Overview
overview
4Static
static
1small_svg/...eM.svg
windows10-2004-x64
3small_svg/...eM.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eH.svg
windows10-2004-x64
3small_svg/...eH.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eQ.svg
windows10-2004-x64
3small_svg/...eQ.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eM.svg
windows10-2004-x64
3small_svg/...eM.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eM.svg
windows10-2004-x64
3small_svg/...eM.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
small_svg/small1-v10J-m4-eM.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
small_svg/small1-v10J-m4-eM.svg
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral3
Sample
small_svg/small1-v11K-m5-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
small_svg/small1-v11K-m5-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
small_svg/small1-v12L-m6-eH.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
small_svg/small1-v12L-m6-eH.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
small_svg/small1-v13M-m7-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
small_svg/small1-v13M-m7-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
small_svg/small1-v15O-m1-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
small_svg/small1-v15O-m1-eL.svg
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral11
Sample
small_svg/small1-v16P-m2-eQ.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
small_svg/small1-v16P-m2-eQ.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
small_svg/small1-v17Q-m3-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
small_svg/small1-v17Q-m3-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
small_svg/small1-v18R-m4-eM.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
small_svg/small1-v18R-m4-eM.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
small_svg/small1-v19S-m5-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
small_svg/small1-v19S-m5-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
small_svg/small1-v1A-m0-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
small_svg/small1-v1A-m0-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
small_svg/small1-v1A-m1-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
small_svg/small1-v1A-m1-eL.svg
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral23
Sample
small_svg/small1-v1A-m2-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
small_svg/small1-v1A-m2-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
small_svg/small1-v1A-m2-eM.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
small_svg/small1-v1A-m2-eM.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
small_svg/small1-v1A-m3-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
small_svg/small1-v1A-m3-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral29
Sample
small_svg/small1-v1A-m4-eL.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
small_svg/small1-v1A-m4-eL.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
small_svg/small1-v1A-m5-eL.svg
Resource
win10v2004-20260513-en
General
- Target small_svg/small1-v10J-m4-eM.svg
- Size 24KB
- Sample260809-xem39steqd
- SHA256 d78815299fd2ba2b3fea05f7c5662295c55e9b87f5659718b5dfc273f4fe78dc
- MD5 8c786d4da80ac1948a137a727a12fd7e
- SHA1 0fb0844fb479811339f7104eb281a91b930ca91d
- SHA512 838d9d0ec608d1e47dd3722b8ccd401e03eb334982cd433a7f896e66b62a9e69b9d2d3e8209914dd8563af8734ee368742a979b7e861efd480707c961c193a0e
- SSDEEP 384:c5veJtU7WSADG+2tM8LSB7XXZwuw5wE1/7PRP3uDCr:c5vQjqZmDK
- TLSH T11FB21F6437F87C978BD803479D02FC68461FA877C4A8678D93D7D4E8A988368FB6C560
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{96C387E7-9422-11F1-AF70-F6DD02F7A3D1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf00000000020000000000106600000001000020000000230a687ead415cb4666778922a3b9f7918847c5ffe1df9e124af84e82425ca40000000000e8000000002000020000000d7a60343f2c373f49431be79aad9282708dc25f4ed0db000aa7b1957a2cd3a7910000000fa9b517f2d0e459fa58fc57c274a35c040000000341334e62f9935b1f12cfbc24aebb35504543972f6b604ce2b72d22998df1e364d4cdf964c56b0c7fbcf36f54aa68f0dce6084572de753752c156768faa216f9 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf00000000020000000000106600000001000020000000709f3ae4f1b45004b97c917416717783028a5d9ed3adad7460b345a1d3ac2c3c000000000e80000000020000200000000adfd082df4aed4b2893d683962f34203ce0df200ccf7f94113acc106ae05b8c500000004ac22aa880c82ea7766a04b85fd70ee81a4c64b4ac480aa06ae079909cd928bfacff3e352f187692abd3737bf5b6f880f0819fed1b92a49dcf8d6e10c6dc770aa9361ef5978f073e658459a6c21a116940000000daa31bd0781c81132f669cb31dff032cff1c17c80e3cd57441487df27f886947b147f4068131fb40dfc4e4734f098e7f0fd532bd23a98f7ba11ff75382aff350 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31270959" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf00000000020000000000106600000001000020000000742b419f5e769a23095e24e285676f71a24f93400918ee8fc943b02c29e86646000000000e80000000020000200000008e0433a2ea0dd04c11954a09a657cc0d93c988fbd7a2edc369dc69705ee413af5000000049cc5b5cf8e7d96b6588bc04c5067edfbc20e490106e83f9ea3c82c32cc6cfdab3b5850f33d61b388e4bf3766a3506b633ae285d8fdf568e29e5f862d5e877b2db6bf9ab8d286d4be271e325a56fb331400000007fdc66fc9072ba4508c23ce9d7d165f327d7924239cdc24c1b759abdf127703c1b49b515421489f2d3e9b0e1d38c0314f52a1036b1dd9530382e3c4380a25963 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31270959" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "493066154" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf00000000020000000000106600000001000020000000cd79365e6775b0f02f7b489ceb62a767a77c5fc7e33000cd7f515de03a546f81000000000e8000000002000020000000b65679e58887b54dae7a80bec051bccad6aa87c2077efebb377079325b42e42b20000000003df876d273ac4159601c6f3a03119dd096a9b5e822a46fb15e75ddd1e4980e400000009d347ed6bbcd652ee53b1c47909d4bcf2862a9c6d02a389c46cca03a109ca0a9aaeaf898d4be556d568da5d2da539175a6b3a761916c5bf0a6bcc7be410dbdd3 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fb1ace3728dd01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 604016ce3728dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1801997217" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1807309566" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf00000000020000000000106600000001000020000000e367c23c4e881bc69b034c058b33b9e50231a598c41d6f07eb0d2c8317d71ced000000000e80000000020000200000009d23768e782c89337fe6604ca3ffdcde91f414bab7d9ca55ab7eff9fc34e1fb5200000009143850a8d24af6bc73df7647052d566b63ed4657751811cbfe1bd552da1ca69400000001b867766d1b4bc6c9acadc12a4c6dcfcf5211ce50f1d97c30c1150e4772d812729ca40932c3744e0abb59429b3b4fc9598bf14abc4e282abd5eeb08b166c21ce iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\KnownProvidersUpgradeTime = b7e41e0878e3dc01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf00000000020000000000106600000001000020000000269982f5f0182dd74d70ae5a124f1196b959aa79daef3f3d864f58057929c708000000000e80000000020000200000008cb2c731a0c7c56d5f530df1e79bf2444a68c4e96e31c5d370f508b37256e2ce10000000857796a335d31c2f9c153ae0350192c340000000c2d59ec345843d777d1fd515e9280ac2f4a8c71c9010f6e2481daa2c11dee93985eb34b785c9fcae5f4ee672738af396729f6ee247ec80ba7165821999f731d9 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 1864 IEXPLORE.EXE 1864 IEXPLORE.EXE 1864 IEXPLORE.EXE 1864 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1864 2240 iexplore.exe 86
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v10J-m4-eM.svg1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1864
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 b6fd7591c4a27973ec150915ee89be0a402ac65c33854932505027be356b21d1
- MD5 6b6f64e3af4dbdd5a64117c06537d852
- SHA1 53f0b19cd838af32c90f5519a6429d06512a8fbb
- SHA512 87e156e0442445736309cdcd077156f256cd99aadf67eeae677c887aff9758df978f861fbb32fabfdfab0f4f94e80ca96128f3fade0c5d4051a3b55423ed8acf
- TLSH T167F0DCD180BCE870AAE0F8FC21B4D6F030B0D8AE0844561AB028A1F10E52BB97F1F475
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 c5bf72e4b3d470ac19afa964d594fc677681ec6e5e57cf4d1c198c29a833a173
- MD5 cf004ddc33689ad1760b18bd0c633c8d
- SHA1 370626b86ffe545742c585acf8eaadfa1ea30136
- SHA512 8bfe230ff07783e4fed5288fd6fd9c988bd6ff1b3b78f6722a3eca258bf861ff9f8484d29065cfda86f45255e6bfd7732b97926fb1b7451b3347773091214865
- TLSH T18FE0C02811F6412FF4E6E4358BDD742245ADF02A152892B52DE55B08B746A00AC03F35
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S9SIAAA3\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH