Overview
overview
10Static
static
10Enigma32g.exe
windows7-x64
3Enigma32g.exe
windows10-2004-x64
3daytjhasdawd.exe
windows7-x64
10daytjhasdawd.exe
windows10-2004-x64
10ghdtawedtrgh.exe
windows7-x64
10ghdtawedtrgh.exe
windows10-2004-x64
10hsefawdrthg.exe
windows7-x64
10hsefawdrthg.exe
windows10-2004-x64
10hyfdaethfhfaed.exe
windows7-x64
3hyfdaethfhfaed.exe
windows10-2004-x64
5jdrgsotrti.exe
windows7-x64
10jdrgsotrti.exe
windows10-2004-x64
10jgurtgjasdth.exe
windows7-x64
10jgurtgjasdth.exe
windows10-2004-x64
10mfcthased.exe
windows7-x64
10mfcthased.exe
windows10-2004-x64
10mnftyjkrgjsae.exe
windows7-x64
10mnftyjkrgjsae.exe
windows10-2004-x64
10mtbkkesfthae.exe
windows7-x64
3mtbkkesfthae.exe
windows10-2004-x64
3tyhkamwdmrg.exe
windows7-x64
10tyhkamwdmrg.exe
windows10-2004-x64
10vovdawdrg.exe
windows7-x64
10vovdawdrg.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 13:30
Behavioral task
behavioral1
Sample
Enigma32g.exe
Resource
win7-20241023-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Enigma32g.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
daytjhasdawd.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
daytjhasdawd.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
ghdtawedtrgh.exe
Resource
win7-20241023-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
ghdtawedtrgh.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
hsefawdrthg.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
hsefawdrthg.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
hyfdaethfhfaed.exe
Resource
win7-20241023-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral10
Sample
hyfdaethfhfaed.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
jdrgsotrti.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral12
Sample
jdrgsotrti.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral13
Sample
jgurtgjasdth.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
jgurtgjasdth.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
mfcthased.exe
Resource
win7-20241023-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral16
Sample
mfcthased.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral17
Sample
mnftyjkrgjsae.exe
Resource
win7-20240729-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
mnftyjkrgjsae.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
mtbkkesfthae.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
mtbkkesfthae.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
tyhkamwdmrg.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral22
Sample
tyhkamwdmrg.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral23
Sample
vovdawdrg.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
General
-
Target
hyfdaethfhfaed.exe
-
Size
135KB
-
MD5
bc48cb98d8f2dacca97a2eb72f4275cb
-
SHA1
cd3dd263fc37c8c7beb1393a654b400f2f531f1c
-
SHA256
c18fb46afa17ad8578d1edd4aa6a89b42f381ca7998a4e5a096643e0f2721c49
-
SHA512
7db6992278ca008e7aafa07eb198b046a125d23ca524f15d5302b137385dd4e40a4a54ce4dabb28710b71fbcfdd2d3315fb36e591edc2b3e1737b11b9ee45a5c
-
SSDEEP
3072:1TGtOioVUSuLwYMdbQro39gSms+rkNgrQ8WZW:peoVU9JMdbQrbvtG
Score
5/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation hyfdaethfhfaed.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 26 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hyfdaethfhfaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hyfdaethfhfaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\FlipAhead rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Download rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Download rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\CaretBrowsing rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-VersionHigh = "0" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Revision = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\PrefetchPrerender rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\VendorId = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-VendorId = "0" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-DeviceId = "0" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Revision = "0" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\VersionLow = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\CaretBrowsing rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Suggested Sites rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Recovery rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Control Panel rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\CaretBrowsing rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-VersionHigh = "0" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-DeviceId = "0" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\VendorId = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\CaretBrowsing rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Recovery rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\FlipAhead rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\AutoComplete rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\VersionLow = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\GPU rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Control Panel rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\AutoComplete rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\VendorId = "0" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-VendorId = "0" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\VersionHigh = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Recovery rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\AutoComplete rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\IEDevTools rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-VersionHigh = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Control Panel rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-Revision = "0" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\DeviceId = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\PrefetchPrerender rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\CaretBrowsing rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-Revision = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\VersionLow = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Control Panel rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Revision = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\AutoComplete rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Download rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-VersionLow = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-VersionLow = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\GPU rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2760 hyfdaethfhfaed.exe 2760 hyfdaethfhfaed.exe 2760 hyfdaethfhfaed.exe 2760 hyfdaethfhfaed.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 508 wrote to memory of 4468 508 hyfdaethfhfaed.exe 84 PID 508 wrote to memory of 4468 508 hyfdaethfhfaed.exe 84 PID 508 wrote to memory of 4468 508 hyfdaethfhfaed.exe 84 PID 508 wrote to memory of 1200 508 hyfdaethfhfaed.exe 90 PID 508 wrote to memory of 1200 508 hyfdaethfhfaed.exe 90 PID 508 wrote to memory of 1200 508 hyfdaethfhfaed.exe 90 PID 508 wrote to memory of 3220 508 hyfdaethfhfaed.exe 93 PID 508 wrote to memory of 3220 508 hyfdaethfhfaed.exe 93 PID 508 wrote to memory of 3220 508 hyfdaethfhfaed.exe 93 PID 508 wrote to memory of 796 508 hyfdaethfhfaed.exe 94 PID 508 wrote to memory of 796 508 hyfdaethfhfaed.exe 94 PID 508 wrote to memory of 796 508 hyfdaethfhfaed.exe 94 PID 508 wrote to memory of 1656 508 hyfdaethfhfaed.exe 96 PID 508 wrote to memory of 1656 508 hyfdaethfhfaed.exe 96 PID 508 wrote to memory of 1656 508 hyfdaethfhfaed.exe 96 PID 508 wrote to memory of 316 508 hyfdaethfhfaed.exe 98 PID 508 wrote to memory of 316 508 hyfdaethfhfaed.exe 98 PID 508 wrote to memory of 316 508 hyfdaethfhfaed.exe 98 PID 508 wrote to memory of 3656 508 hyfdaethfhfaed.exe 99 PID 508 wrote to memory of 3656 508 hyfdaethfhfaed.exe 99 PID 508 wrote to memory of 3656 508 hyfdaethfhfaed.exe 99 PID 508 wrote to memory of 4108 508 hyfdaethfhfaed.exe 100 PID 508 wrote to memory of 4108 508 hyfdaethfhfaed.exe 100 PID 508 wrote to memory of 4108 508 hyfdaethfhfaed.exe 100 PID 508 wrote to memory of 3868 508 hyfdaethfhfaed.exe 101 PID 508 wrote to memory of 3868 508 hyfdaethfhfaed.exe 101 PID 508 wrote to memory of 3868 508 hyfdaethfhfaed.exe 101 PID 508 wrote to memory of 524 508 hyfdaethfhfaed.exe 102 PID 508 wrote to memory of 524 508 hyfdaethfhfaed.exe 102 PID 508 wrote to memory of 524 508 hyfdaethfhfaed.exe 102 PID 508 wrote to memory of 4420 508 hyfdaethfhfaed.exe 103 PID 508 wrote to memory of 4420 508 hyfdaethfhfaed.exe 103 PID 508 wrote to memory of 4420 508 hyfdaethfhfaed.exe 103 PID 508 wrote to memory of 940 508 hyfdaethfhfaed.exe 104 PID 508 wrote to memory of 940 508 hyfdaethfhfaed.exe 104 PID 508 wrote to memory of 940 508 hyfdaethfhfaed.exe 104 PID 508 wrote to memory of 1996 508 hyfdaethfhfaed.exe 105 PID 508 wrote to memory of 1996 508 hyfdaethfhfaed.exe 105 PID 508 wrote to memory of 1996 508 hyfdaethfhfaed.exe 105 PID 508 wrote to memory of 4860 508 hyfdaethfhfaed.exe 106 PID 508 wrote to memory of 4860 508 hyfdaethfhfaed.exe 106 PID 508 wrote to memory of 4860 508 hyfdaethfhfaed.exe 106 PID 508 wrote to memory of 2992 508 hyfdaethfhfaed.exe 107 PID 508 wrote to memory of 2992 508 hyfdaethfhfaed.exe 107 PID 508 wrote to memory of 2992 508 hyfdaethfhfaed.exe 107 PID 508 wrote to memory of 2072 508 hyfdaethfhfaed.exe 108 PID 508 wrote to memory of 2072 508 hyfdaethfhfaed.exe 108 PID 508 wrote to memory of 2072 508 hyfdaethfhfaed.exe 108 PID 508 wrote to memory of 3944 508 hyfdaethfhfaed.exe 109 PID 508 wrote to memory of 3944 508 hyfdaethfhfaed.exe 109 PID 508 wrote to memory of 3944 508 hyfdaethfhfaed.exe 109 PID 508 wrote to memory of 4568 508 hyfdaethfhfaed.exe 110 PID 508 wrote to memory of 4568 508 hyfdaethfhfaed.exe 110 PID 508 wrote to memory of 4568 508 hyfdaethfhfaed.exe 110 PID 508 wrote to memory of 2760 508 hyfdaethfhfaed.exe 111 PID 508 wrote to memory of 2760 508 hyfdaethfhfaed.exe 111 PID 508 wrote to memory of 2760 508 hyfdaethfhfaed.exe 111 PID 508 wrote to memory of 2744 508 hyfdaethfhfaed.exe 112 PID 508 wrote to memory of 2744 508 hyfdaethfhfaed.exe 112 PID 508 wrote to memory of 2744 508 hyfdaethfhfaed.exe 112 PID 508 wrote to memory of 4468 508 hyfdaethfhfaed.exe 113 PID 508 wrote to memory of 4468 508 hyfdaethfhfaed.exe 113 PID 508 wrote to memory of 4468 508 hyfdaethfhfaed.exe 113 PID 508 wrote to memory of 3372 508 hyfdaethfhfaed.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\hyfdaethfhfaed.exe"C:\Users\Admin\AppData\Local\Temp\hyfdaethfhfaed.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\hyfdaethfhfaed.exe"C:\Users\Admin\AppData\Local\Temp\hyfdaethfhfaed.exe" /normal.priviledge2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:4468
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:1200
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:3220
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:796
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
PID:1656
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:316
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:3656
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:4108
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:3868
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:524
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:4420
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:940
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:1996
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:4860
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:2992
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:2072
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:3944
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:4568
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:2760
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:2744
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:4468
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:3372
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:404
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,63⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:2408
-
-