Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 16:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5db92f1296c7d7146dd9a5a10bfb393973ae04e1fcb03002679592090a3b928d.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
5db92f1296c7d7146dd9a5a10bfb393973ae04e1fcb03002679592090a3b928d.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 5db92f1296c7d7146dd9a5a10bfb393973ae04e1fcb03002679592090a3b928d.dll
- Size 332KB
- Sample260722-tkx9mscp6v
- SHA256 5db92f1296c7d7146dd9a5a10bfb393973ae04e1fcb03002679592090a3b928d
- MD5 b308aed68a8085fd653058662d94c810
- SHA1 46769fe40eaa112a1b5737edc4bdf8d7d58fdae9
- SHA512 424e9096d4dba2a751b7daed0d0734a355e48ec3bbcfaf1d4715a5e1eb9793a5d3a4757b58536836e1c79acf6c0fd3314421b1865187fb742b559eb41c811f15
- SSDEEP 1536:S+89U1jgzJRtW3qlW7V6VPHpxCeosaMoioQ+upt:8K1jgQyWp6VjCxlYr
- TLSH T1BE7442A67CEA3414C6E3CF7722F95EF747A38A7B3045F62A1A72BE4C455227065A3103
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
gozi
Extracted
Family
-
gozi
Botnet
-
7555
C2
-
c.s-microsoft.com
-
ajax.googleapis.com
-
greatewallfirewall.xyz
-
185.186.244.130
-
booloolo2.com
-
37.120.222.107
Attributes
-
base_path
/postfix/
-
build
251173
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
dns_servers
107.174.86.134
107.175.127.22
-
exe_type
loader
-
extension
.yml
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ielowutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B2F15D5-85E7-11F1-912B-6E2C97F08F43} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\SearchScopes\KnownProvidersUpgradeTime = a94cc26ff00fdd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Suggested Sites\DataStreamEnabledState = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000de4ea29f3a2dcd44bc40feb6b7cda34e00000000020000000000106600000001000020000000088e7aef7502dd56739cdf1623da153f77281e18f7e088dfb658f6f68f784649000000000e80000000020000200000002bdcf366d35cf7a0a91b1941f76cbfe76040e727b50e082b06ca9f6bb10a1788200000002a0189cace816008e951190ff337f40fcbd73e89ec64b6a34bf2dbf5160763de40000000f42fcf85f37ad800a1018b99f89320b6b100fe48fb8c81a004ae4cb95dc1d6e2cbdc6497d74aff302ca59f8194436d7bd1518fe481849aee41983ea78ee39434 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a064c5b8fc19dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Recovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\ImageStoreRandomFolder = "a0eg7i6" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000de4ea29f3a2dcd44bc40feb6b7cda34e0000000002000000000010660000000100002000000029d5d053d1f7bc41e136b5020c3c90372d813721a882df236e7601fa3f9bc470000000000e80000000020000200000005187667c3ab912a7af0864d74ddc1eda7d762678465b803c7909fbbed2f5d5c550000000e41eec77ff0ba59da3fcf6920dd7a020d69f55833a4a990199f846bddfa30c30f58fd1fd94b35440d064c8e364a68813b51488bff521c82ba791d4796b736d210a9b688e29d5f49c1dfd17b3071d8449400000008e86f9d169ff6b3662f2cac91fb6c20fa8f8c2fdb925000e5168f646ea594a749d9e124db1ffae7dc1c247f3b6bcabf746c51717ed15a30ba091688fe3b9e93d iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000de4ea29f3a2dcd44bc40feb6b7cda34e000000000200000000001066000000010000200000007528c91b8bc0d9eb2b8ab4371a4bb5d3570dbf55243eeac86daa96addcc131a3000000000e8000000002000020000000d42a65634ba2e812f6f7a71d6bc79c6346e838af47ee8717907095820a3b05821000000022f0e181f1b4d7b2ce211fad6afb421040000000ccd89f42d7d8867915859f829610d4d390ef25c2ca4e134862950fe5ccc354b8012f1adc90f3c8925ff157862afc3565058bb0a30c14bef471c6e6dc62d118c7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C2D246A-85E7-11F1-912B-6E2C97F08F43} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\SearchScopesUpgradeVersion = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Suggested Sites iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000de4ea29f3a2dcd44bc40feb6b7cda34e000000000200000000001066000000010000200000000ad5aa09b2645308763605a2579c7fa093da19c0c0168e1701f63da3d28a405a000000000e8000000002000020000000c7c090e791a549c0f7d4be2f183cb06c848bc34444ed45b384fd04e5069f7c96200000004ead9f333582cc21143b78af2efd12181a8625019776c35dd5958f903896cc4e40000000161df70ee96f503d5bd5763cad5a23286ca726027e4d1de9629174ef879cb15fbbbd41fd4a8f67ecb8a67accec5ccea599c06a062c1dcd8d767120d81d6c4a30 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000de4ea29f3a2dcd44bc40feb6b7cda34e0000000002000000000010660000000100002000000025e3b04ec1f6f27c7028a11ba0bd02a7386ca0371a77dbd0966a5d97130d5826000000000e80000000020000200000004f06484fbdc8e37cc6bd63286ef57de7ba15735964ee4023d72fcd2b8b3e7eb620000000e155bcadf8b82a55b748299db8f15aaf6a2bab33a68129a33f449338335b8c954000000025d233934d6fbe91fa4261ef4bcf1464e92023dbbb73f9a43640588f7daaa88b67e543fd49330662c33cc7479e2aca79a3c52d6c4c7f90ca089d8269c0be515d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Suggested Sites\MigrationTime = a94cc26ff00fdd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000de4ea29f3a2dcd44bc40feb6b7cda34e00000000020000000000106600000001000020000000df3b526991b3716e4f455143322cbfdeba48f16dcda671136f05eb7856335fae000000000e800000000200002000000003d8cb85fb3018e3ec399cae2e3830862492e576d4ba34806818dead2a2a3d1310000000bf91e04e3540f65eb89f67c3db1d4ea240000000ddc33dc72db13a27d509895a9a965b44b3c88145449a384b6064e70e926b564ffd80dc0e15879cceb0266a759eb8a3f498b860714b757d4420851dc1ace1133c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709cbdb8fc19dd01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000de4ea29f3a2dcd44bc40feb6b7cda34e0000000002000000000010660000000100002000000043beda72e59c31367b14132d50619570c065844b3ab3750fb1d23f1f4a854756000000000e800000000200002000000062660e453038d6a60d13843dd98c60e40356482d1ae9ac861b66c431039f9ad650000000d28d7f0de823f9292b1bbc8fc78fca59d48a9c0f5b7b2a49ddeed09c0496e690d8061f46854574d9c1ef44ebb0bb7cc46baf4480be9c5cc32d6a9df2afe556de3e3170885deb7e37f782027eaf70466840000000d9c87818e9cfb646222266fb010868d886b3944e03aa43a959071cb8a1c05058a63623e7b187ad2f2f8031d26f20cc6918e4d1bfc4647de3b8c66910580c5749 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e02ce8bffc19dd01 iexplore.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4788 iexplore.exe 5320 iexplore.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4788 iexplore.exe 4788 iexplore.exe 3276 IEXPLORE.EXE 3276 IEXPLORE.EXE 5320 iexplore.exe 5320 iexplore.exe 3452 IEXPLORE.EXE 3452 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4140 wrote to memory of 2088 4140 rundll32.exe 88 PID 4788 wrote to memory of 3276 4788 iexplore.exe 93 PID 5320 wrote to memory of 3452 5320 iexplore.exe 96 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5db92f1296c7d7146dd9a5a10bfb393973ae04e1fcb03002679592090a3b928d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5db92f1296c7d7146dd9a5a10bfb393973ae04e1fcb03002679592090a3b928d.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2088
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:908
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4788 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3276
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5320 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3452
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD
- Size 312B
- SHA256 9c08972e19fd9358f5d968908a63baa283a4e20cdfc6f9f3645e60002b6c4e10
- MD5 3e6f689965bcec55680678e1828b2d5d
- SHA1 2530de7fc669885a5a9f26c60d05b9ad278fc78b
- SHA512 aaaf895216529f73870161051c39c2480cbe34eb4775816f55da07c8d317f695681b9b025de1c2efc9fea97f80514f862632dab1c2bae3bf9fc16f4c2cb4e920
- TLSH T105E072C93FE22CA024BA85D4BDF2CE76386310A601C331003A23409B0E63A3A635300B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\892580777767344DCAEF580FFA143EA6_06AA6C92E12381CACC311949FAA50FF1
- Size 952B
- SHA256 f26c3060239d6135cfa97d12b83084d3b3ea5094da32eff85dc02540bce43c29
- MD5 a7e56f949c2e0323d7ed9394e982e21e
- SHA1 874d2e471cf6e8d1ae4a8ca51997ed0c341cc80b
- SHA512 252dcc38c714f890aca8552e431ac1a72fc10c310a8019a50898b0d1d5c75a755df2ebf176ef74a404946a309e20b09ce115c1b6738fb18acdfb590d087ccf8a
- TLSH T1F0116D0E9C3864C2CA76B64BB6E8CD3338708583B98994039000E2C943AB7C9BF14ACC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD
- Size 404B
- SHA256 2b8680e5d175b83cae67676cc6c1d1de31230074a34461fd4615d47fa309daf4
- MD5 d4a7bf4a88f4196fd71bd0ea36b1b496
- SHA1 43ab468aa0aac1774efdc4b8dbb2c53214919436
- SHA512 9e89586f66e404e3433863cfcfd07e8d2f5d83f8cb0b653708c912c8d73b2af1419ab9b4a2060b7ee9fc518c3ff45ae8950bf16293d57140b7349884b6284ef7
- TLSH T10FE020203BF901BDE174B578C6D68B794A7FA0350D84D3711BE0454E6E076016E72D75
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\892580777767344DCAEF580FFA143EA6_06AA6C92E12381CACC311949FAA50FF1
- Size 438B
- SHA256 a6cb2d9e3993a196441a287fb47a9da4e30d2c3de4c66f96e93f71ef59fe0ba7
- MD5 8ff2887fae27edb9ea9de201e2bc24ca
- SHA1 dbad4e771864d646fa88d9738c81192f9fc747a3
- SHA512 b71f29d3bbfd8b195630833589f3d37f298558a86b5a9cc1e85884ad657f340141aab9782b256b2b2de1ff9fb9509389616aab481d22265650eed551a613dbe8
- TLSH T173F0680C22FE1659F332EA3803C628EC6A7F90136D087F7912D08A15BA55D002DA2B23
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\KnoC876.tmp
- Size 88KB
- SHA256 1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f
- MD5 002d5646771d31d1e7c57990cc020150
- SHA1 a28ec731f9106c252f313cca349a68ef94ee3de9
- SHA512 689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6
- SSDEEP 1536:V5JGkeov2IRdGjYQ4OozRuTah6gK8wd1ObAto2cTReH5xCVYiA4Pjqcawh7O6GAn:R
- TLSH T165937D2A04C76881B231D8193DA87FC1DC30886BB4069AE57DFD471B8F79E4BA46367C
- MD5 SHA1 SHA512 SSDEEP TLSH