23d26
-
Filesize
627KB
MD5290c452fed2e3c9736763e6aa099999b
SHA19c60e0ca87253dcf7b75d5e35fe5705a37e4ab02
SHA25605f9ae8c8222d25556cffba558cfceecb39804e095dce42c63cf768b6b671ec9
SHA512c702ac90be43455a5ff65cef16225a97b461dd73e16bb8bf9c317297636ec446d19d32061d7989144ddf6d01f25f0f0fa8a628278aa9ba58e3013acb1395b6b7
-
Filesize
33KB
MD5285520bc859a840449187cc43864a1cb
SHA13d85ac9801d3cc9a3577bc6f6ef3c754d2677dff
SHA256ac8e37a73437f2c13789726ea053c21fcdfd485896aabd6498702064968e34da
SHA5127d99e9b95ed4fdc8a510b3830e7948be99d55edfac91ec71c4c7e534176a25ebe48c1955dc39a950f1a3322ef7d18910048c16492ebb9ff54d517a294602d6a5