Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 09:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe
- Size 4.0MB
- Sample260810-k2faqavfph
- SHA256 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c
- MD5 762ff57b5ec12b3d523b7f28918ac2f7
- SHA1 5e145dac3a4c583eeef1b9bc043d734d4720e390
- SHA512 eaf563d198b7ce3f091e37828e93a57fe8d9ed6dc7246b2cc7f5563443e599fd7524ea797ccf74ea5e894c5deab611f8778776dbd1e799e4ae0ad9a4a9dcd77b
- SSDEEP 49152:DScAmPWwDSVxKphdY/CW1sBlq7oQVAqq8j0hb/4R6:OcAmPLE6dY/j7oQqV14R6
- TLSH T1BC168C02F98380B6FB4D2530085E677AD231DE894725EBF7A354FD199A325C35D3A22E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1412 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe - Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX4C7F.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX47D6.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX4776.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3CB5.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3C76.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCX3E1F.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX4855.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX4894.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX4C00.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX4C6F.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX47E7.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3A42.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3DB0.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX3A32.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX4796.tmp ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Printable\ ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\3\ = "Foxit Reader" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultExtension ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E} ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\0 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb\0\ = "&Edit" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DocObject ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ProgID ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultIcon ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c?.exe /dde" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c?.exe,0" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DocObject\ = "0" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\LocalServer32 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable\ ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\2 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\CLSID ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultExtension\ = ".pdf, PDF ??(*.pdf)" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec\ = "[print(\"%1\")]" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ProgID\ = "FoxitReader.Document" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32\ = "ole32.dll" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb\0 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec\ = "[open(\"%1\")]" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c?.exe /dde" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Printable ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c?.exe\" \"%1\"" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\1\ = "&Open,0,2" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\3 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DocObject\ = "0" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\CLSID\ = "{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\MiscStatus ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c?.exe /dde" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable\ ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ = "PDF ??" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DocObject ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\server\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c?.exe" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c?.exe" ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1412 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe 1412 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4112 wrote to memory of 1412 4112 ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe"C:\Users\Admin\AppData\Local\Temp\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe"C:\Users\Admin\AppData\Local\Temp\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1412
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 590KB
- SHA256 2fc6121f724afb3885415d798d746f35a05fda835e49bdf5692596873db967bb
- MD5 8c7ae09b76418c244d8ee17a7097ba59
- SHA1 31506ba948dfaa34a7c6283101a28389a17b82fd
- SHA512 fc299df67d722709b55d46c2a3af4436dda8da98124612e9ffb6686d256e9f60c30528589fcc2aa8ad0cdf462acf13578cc2ea1021fd0a38faeb14012e47317d
- SSDEEP 6144:B2UWWHQCQPj1PBWbSNe10iXI7WTeMlOps4vWoLQLO76tlVr1Il5HlrJHU7kfLeeE:BqMS86nHrUA9HVlK8SQBJ9t4f15rL
- TLSH T17DD49E81F3D847E8E06AC534CA428645EAB17C921B61B6DF0390767E2F376E54F3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
- Size 4.6MB
- SHA256 e657308d2301360a01f2cc9d5917284c6b8317926acd9a8f60143dfc56058b38
- MD5 9aa7f89c2a13396a707dfd84ca598d13
- SHA1 091b015d45046516572847cba389b2b46b930dfc
- SHA512 0495ae976008693dc75ee81345d5e945a9e293f51732f3fce53eb3d109cde92fea26aaab6ddd7ca62893a6d42195726d702d1e86866b4a4f9ae18408ddacf254
- SSDEEP 49152:QJGYRJZudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:QnLijnUdYd+RaAj
- TLSH T1B0264903B28984D4D049C074CE1AD232AB617C9947F161EF36D4BBEA3A73AD47A3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e5938d9.tmp
- Size 1.4MB
- SHA256 d3b78e7ed236350a7647030fcb7dfcef8a154aa67363741b13f53268a23ae01c
- MD5 8a74abcf6ab1f04e308431cd87cf3e98
- SHA1 edbcdf9a1ef1def591b6b51749a277f18519cace
- SHA512 c64c45f4943d88aad4ee274c2b0ad76096a92a8ea184fbabad0de3e52c0c93a9ad3848a7ace398193a95937949220a30234c31e92bcabc1ad07d1b83a2dfc25d
- SSDEEP 24576:YZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:jY2fF8FhmS86IUJWQn+6h27d6
- TLSH T1AE657B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ad9e8c8c78eaf8bce4f97970c6aec39e3d18893ef23915bc98b014819ca0e51c.exe
- Size 4.0MB
- SHA256 250c50bbf267c2208701faba8714acf70d952580900b4c1a2ea6e7a9b9a4ea82
- MD5 b1191e63619b914fe659dd64ddc3b0b8
- SHA1 81d3f0279e4a2ed6177f0b66630a3fc4031ca746
- SHA512 23bc1eb3e5e656e16af76878b212f20237d7f8b258c670fc8a2f512b093ed05945d0cb53179fb16afc3d4ce121c120f91bd0237fe76a0acd90375a83a521c7bd
- SSDEEP 49152:yScAmPWwDSVxKphdY/CW1sBlq7oQVAqq8j0hb/4R6:9cAmPLE6dY/j7oQqV14R6
- TLSH T1B7167C02F98380B6FB4D2530085E677AD231DE894725EBF7A354FD198A725C35D3A22E
- MD5 SHA1 SHA512 SSDEEP TLSH