Overview
overview
4Static
static
1small_svg/...eM.svg
windows10-2004-x64
3small_svg/...eM.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eH.svg
windows10-2004-x64
3small_svg/...eH.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eQ.svg
windows10-2004-x64
3small_svg/...eQ.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eM.svg
windows10-2004-x64
3small_svg/...eM.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eM.svg
windows10-2004-x64
3small_svg/...eM.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 22:28
Static task
static1
Behavioral task
behavioral1
Sample
small_svg/small1-v10J-m4-eM.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
small_svg/small1-v10J-m4-eM.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
small_svg/small1-v11K-m5-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
small_svg/small1-v11K-m5-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
small_svg/small1-v12L-m6-eH.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
small_svg/small1-v12L-m6-eH.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
small_svg/small1-v13M-m7-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
small_svg/small1-v13M-m7-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
small_svg/small1-v15O-m1-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
small_svg/small1-v15O-m1-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
small_svg/small1-v16P-m2-eQ.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
small_svg/small1-v16P-m2-eQ.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
small_svg/small1-v17Q-m3-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
small_svg/small1-v17Q-m3-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
small_svg/small1-v18R-m4-eM.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
small_svg/small1-v18R-m4-eM.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
small_svg/small1-v19S-m5-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
small_svg/small1-v19S-m5-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
small_svg/small1-v1A-m0-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
small_svg/small1-v1A-m0-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
small_svg/small1-v1A-m1-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
small_svg/small1-v1A-m1-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
small_svg/small1-v1A-m2-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
small_svg/small1-v1A-m2-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
small_svg/small1-v1A-m2-eM.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
small_svg/small1-v1A-m2-eM.svg
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral27
Sample
small_svg/small1-v1A-m3-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
small_svg/small1-v1A-m3-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral29
Sample
small_svg/small1-v1A-m4-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
small_svg/small1-v1A-m4-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
small_svg/small1-v1A-m5-eL.svg
Resource
win10v2004-20260513-en
General
- Target small_svg/small1-v11K-m5-eL.svg
- Size 28KB
- Sample260804-2dpb6ahg73
- SHA256 d08d8cefc21783960a89cfffea6755499860559e53b0645ff5d35ecf0ba2497d
- MD5 f2f7df101c9bf5d75ce49d42491e9f8c
- SHA1 bfa147420c27f8f75982ba6d99be1b938f30cd3c
- SHA512 85aa10c95f787a0460395f4aaaa5184eefa4b66ebfd48e0931d021752560f69fee8e79a0788d026d5c00ca8258cc558db5121631ce5c6bd0df1410ceb6c76dba
- SSDEEP 384:ckwQGRNPUTQLwwizqwaowD66Uu9dqbvCK+E9xrYTxkk4sQsDI:c5QGvji
- TLSH T125D24D6437F83C9B8BCC03478D52EC68465FA8B7C498678D97C7D4E8A988368F76C560
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3175286229" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31269993" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E87A0722-905C-11F1-AF70-F6DD02F7A3D1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31269993" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3170442359" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\KnownProvidersUpgradeTime = b7e41e0878e3dc01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf0000000002000000000010660000000100002000000079604ffd7e1445647719ff5c0d619e19f5a0cabbcd89c0b40f4d24843151f8cd000000000e800000000200002000000025c9d6a9667b622c31635213c51a31ed9a6abb10e653e346ebdf9960dfbd75625000000049e1ac947dee257f94d44af350109727ce1cc03f38a43f5d89853bf9018c04b751acc70cfa0464cf4d821921619fef107115335044058f9cf366ff204d5a934f90b2b72e0c4dcd044468140aee652a6b40000000c7ffa24435c0706d0944e96ac4023f91d53cd7d44953c1af895da443579ec4b8b8202b92a7d48d08d42109657b5b26fc68054fbe222d55fb0ab71f601c62023c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf0000000002000000000010660000000100002000000063f4c5e2651243c299a926cab65679e58887b54dae7a80bec051bccad6aa87c2000000000e80000000020000200000002260e0616115fbf0e18a8d26091b5470753e592f673f4656f65f5cc5f44a7cb620000000dc89ca895493282612de57bdfab39a7eba42bfbacfce13953c991f37b685fffc40000000fdeda816c70521bc4ef7ff317a9d89bf8cba2f038307ec34b700a502544a08ffc347e2e1bb73e945f6b431befed89c28b8e98890c99e31b07aa2e6a400156128 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 606c8a1f7224dd01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf00000000020000000000106600000001000020000000b9cca8e9ccbc0f6273cd3bab9f47bca17c63a8061e3d1075745a509051c05030000000000e8000000002000020000000b909a81be1c3ae19ffe00b1db26d6e073078cf518987f96ed5bc8e579f2ec03010000000a342d7197b60c5ffa676a4972876dc504000000067b90e11584c85f844571baae63b78ecd67c318846702688e230aafbb6dbe2a7ec712c30a865a76ad51853d3824b8e84b699045b2414215f610fafc5d0da0912 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf000000000200000000001066000000010000200000009e83616fecc26e11d8d4ace6693a5c60ee3be7c6e9e475b7d4136561e50a3632000000000e8000000002000020000000ce4f94047cac45c18087706d058583ed4b4db47532fe747f4a0a18875e9dcd3d100000007e788ddb520764a07e960f442255299140000000065c072bc89c8cd3267a03c3ac0c6ddef5b13c1077372f08c6231a934d8687fb9db136905fbe05fe2ade2e75d54c7001858f5264ee5862afbabf27f61112a0c5 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf000000000200000000001066000000010000200000008b33b9e50231a598c41d6f07eb0d2c8317d71ced8559f82e2b7dbeef85ca8419000000000e80000000020000200000009d23768e782c89337fe6604ca3ffdcde91f414bae367c23c4e881bc69b034c052000000096b19cc760abce4eac5573137f35fe84997268f221cee933a6ce4154019a048e40000000f165d1365ea4f1f74c29f3d0c0454fe25716b428978cf909f921d7916a96bed33a1d4003dea3618e4508a3fb30f7f84ff92869304a49b9aa355c802a846358da iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70b1851f7224dd01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "492651419" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf0000000002000000000010660000000100002000000079aff9b6864481311b7c10963319109e234fa5370d656a029773ab7d40811b8c000000000e8000000002000020000000f98bd4ace5b86f8c79db7fe518bea88bd3a26bf1f847bcf2cb9e6ebe05badb4c500000000a785494fabd98427f1d4e5b2ce9dac2e4fac9d1d6fabf34fab5d6ca4a12a2bfaef6bb631b1e76fd5c1792c0f3137d0d11735857de3422a520f5453e3ef11d161f39a725bffae2c6a51e0074be9d24cf400000000c27e261c8590f5495f86bf4cf49c378fcf2fa6e678a6fb6be4e2d0f024da443950cb79e32923530cf36853d5f1134efe1bcd720149e54a91453cdbb684e9aea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 676 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 676 iexplore.exe 676 iexplore.exe 6120 IEXPLORE.EXE 6120 IEXPLORE.EXE 6120 IEXPLORE.EXE 6120 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 676 wrote to memory of 6120 676 iexplore.exe 86
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v11K-m5-eL.svg1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:676 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:6120
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 e83deaafcbebfd222e962f86dec05269bfb348ab690cc081b07fc65d3850fea6
- MD5 cb1755e0cd01283e143d6db195432608
- SHA1 76888d0d5def470ebd0de0f96070654579893fab
- SHA512 7d7924b727c053c54933a342facf1ce9d557059ca732b9ec868cce51b5dccfabf6191c6db3b4425e66c0d59f2cab8c2731081769b0c9a9fdeba17fa6fd2f8ae3
- TLSH T139F0D44144EAEAA05B409FCC15BC99763030F87921E518D7502CA4E2886737C6E460B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 9b6f1367c11aeff7d8830da5d86e3c7aac2e17aba308ecab19e2094c4e0d57ef
- MD5 e1e85e3287da8a3f312ed82c7bc4d7a9
- SHA1 38ca5f8dfcbe35df4431983aba8f7323ea64f14c
- SHA512 6835b75c07dc99306a90317678556fef8e08730ea44b0ca529d1d5981169dcaed61ef49516971b572c0455d719f8bb70ea9599536322e74ee44adbc2da95c86a
- TLSH T1A8E0C02411FB415EF6F5E5354BD97425655FF036141893B52EC59B05A703A00AD03E25
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S9SIAAA3\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH