Overview
overview
4Static
static
1j/83097940...23.svg
windows10-2004-x64
3j/83097940...23.svg
windows11-ltsc_2024-x64
4j/83097940...56.svg
windows10-2004-x64
3j/83097940...56.svg
windows11-ltsc_2024-x64
4j/83097940...r.html
windows10-2004-x64
3j/83097940...r.html
windows11-ltsc_2024-x64
3j/83097940...x.html
windows10-2004-x64
3j/83097940...x.html
windows11-ltsc_2024-x64
3j/83097940...x.html
windows10-2004-x64
3j/83097940...x.html
windows11-ltsc_2024-x64
3j830979401...x.html
windows10-2004-x64
3j830979401...x.html
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 12:21
Static task
static1
Behavioral task
behavioral1
Sample
j/83097940198pwd=Zxa7bbEtlbuIgquGluyd/123.svg
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
j/83097940198pwd=Zxa7bbEtlbuIgquGluyd/123.svg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
j/83097940198pwd=Zxa7bbEtlbuIgquGluyd/456.svg
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
j/83097940198pwd=Zxa7bbEtlbuIgquGluyd/456.svg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral5
Sample
j/83097940198pwd=Zxa7bbEtlbuIgquGluyd/admin_sidebar.html
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral6
Sample
j/83097940198pwd=Zxa7bbEtlbuIgquGluyd/admin_sidebar.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral7
Sample
j/83097940198pwd=Zxa7bbEtlbuIgquGluyd/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral8
Sample
j/83097940198pwd=Zxa7bbEtlbuIgquGluyd/index.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral9
Sample
j/83097940198pwdzI7hjfmhi3i5/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral10
Sample
j/83097940198pwdzI7hjfmhi3i5/index.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral11
Sample
j83097940198pwd=zI7hjf11mhi3i51/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral12
Sample
j83097940198pwd=zI7hjf11mhi3i51/index.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target j/83097940198pwd=Zxa7bbEtlbuIgquGluyd/456.svg
- Size 7KB
- Sample260730-pjapqsxcpg
- SHA256 8bd451b8d3d7da7368de36525da7aeb302899c46e8d28bdc0013edc302637c1d
- MD5 b352efa017e4f8f1ffda43e847820322
- SHA1 20d7d6cbc89d0a8034b2cdd0cc7eaee93b1ad690
- SHA512 126c5b1b193f9c98a5b001664ed612a8fd1cde2e615c9605edf35f19213d941a337abe133043ca6090eebaa1ab89953e435901e526098ca3c97050d75be67f25
- SSDEEP 192:K/pIurlPXsXuXsX85T5XvpE5rbx7zu+hoNC7i:K78+8MnviZx7aAo07i
- TLSH T14CE1EDDFA1213C8815835ABCDFBE6865152E60C732C64398FD4B6698F20356DB9E0FC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf0000000002000000000010660000000100002000000020d8a3bd081423a0fe9036e4003a8857a5d0e06d2a395d94848c30c0f6082601000000000e8000000002000020000000d8ec8ce00b1253821a61169260b6999a0639a453a5369e1c7452f745e5378e345000000086d4ac995698eac4ad52a46f8fe7be3b0b0ba91e968c13dc254f144c7a1d1223ff152905717729899883b184bd59a512b02f030656d49e2e9705bcc5134964a04549badc40b584705c737b5f93b6b36140000000be60d1de2a5e90c6d49962be2bec7ba8ecb9537e01c28939c74a365cb246a1ce092d58b873bbaf9dbddf56b3e63f9f6215f5764d10af4ff2bcb47b2e54a019c8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31268893" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\KnownProvidersUpgradeTime = b7e41e0878e3dc01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80fb015d2620dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf000000000200000000001066000000010000200000001a48f2eac3041b3699f4661caa18b1b934beb158d19d3deaee8345189fdf6fc8000000000e8000000002000020000000f9ceeae1146d9c400628248514170514f3b304d65727b068d4b863a35716689f1000000096887c3402842899ba6dd3a076f94cb2400000008262a027958c45c4ac957bcabc6dd6adddd6d0ca784ff1303d27ed59a84d461a8423d3dd1f5ea7cb36731b72295a348cc9f2cb3fa5c26140e4ddff24c2e21346 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4207306721" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf00000000020000000000106600000001000020000000166eac63d6a2c8748c68250a771a846c6107c4b2c87ffbb2d3b314c2eab39d1c000000000e8000000002000020000000f56b9c4b049c5fd85ab28731e6d0069582cf63096acc1b59200d84a53df55d892000000067eb6f7ebbdfaf2726d37e194dc854c2e653eddde30998be0606528a1f047bc640000000a2f1dc3ca2e503886a563dc387ef10068035bda230f7db8d0f011fa12b8fd512793e8f8da24f331379405b0616c0a72b55507344b2d2761f7bc9c54001f83f5e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf00000000020000000000106600000001000020000000d7f0da2623a0fcb15cad90fa48f8e9efde7909745100dc4570f1abd864f91458000000000e80000000020000200000007bfd087e8f075b9ffd74db59529ca5a282b1991f2796796796fe70e6cd53f0f8100000008818b9d21357bf231ae189ffe2e4887f400000000cbefbbae1af21f9e085234a4129ae15b5c9a86d7e18a8422d0f7a38e297085b9b4c97f3e6bd4fe3943026cd972cf358ca54bd7725d3504757fc3a64d4c36bcd iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = b7e41e0878e3dc01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4200431461" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31268893" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "491575958" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf000000000200000000001066000000010000200000009e28bcd015788e4524357eba28544cfb701aedf1ebca86145b5d0b035a7d099b000000000e8000000002000020000000aa898e32daeab8bc3d795d2967e8585ab71c1a2dafbaa77d9bcb2a93cfbf3a9e20000000c549eec690314ca50d4c1be052cae5ff0574eb9dd11a1a2fb647c3abe8968bec40000000e50b320394218607e275a2a3c3e2060a4a8253b78756e565caf6f032a2a34e18e21abba4100d7f1c223c95bc8843b04b284c8723096cda8cab66914b842e3258 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8019fd5c2620dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{25EE0061-8C11-11F1-AF70-6E95C79F7E05} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf00000000020000000000106600000001000020000000d772227047b0f9977b3a7184ea66eef273c34b9e7e92cf66b2042feddcd2c145000000000e80000000020000200000009771141f2fe07d84e15e51d965a364d4504942126f7bed6a19ce1687f33bf4b650000000dea2a8c236a4ec31f20fcdea4678fc8ab89df3060ca317f2ef50d6432b07bad07eaf37764a41262248ec777752babac1286f97b8f13de9a761e8996b18e869e9e61ebd6fd120ed99c9be5993baa24f114000000039bf277ed13ea18182e52a134584246a23e8546a15bb9cfa9f40230ac53a6298a5ec55c2c1580fe68f915126930935abc23702c0c35e31e3bbddf15381b8b842 iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1144 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1144 iexplore.exe 1144 iexplore.exe 4548 IEXPLORE.EXE 4548 IEXPLORE.EXE 4548 IEXPLORE.EXE 4548 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1144 wrote to memory of 4548 1144 iexplore.exe 83
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\j\83097940198pwd=Zxa7bbEtlbuIgquGluyd\456.svg1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1144 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4548
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 c555ad774da598ebc0811c7b33a225faa6bad39cc01d3046b57382435e78f6ae
- MD5 cb78173ed64f42287dd8c321eb1ef8b6
- SHA1 2b3824e66a55f6252a8e19505722a4524a1ba10c
- SHA512 265004d4887a00e75efb824351b18d4b0befcb2a1972a038e3764ed54f2eeef2b7f04b30e48619bd8a3c6302f941a55c08c40fc96a2c6916a2dd78fda78425a7
- TLSH T19EF0979210BCA8912DC296DC4754832D3871CAB31688062924BDCAF50826BEE7625072
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 6522cdd8fcd3ac159e53644188ee1c66956db89f42a949470edd861da2cfdfaa
- MD5 033dd7e3722d5a3581faea2796a3bca5
- SHA1 b5e388e063da350c4ba8151925c841bf8f433a79
- SHA512 bb0f012d52afc4d0ef4c69cec5cbee31d4830115ad012327456afd57d3d7e5615cd2c5df3cc9ea716403b83f1ede0a5c128c7821c0a700b24dbe43c911ff1c0d
- TLSH T1C2E0C02411FA412FF0E4D4354BC9B4274459F033045CA2B43AD4CB04B703A409C02A25
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Kno6B19.tmp
- Size 88KB
- SHA256 1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f
- MD5 002d5646771d31d1e7c57990cc020150
- SHA1 a28ec731f9106c252f313cca349a68ef94ee3de9
- SHA512 689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6
- SSDEEP 1536:V5JGkeov2IRdGjYQ4OozRuTah6gK8wd1ObAto2cTReH5xCVYiA4Pjqcawh7O6GAn:R
- TLSH T165937D2A04C76881B231D8193DA87FC1DC30886BB4069AE57DFD471B8F79E4BA46367C
- MD5 SHA1 SHA512 SSDEEP TLSH