Analysis
- max time kernel
145s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 02:23
Behavioral task
behavioral1
Sample
54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe
- Size 2.9MB
- Sample260602-ct89tsc13n
- SHA256 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329
- MD5 4e079df53092aba0d88105fd4fcb700c
- SHA1 13c28eaa66dcb76f95a29640af92385c1131035e
- SHA512 fd3d6e0451f4a543cd8b5b5ac03f1b048d0148e955d655c03305a6dabe4755dd46625dc87cdd52b1ae880ed8ec15d6f5de32c5c4bffb2baec8f8b199e6c563b8
- SSDEEP 49152:bEt0aNzCvmV7Zmgcozj6QAKKaiy/BtR40jIGstiSjoLATSvjgkBGPn7CX:g2aNEmxZmU+QDKaiOBtqSIGGiSUgSEE
- TLSH T1BEE533A643728446F1D750BA7D4FD274E209B14FC442FA5A1A00FEE3127BBE09991F8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
flow pid Process 1 2168 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe 1 2168 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe - Loads dropped DLL 4 IoCs
pid Process 2168 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe 2168 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe 2168 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe 2168 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\MSWINSCK.OCX 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe File opened for modification C:\Windows\SysWOW64\MSWINSCK.OCX 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe File created C:\Windows\SysWOW64\MSINET.OCX 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe File opened for modification C:\Windows\SysWOW64\MSINET.OCX 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe -
resource yara_rule behavioral2/memory/2168-0-0x0000000000400000-0x000000000119D000-memory.dmp upx behavioral2/memory/2168-4-0x0000000000400000-0x000000000119D000-memory.dmp upx behavioral2/memory/2168-24-0x0000000000400000-0x000000000119D000-memory.dmp upx behavioral2/memory/2168-54-0x0000000000400000-0x000000000119D000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{39977C62-C383-463D-AF61-C71220634656}\AlternateCLSID = "{6E5311A1-325D-4FFD-9AF4-B373F02AE458}" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908}\AlternateCLSID = "{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{39977C62-C383-463D-AF61-C71220634656}\Compatibility Flags = "1024" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908}\Compatibility Flags = "1024" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Compatibility Flags = "1024" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\AlternateCLSID = "{6E5311A1-325D-4FFD-9AF4-B373F02AE458}" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{39977C62-C383-463D-AF61-C71220634656} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe - Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\InprocServer32 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\1 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\VersionIndependentProgID 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX, 1" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\Control 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Programmable 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\CONTROL 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\ToolboxBitmap32 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\HELPDIR 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\TypeLib 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\TypeLib 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\Version\ = "1.0" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\ProgID\ = "MSWinsock.Winsock.1" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\InprocServer32\ThreadingModel = "Apartment" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0 (SP6)" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\ = "Microsoft Internet Transfer Control 6.0 (SP6)" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\ProgID 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\MiscStatus\1 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\Implemented Categories 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Programmable 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\ = "Internet Control URL Property Page Object" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458} 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\Implemented Categories 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CurVer 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\MiscStatus\1\ = "132497" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\TypeLib 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2168 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe 2168 54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe"C:\Users\Admin\AppData\Local\Temp\54a723d5e6a9ed31f84d80fff601d885e7da26ba5b81854d1aa51468d35cc329.exe"1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2168
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\MSINET.OCX
- Size 128KB
- SHA256 c11615f4561755632da7469e6c5fbf3ead40e0d9747030c90077b70115692ce3
- MD5 bed46f55af9a7b495ec0f2de0cb5ad3f
- SHA1 e9c47a7cabbf62e154dca7dba2301cc8eac1047e
- SHA512 4938f4e4007e63d990d6b18907b71b7108d9f1d5cbeab194bdf3c25226da20b2995102d79daa262b433f6a4479a9cceafea6c8f5b6f86bd190c751e7c0bd788b
- SSDEEP 3072:kfKgLosCFoyVOyWoMb9K4P/nGBBSSzr3+8s:kiaao8MbdYRY
- TLSH T12FD34902B3E2502FF5E25A303AF72A959EF67C297E26D14F5344728C2971791EA7430B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\MSWINSCK.OCX
- Size 124KB
- SHA256 b66e17e0d7bbfe4f6be537c544083e844b5dd0ebc660910bff17ad6cd5480971
- MD5 57325d394119db3d3b3cf8a3bbfda5ca
- SHA1 91fc9a75807f8cd98c52d8804dada489bd187430
- SHA512 a6efdc59a999df797d3030042e62eb452e5ad87a19429fdaf4117fff1c85ff2e58015159c24b3c2e4c7fe97b601fcfe795fa3457da66b69b08eaf7e34ba5ad48
- SSDEEP 3072:g4NcOKzGL34jTLUlLD0NzpDudk61bugpF/d3H7/Ummxx+86:H2Q4CLD0Nzg1bnvDAG
- TLSH T1A8C34B0273F5816AE9E226310E362F55BBF9BC25AE39954B4340774C1D31B86DE3932B
- MD5 SHA1 SHA512 SSDEEP TLSH