Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 10:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe
- Size 4.0MB
- Sample260802-l4chaage38
- SHA256 b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80
- MD5 b6a8208717de8bce3af7d25e732ef5c5
- SHA1 4c096b4decbc6740227024911a36698503ab135f
- SHA512 87dd5fa7fcf9faf8b13fe7f32efde9802c8d4370e163a631188110a1a0ccd66c7913f90ae0b1a03790c6b519a7102c1bb9ce5eb0eae745b00d12b237d8ade30b
- SSDEEP 49152:WScAmPWwDSVxKphdY/CW1sBlq7oQVAqq8j0hb/4R6:RcAmPLE6dY/j7oQqV14R6
- TLSH T119168C02F98380B6FB4D2530085E677AD231DE894725EBF7A354FD199A325C35D3A22E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1528 b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe - Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCXAD92.tmp b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA90A.tmp b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXB7A7.tmp b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXBC8F.tmp b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXBC7E.tmp b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCXA8F9.tmp b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXAD43.tmp b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXACB5.tmp b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXB748.tmp b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXB8A3.tmp b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXAC76.tmp b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXB921.tmp b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXBC6E.tmp b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXB728.tmp b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXB7C7.tmp b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb\0\ = "&Edit" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\3\ = "Foxit Reader" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ProgID\ = "FoxitReader.Document" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\LocalServer32 b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultIcon b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80?.exe" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80?.exe /dde" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\1\ = "&Open,0,2" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\3 b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DocObject\ = "0" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80?.exe,0" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DocObject b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32\ = "ole32.dll" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\ = "PDF ??" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80?.exe /dde" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\MiscStatus b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec\ = "[open(\"%1\")]" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec\ = "[print(\"%1\")]" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E} b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\1 b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\2 b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DocObject\ = "0" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\server b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable\ b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\MiscStatus\ = "32" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ProgID b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Printable b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ = "PDF ??" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\CLSID\ = "{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultExtension b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultExtension\ = ".pdf, PDF ??(*.pdf)" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb\0 b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Printable\ b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\server\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80?.exe" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32 b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80?.exe,0" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80?.exe /dde" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\0 b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80?.exe\" \"%1\"" b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable\ b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1528 b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe 1528 b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5080 wrote to memory of 1528 5080 b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe"C:\Users\Admin\AppData\Local\Temp\b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe"C:\Users\Admin\AppData\Local\Temp\b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1528
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 590KB
- SHA256 924c0ff543454bcf1b7c873bb883239d1e2fdbc37f73f2fd88ec62770c8620cd
- MD5 9231e254956dd820bb5dfbb76b57090d
- SHA1 9e73978064506065be8aef846d89a4b91ededbe1
- SHA512 065c95cb5ef2c5f9ae2819dc51ae7ecf19e75805bcbfd8ecb964cf9ae71085ed7e4b4aa6c123af953aa70928c88f67f6bbfb9d851da083f1a4dc211b5e90e2ac
- SSDEEP 6144:BYUWWHQCQPj1PBWbSNe10iXI7WTeMlOps4vWoLQLO76tlVr1Il5HlrJHU7kfLeeE:B0MS86nHrUA9HVlK8SQBJ9t4f15rL
- TLSH T151D49E81F3D847E8E06AC534CA428545EAB17C921B61B6DF0390767E2F376E54F3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe
- Size 4.6MB
- SHA256 6c8b77ac9ec197de7b5ebc564152bce1aec55b760ea3e4195c30972f1f7a9055
- MD5 c40e4547b1ad037add105cd658b68a7d
- SHA1 9a9feed2880823ce968bf744550edae9e07780a5
- SHA512 84c1a38540529fa2cde449fba1d2ca4ae724da1571b46c15a02a45941390ff2e6617cb39e3abd1ae130b558433c00c450b12383d6eb0731a86163a08497914c8
- SSDEEP 49152:IJGYRJLudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:InJijnUdYd+RaAj
- TLSH T159264903B28984D4D049C074CE1AD232AB617C9947F161EF36D4BBEA3A73AD47A3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
- Size 1.5MB
- SHA256 f81e185e00a0061b23df22629278c4705b60e659f4dfb809c85e255e2c5c0c3e
- MD5 d985ab67632ffe211d14cc38fbd7693e
- SHA1 c64678d96991098de05aaa4dfbd3b72eb5b97a62
- SHA512 d95e5854a458f005bc97ccd4c857cd8c5817e6e9f88b0cb77d824654ebe36d0fc3e89b6087a1b416e518ca463202cdb53775b2656ecef037771dcce3c5e96716
- SSDEEP 24576:yyoteh6euUHmEhK7eTuNdfxINakEtv9kWG2L1oaedpEukUoygGmq/Sl:yfehjvHHKTdfxINPEt99G2Bo7EukU1a
- TLSH T165757B03F29900E8D059D1B4C7468536EAB2BC454B24B6EF0B90B75A2E77FE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
- Size 1.4MB
- SHA256 187d0fb7fa321e4b5f80119514b0fd28b3455be560c1db30760d8ab688d5255e
- MD5 3de72f42c82ec1667edd948a35b2dc41
- SHA1 07bbfff9c90db892ae21f9c419cdc775b38a2d3d
- SHA512 052cc2d7634a6c254c609b9f400836b0f6ae417675d8e3ed81dd85c8ea34eaecf0fd8b25cfcdfdd61cfba02442eb774da99623456c06b5afd18691aaab9ba653
- SSDEEP 24576:lZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:KY2fF8FhmS86IUJWQn+6h27d6
- TLSH T12C657B03F79900E8D059D0B4C756853AEAB2BC464B24A6EF0B90B7562F77EE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e59a781.tmp
- Size 2.8MB
- SHA256 aa0a34300a93a2882b241b7fbf23e590f594f811fabfb8fccbc789796b7fa80e
- MD5 5fb303dcaf8de9324c9e4824718c0195
- SHA1 068710eaefe9da6aac750553546c08d2ad723b3e
- SHA512 1b117e044862a9a6bfc55984e6fd5093e0baa413507ca3055becd321ee602dbd5fb41c1bfa5e21327390e83ed50f6d1dabfea6e84896c11bb284578df8e7e7ee
- SSDEEP 49152:jY2fF8FhmS86IUJWQn+6h27d+Y2fF8FhmS86IUJWQn+6h27d6:jbOjjst4bOjjsts
- TLSH T1B6D57B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\b81eb89a9f960e244b01e1e13a1bf3042e31ed7802acca5d807fc356b4297a80.exe
- Size 4.0MB
- SHA256 250c50bbf267c2208701faba8714acf70d952580900b4c1a2ea6e7a9b9a4ea82
- MD5 b1191e63619b914fe659dd64ddc3b0b8
- SHA1 81d3f0279e4a2ed6177f0b66630a3fc4031ca746
- SHA512 23bc1eb3e5e656e16af76878b212f20237d7f8b258c670fc8a2f512b093ed05945d0cb53179fb16afc3d4ce121c120f91bd0237fe76a0acd90375a83a521c7bd
- SSDEEP 49152:yScAmPWwDSVxKphdY/CW1sBlq7oQVAqq8j0hb/4R6:9cAmPLE6dY/j7oQqV14R6
- TLSH T1B7167C02F98380B6FB4D2530085E677AD231DE894725EBF7A354FD198A725C35D3A22E
- MD5 SHA1 SHA512 SSDEEP TLSH