Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 02:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe
- Size 4.0MB
- Sample260529-c552jsbs7k
- SHA256 a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d
- MD5 0cba71c90cceaebe5ad92314de19ef54
- SHA1 081c2a645db4fabb5f25bae40773c9e8a0a0cc2d
- SHA512 9e16fe28bd2d19b5c80c8e1da44c0c0ecd36e50ec0b3d782a20ea792826f731c0c148a51cbb727be089ff18d05c4ae0ae7ac3d583e27371d431c751201d8a898
- SSDEEP 49152:YScAmPWwDSVxKphdY/CW1sBlq7oQVAqq8j0hb/4R6:LcAmPLE6dY/j7oQqV14R6
- TLSH T185167C02F98380B6FB4D2530085E677AD231DE894725EBF7A354FD199A325C35D3A22E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3968 a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe - Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXE041.tmp a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXE0F0.tmp a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCXCF14.tmp a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXE081.tmp a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXE4CC.tmp a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXD129.tmp a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXE4AB.tmp a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXD168.tmp a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXE130.tmp a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXE4DC.tmp a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXCF24.tmp a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXD1F6.tmp a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXE021.tmp a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCXD255.tmp a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXE091.tmp a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DocObject a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ = "PDF ??" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d?.exe,0" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d?.exe,0" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb\0\ = "&Edit" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\0 a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec\ = "[print(\"%1\")]" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d?.exe\" \"%1\"" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Printable a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d?.exe /dde" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DocObject\ = "0" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DocObject\ = "0" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultExtension\ = ".pdf, PDF ??(*.pdf)" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable\ a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d?.exe /dde" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\server\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d?.exe" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable\ a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\3\ = "Foxit Reader" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultExtension a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\2\ = "PDF" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\server a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d?.exe /dde" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\1 a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\MiscStatus\ = "32" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\CLSID a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\LocalServer32 a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\0\ = "&Edit,0,2" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec\ = "[open(\"%1\")]" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb\0 a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\3 a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Printable\ a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ProgID a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\1\ = "&Open,0,2" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32\ = "ole32.dll" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultIcon a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E} a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32 a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\ = "PDF ??" a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3968 a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe 3968 a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 772 wrote to memory of 3968 772 a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe"C:\Users\Admin\AppData\Local\Temp\a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe"C:\Users\Admin\AppData\Local\Temp\a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3968
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 590KB
- SHA256 76b7fb6ff21860072f0cd530994601d52f169b778d48d4216de1e7a208f4c513
- MD5 2e46184ca7789352354d03f41a35a27c
- SHA1 a5079d73af9d6c6335f14aa1d72cc201c95b95f0
- SHA512 8d0d31be0ed7c3b6e937029f36b8a15fe7ac06f3d67fa0b6c19b6cb7fbf1fb4e1d8e3b0c503a93f2954a548b115cd4075a4d88dc76a81c465e3fbea1ace1f7fb
- SSDEEP 6144:BcUWWHQCQPj1PBWbSNe10iXI7WTeMlOps4vWoLQLO76tlVr1Il5HlrJHU7kfLeeE:BYMS86nHrUA9HVlK8SQBJ9t4f15rL
- TLSH T188D49E81F3D847E8E06AC534CA428645EAB17C921B61B6DF0390767E2F376E54F3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
- Size 7.1MB
- SHA256 58cca641ab8ce11f98b27b347789c8816567c3918b78649bd3cdfa76d4219600
- MD5 75f0264733d336312e2cbcbc0fc14597
- SHA1 3d099a1b639021c440a76b6544513e8d55d09321
- SHA512 496088aa4ce22f8d086cd9fbe3818e353c09f799490285fede0a7d2034b4bce2e2cea6ba8338961a0525e090eede94a54cac72ed5a4a959a7f8cd30c983f046f
- SSDEEP 98304:26CZetahq+WZxcpwCsJB2++fGOOxRj2vJzRN+T6frX:xCZetaEMGIG5xVqzRdDX
- TLSH T13F766C47E3E600A8E46EC970CF2A9521DA353C8E47B492EF169476E51A32FD47B38F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
- Size 1.4MB
- SHA256 fa2c91b5b4d3309826ed774c45101262ba03ec1481a29b6ea4f16159d7f19d82
- MD5 bd7ae74a0abb00f65bdab03d31f747e6
- SHA1 e578d2ab60a166c0cf2dc006c6f5e73154905069
- SHA512 d6002c5eda34940d111d3a89bc64fdd4edd3da553aefc6576562f3824ebbe3c04f62379f03c49c1377c80bcc1f9c6e21df225db6c8f8097f658ef6b31acf398e
- SSDEEP 24576:jZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:MY2fF8FhmS86IUJWQn+6h27d6
- TLSH T124657B03F79900E8D059D0B4C756853AEAB2BC464B24A6EF0B90B7562F77EE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e58ce67.tmp
- Size 40.2MB
- SHA256 51b90837dfdb8a24367abb6bae3d99f1bdc7abcc6702812571889d75192118eb
- MD5 8e8f4f2a7a9e2800d71b3d606eb5f73e
- SHA1 a1fe8de5ef29f917d9a4bf3ff992b8551c88b76a
- SHA512 8d9a91bafde92f037ef23531d2be82c68b98a1a7dcdc9b2dfe73d9bf2da2e3fbcb23ebc6c0bf612021e362d4fdbd0baf09d2fb1bcb2d1df7ab7dd3051b3d7515
- SSDEEP 786432:HqNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59w:HqcWxDMPnN+dk65gGUjku4vNjLjw
- TLSH T1E2972302ABD84079F1BBD2706A7A63758676BC743F35D6CF22847A4D1B31AC09A35723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\a027b58b9e9b790fe6fc16dbe3fbf9c0ed3ff87b89d3301935c9fc69346fb88d.exe
- Size 4.0MB
- SHA256 250c50bbf267c2208701faba8714acf70d952580900b4c1a2ea6e7a9b9a4ea82
- MD5 b1191e63619b914fe659dd64ddc3b0b8
- SHA1 81d3f0279e4a2ed6177f0b66630a3fc4031ca746
- SHA512 23bc1eb3e5e656e16af76878b212f20237d7f8b258c670fc8a2f512b093ed05945d0cb53179fb16afc3d4ce121c120f91bd0237fe76a0acd90375a83a521c7bd
- SSDEEP 49152:yScAmPWwDSVxKphdY/CW1sBlq7oQVAqq8j0hb/4R6:9cAmPLE6dY/j7oQqV14R6
- TLSH T1B7167C02F98380B6FB4D2530085E677AD231DE894725EBF7A354FD198A725C35D3A22E
- MD5 SHA1 SHA512 SSDEEP TLSH