Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
24/10/2024, 23:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe
Resource
win7-20241010-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe
- Size 11.2MB
- Sample241024-3l3p7axgnf
- SHA256 642d4d6c125d358f12c03aaa2beda799d34ed63420cc694f67b5e8bc37df7bde
- MD5 8e4d37c20f0ec310206f5b2a6b5f5fe0
- SHA1 1a714deafd1ef6a8258fab567ee366da8b439344
- SHA512 5faa99a830faba7492094f043e970bcf9a05125da254bab5f5a176f11375d35aa583bed00b62ddb591516edd5b0aec7a70b253c7055d91a84626203955ede3ba
- SSDEEP 98304:3+5xKM1Woww2E5T3DoXSG8kM8pNhS9Yw8y0pNTwtWQtZ/K0tGOFWVRuLftCT:wS7aTcXSL8Hwf04WyZ/K0ttYVAAT
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\windows\SysWOW64\drivers\spo0lve.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\windows\SysWOW64\drivers\spo0lve.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe" 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp" 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe - Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\WallpaperStyle = "2" 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\TileWallpaper = "2" 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe 3208 2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-24_8e4d37c20f0ec310206f5b2a6b5f5fe0_hijackloader_icedid.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 11.2MB
- SHA256 fe537eeefbf1138d84748baf841bed045c21f88e6701137afd0afaa7021a45eb
- MD5 8680e252d9bc41f43c3fa457e26e4fd8
- SHA1 8062363d9614cc77c95742cee5bba06e0db47fc4
- SHA512 9a1e63763ae655cf6069ee271fa6a8cbd8af59870c1a9af0ad930b43fcc4fc221abea91534403d47a3f64864f115ef6c345c8076a0c72fa7201be282a755245c
- SSDEEP 98304:3+5xKM1Woww2E5T3DoXSG8kM8pNhS9Yw8y0pNTwtWQtZ/K0tGOFWVRuLftCT:wS7aTcXSL8Hwf04WyZ/K0ttYVAAT
- MD5 SHA1 SHA512 SSDEEP