Overview
overview
4Static
static
1small_svg/...eM.svg
windows10-2004-x64
3small_svg/...eM.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eH.svg
windows10-2004-x64
3small_svg/...eH.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eQ.svg
windows10-2004-x64
3small_svg/...eQ.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eM.svg
windows10-2004-x64
3small_svg/...eM.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eM.svg
windows10-2004-x64
3small_svg/...eM.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 15:54
Static task
static1
Behavioral task
behavioral1
Sample
small_svg/small1-v10J-m4-eM.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
small_svg/small1-v10J-m4-eM.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
small_svg/small1-v11K-m5-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
small_svg/small1-v11K-m5-eL.svg
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral5
Sample
small_svg/small1-v12L-m6-eH.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
small_svg/small1-v12L-m6-eH.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
small_svg/small1-v13M-m7-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
small_svg/small1-v13M-m7-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
small_svg/small1-v15O-m1-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
small_svg/small1-v15O-m1-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
small_svg/small1-v16P-m2-eQ.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
small_svg/small1-v16P-m2-eQ.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
small_svg/small1-v17Q-m3-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
small_svg/small1-v17Q-m3-eL.svg
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral15
Sample
small_svg/small1-v18R-m4-eM.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
small_svg/small1-v18R-m4-eM.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
small_svg/small1-v19S-m5-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
small_svg/small1-v19S-m5-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
small_svg/small1-v1A-m0-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
small_svg/small1-v1A-m0-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
small_svg/small1-v1A-m1-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
small_svg/small1-v1A-m1-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
small_svg/small1-v1A-m2-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
small_svg/small1-v1A-m2-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
small_svg/small1-v1A-m2-eM.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
small_svg/small1-v1A-m2-eM.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
small_svg/small1-v1A-m3-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
small_svg/small1-v1A-m3-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral29
Sample
small_svg/small1-v1A-m4-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
small_svg/small1-v1A-m4-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
small_svg/small1-v1A-m5-eL.svg
Resource
win10v2004-20260513-en
General
- Target small_svg/small1-v15O-m1-eL.svg
- Size 44KB
- Sample260808-tb8zsaec46
- SHA256 2356f4f2b651efbad7c8ee7f8e4dcaa51b9ce28d95394fb3a5254447f93818e1
- MD5 2afb4097fb2218401ce6072aa93f8307
- SHA1 faf6a9c1effa6293ec2021eac520dce00486f4e0
- SHA512 f66dca04fa73cbae407bab6bcc97525d8d397ef065a220094ce93dcf717293611e9f00d05915fc2d4c5bd63b27ce5714f07b8b27c62cc32ab4efccf5b81dd84b
- SSDEEP 384:c827NHdmDcvlxO4fnH5AomEkJW9mOx790u+wycg9+fiUCFRlg0vlg90rf2:c/NHMWaA90C
- TLSH T1CF1340B537F43C9B8BCC034B6D42FC6C46BF94B78458668C9BD790E89548368B7AC5A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "997021567" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\KnownProvidersUpgradeTime = b7e41e0878e3dc01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf00000000020000000000106600000001000020000000a13da8432c2491e842546a8d812b3fab28596ef0ca385dbe6de2c7451e730730000000000e800000000200002000000036af1315a66b6bb8867c6e211c1b6b6eba52e6d7e218f439c60dfb485c8f6a395000000062d27da3ab78ee0786d2828af940ee5b0c47a31e9112a6497a8b1a274833c9bdfe69ca217023451d71cadf261ec7c09da09b447d76da9422edf6a1bee23aa28224bd471e5148805aadaa5dd625f0507440000000c535aecf820677da30e2b42310701a1f265c62efe184d9fc8687132bc70b188fad58c0352d16922e27b743c353b0b47ba64523a081a7349a66aa664d211c70b1 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "492969434" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31270734" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70ca579d5627dd01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf00000000020000000000106600000001000020000000653c6bff746e9e7811e41ae6b7342cb52e3d9192b786f293746201cc57f6783a000000000e80000000020000200000007c68302f48524cf772624076a04d11ebbbdf73cc055ea169b154d1886b46bf3f500000004552051f4b3b763905114e04563a0fc6e2332c48d8368a72da90977390887076a741e0b1ad1ae8e260fccd885241a85760044c4b536bd5488302dcf1d8af9f477c2db630b9e7307acd1c0f731d246adf4000000026e374f6298f7a4e3e13983250d68e8a755e2e54eb6f6f950e56eaaa396369fc7ab747c4b2c5fb8cf1ded674c8284e531d18ac8aece92172b1287a0ca0798965 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf000000000200000000001066000000010000200000009e2f3fdca701289b86a8940bcbb4fe5180d5539c1bb9404606553bee0fe1f080000000000e8000000002000020000000815f36b51c62d07cfedb2557000f45add24a7100062ac1c62361ee17d18c741110000000a4f76b4e47e7dddece249399c30cc52740000000a7b0a3900aab506079830dc80ad99736110857c4d31e7b63f4ab56df4a6bba3bacb9b9e9c95c0ce00c946e158e0b1ad5580aa998f22a622b527dfa20eaa8de06 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf000000000200000000001066000000010000200000008f77d55ddb70b8fa35ae7afe1a542a7f462cc871ad528fdff85ba346a2b1c1ee000000000e8000000002000020000000468ee7658f4b899fb01d1285e1e30e9042a462f9d5bb1441bb4b9860e34d103e200000005c59a638635ce6cdce7681e870efba12f0ff14656b925dd5fa59a92a74179a424000000043f3af4900da388863a14892a746beadc265e5cf97f6b20432f197e37d7eb6bb7a3744525c14916f0e88be4dc1f5722be9b082c11243ee7ef42e68d5a8d31595 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{664E5ED4-9341-11F1-AF70-761C4632812C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "987802923" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf000000000200000000001066000000010000200000001bd399ad2f72e9a22f024484deae07d2726762715e9a775411fdc333eb10f238000000000e80000000020000200000003003ccecf6ae2c8771e7c5b78733f888f9be0dcecdb1d8f4e6546f78def3575220000000bd7ff31999e1ddefaa315229ebdef3f3d79999e58d69dabb1741a354e64f06064000000083887dec19af067fbb944d6c13b04b42ecba032fa14c3167043e33c7ebb10c0c209cfeef7c8ebf2f61081ef76b5d021c204145ce822067ca4218d24bb67692fc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f65e9d5627dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31270734" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf0000000002000000000010660000000100002000000025669dcabe6eb6704ffaa2b59cba7f499002d11b080a21d6e247d51991df9761000000000e800000000200002000000012d8a57eef6462014220cb5223779e98c52b1e67ae9246b18acc95e00c652911100000004cdd360dcb7c9a18d82acb634252c4274000000055bfb405247c3cf1e76c3731ccf8af6b621a54ed3709a3e237927a90b82c06f3b11ffef81a995e94d37ac4dec1e3059f9b8768463741804008767801399cee9f iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3648 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3648 iexplore.exe 3648 iexplore.exe 4468 IEXPLORE.EXE 4468 IEXPLORE.EXE 4468 IEXPLORE.EXE 4468 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3648 wrote to memory of 4468 3648 iexplore.exe 86
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v15O-m1-eL.svg1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3648 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4468
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 d90b86f88f7e04235d5afded8e32ea7e3c3d329ba09e3a563445ccc12ef16a88
- MD5 2ecac02e48cd0a7339d865f5dfe4cd2a
- SHA1 62b9167ba7b7e8eda79c618b271ec210c35e2c1b
- SHA512 e51b15ad56ce1fa0c6f40039cff23d5bfd584c784d6347de5b872e336eecad24e61f0e3eb148b526a4cb1c6d8f6cee719102f6a547e4316911629e3c17fa57a0
- TLSH T11EF09741943AEAC03900F9CC02798A3FB410A02200E4209AA67C94BF44967A9A78E838
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 7e97147ccf3f7529dacc3413feb4d921c241725c5058ea524b9e763428c65f3c
- MD5 93708784da1e304fb3c2a68882182e8f
- SHA1 fdd44331e5bf11e4a1e8ee9566110a4d311e6040
- SHA512 3f37430d06596e1e2df25b8525e037e53dc4d1408d750e86aaf9c6a5ff9fa7bbfe70bc3e7caf9889b391862bb24b81c3cfa8f5de5a7c60ac641fb8d729f1399e
- TLSH T189E0C03412FE011FE0F5E4355FD97421C96EF132042A93B529D45B0CBB02740EC02A25
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S9SIAAA3\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH