Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 09:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe
- Size 4.0MB
- Sample260810-k2faqavfph
- SHA256 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c
- MD5 762ff57b5ec12b3d523b7f28918ac2f7
- SHA1 5e145dac3a4c583eeef1b9bc043d734d4720e390
- SHA512 eaf563d198b7ce3f091e37828e93a57fe8d9ed6dc7246b2cc7f5563443e599fd7524ea797ccf74ea5e894c5deab611f8778776dbd1e799e4ae0ad9a4a9dcd77b
- SSDEEP 49152:DScAmPWwDSVxKphdY/CW1sBlq7oQVAqq8j0hb/4R6:OcAmPLE6dY/j7oQqV14R6
- TLSH T1BC168C02F98380B6FB4D2530085E677AD231DE894725EBF7A354FD199A325C35D3A22E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3048 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe - Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX19D0.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX2CB8.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX19A1.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX1B39.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCX1BA7.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX2C97.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX2C87.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX2741.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX177C.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX178C.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX288C.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX28EB.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX2959.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX27BF.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX285C.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\1\ = "&Open,0,2" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Printable ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Printable\ ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c?.exe /dde" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultIcon ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec\ = "[print(\"%1\")]" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E} ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ = "PDF ??" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\server ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c?.exe,0" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultExtension\ = ".pdf, PDF ??(*.pdf)" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\0\ = "&Edit,0,2" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\2 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\MiscStatus ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\1 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\LocalServer32 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c?.exe" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec\ = "[open(\"%1\")]" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb\0 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable\ ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\3 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\3\ = "Foxit Reader" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb\0\ = "&Edit" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\0 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DocObject ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable\ ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c?.exe,0" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\2\ = "PDF" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DocObject\ = "0" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\ = "PDF ??" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32\ = "ole32.dll" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c?.exe /dde" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ProgID ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DocObject ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\CLSID\ = "{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c?.exe /dde" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\MiscStatus\ = "32" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\CLSID ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3048 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe 3048 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4880 wrote to memory of 3048 4880 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe"C:\Users\Admin\AppData\Local\Temp\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe"C:\Users\Admin\AppData\Local\Temp\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3048
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 590KB
- SHA256 beb05116099256e07c0ab682310934c808ac4e5294def27b66ee94a966c2fb5d
- MD5 f67d83fb8e23cb70822cbe08fad2b48f
- SHA1 0c804cc6a1c1a93908816abdf4075e64d3394621
- SHA512 0f44f08c0708b3c29ada44f3acbae86f1794d39cf2d296d34bc3beb216d71fbebda1c6a8c5fbc8574a9f6397eb59cffaf64fc4e5b603233b5c20bee63086d967
- SSDEEP 6144:BpUWWHQCQPj1PBWbSNe10iXI7WTeMlOps4vWoLQLO76tlVr1Il5HlrJHU7kfLeeE:B3MS86nHrUA9HVlK8SQBJ9t4f15rL
- TLSH T1A0D49E81F3D847E8E06AC534CA428645EAB17C921B61B6DF0390767E2F376E54F3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe
- Size 4.6MB
- SHA256 f176fa538621048554bea2975499c8a7e27d9215cb59f1888b783a7fd11dddd2
- MD5 3f5f10b66488540b293d791d27387eca
- SHA1 d7020d712a11c0112ed02f469a25f8bd902d8b2f
- SHA512 36a2fce46101ae87a69fc540e3210e2b10a831d2136ccb7650f47443b08c67b5e17c519cccf2a370165637bd6b17fbf656b46dca6bd447f28ad075acaa63f175
- SSDEEP 49152:DJGYRJLudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:DnJijnUdYd+RaAj
- TLSH T192264903B28984D4D049C074CE1AD232AB617C9947F161EF36D4BBEA3A73AD47A3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
- Size 1.9MB
- SHA256 cd1c02f391724b38678632214464a0c789a439a8cf04e49f1076bade73ae5248
- MD5 7ba323f688b1b8ebeb3809806fcfda45
- SHA1 d8668a85e1de2a5577cab6649627438a26f0f093
- SHA512 7638353452063c470d5f30a233dddf81cf8bc7fa75ebd11a94c3fe2f5e7da61bfcfa92ae156a3cfd02c097d8c454f820ab9a46fbb0b9b0591b001496c0da6699
- SSDEEP 24576:7GP5kAGu6McqpA7D9ruO3O7Q7OBLLMdus7CtW7KSdHBxmRkkkkkkklQXBysWAb:aPZGu6qG13O7Q7gLYduZrSdHBAVfb
- TLSH T16B958D03F69A80E5E05DC2B8CB768B35DAB17C555F20A6DF0780BA652E77AD04B3D390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e5816bf.tmp
- Size 1.4MB
- SHA256 d3b78e7ed236350a7647030fcb7dfcef8a154aa67363741b13f53268a23ae01c
- MD5 8a74abcf6ab1f04e308431cd87cf3e98
- SHA1 edbcdf9a1ef1def591b6b51749a277f18519cace
- SHA512 c64c45f4943d88aad4ee274c2b0ad76096a92a8ea184fbabad0de3e52c0c93a9ad3848a7ace398193a95937949220a30234c31e92bcabc1ad07d1b83a2dfc25d
- SSDEEP 24576:YZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:jY2fF8FhmS86IUJWQn+6h27d6
- TLSH T1AE657B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe
- Size 4.0MB
- SHA256 250c50bbf267c2208701faba8714acf70d952580900b4c1a2ea6e7a9b9a4ea82
- MD5 b1191e63619b914fe659dd64ddc3b0b8
- SHA1 81d3f0279e4a2ed6177f0b66630a3fc4031ca746
- SHA512 23bc1eb3e5e656e16af76878b212f20237d7f8b258c670fc8a2f512b093ed05945d0cb53179fb16afc3d4ce121c120f91bd0237fe76a0acd90375a83a521c7bd
- SSDEEP 49152:yScAmPWwDSVxKphdY/CW1sBlq7oQVAqq8j0hb/4R6:9cAmPLE6dY/j7oQqV14R6
- TLSH T1B7167C02F98380B6FB4D2530085E677AD231DE894725EBF7A354FD198A725C35D3A22E
- MD5 SHA1 SHA512 SSDEEP TLSH