Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 07:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe
- Size 4.0MB
- Sample260916-jbyhyaaa63
- SHA256 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53
- MD5 9fa884411daf04c7bdc5cab5fb08dac1
- SHA1 e559feae3a58e109dcfd8ba383368437006b334d
- SHA512 42ecb0049196894e8db3745f31eaf32540a93828f6a58d1715ab52e546d0f17037803cf2444c52f56b8a6f9d48943bf864a5353b4328b52d125a110fd27eef69
- SSDEEP 49152:ZScAmPWwDSVxKphdY/CW1sBlq7oQVAqq8j0hb/4R6:scAmPLE6dY/j7oQqV14R6
- TLSH T18B167C02F98380B6FB4D2530085E677AD231DE894725EBF7A354FD199A325C35D3A22E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5644 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe - Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXF4F7.tmp 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCXDED3.tmp 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXDF03.tmp 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXE2CD.tmp 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCXE456.tmp 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXF13C.tmp 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXF19B.tmp 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXF517.tmp 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXF528.tmp 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXE30C.tmp 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXF0AD.tmp 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXF05D.tmp 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXF07E.tmp 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXF0DD.tmp 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXE3E8.tmp 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe - Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ProgID 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultIcon 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec\ = "[print(\"%1\")]" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\0\ = "&Edit,0,2" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DocObject 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DocObject\ = "0" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53?.exe,0" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\2\ = "PDF" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\CLSID\ = "{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53?.exe /dde" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable\ 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ = "PDF ??" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\1 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\0 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\3\ = "Foxit Reader" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\MiscStatus 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\server 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\LocalServer32 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultExtension\ = ".pdf, PDF ??(*.pdf)" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53?.exe /dde" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E} 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\1\ = "&Open,0,2" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Printable 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53?.exe /dde" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53?.exe\" \"%1\"" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb\0\ = "&Edit" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable\ 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\server\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53?.exe" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\3 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\MiscStatus\ = "32" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DocObject 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32\ = "ole32.dll" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb\0 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\2 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Printable\ 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\CLSID 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53?.exe" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53?.exe,0" 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5644 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe 5644 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2520 wrote to memory of 5644 2520 39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe"C:\Users\Admin\AppData\Local\Temp\39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe"C:\Users\Admin\AppData\Local\Temp\39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5644
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 590KB
- SHA256 5dee053333a6458fce90ad2ee81a13fcf3d12995c1f8a659a189f41c0a9d8582
- MD5 db2c715516a26571948fe8da2367fa26
- SHA1 aaf1982770d42e292dcab33b121a0cd7fa21914a
- SHA512 3cec07ae97ad9d6865edc85f7cddbe38eaa9e6e41540a7548c8ad780c18d21358545687f78551a51831d39b5ca53e73e12423fc5dbf61d331bd03b5e9cc5586a
- SSDEEP 6144:BxUWWHQCQPj1PBWbSNe10iXI7WTeMlOps4vWoLQLO76tlVr1Il5HlrJHU7kfLeeE:BvMS86nHrUA9HVlK8SQBJ9t4f15rL
- TLSH T192D49E81F3D847E8E06AC534CA428645EAB17C921B61B6DF0390767E2F376E54F3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
- Size 1.5MB
- SHA256 01fbf971bf249af674b738bdf6c01598e0816379992bc3398df3941008145808
- MD5 cd692026e4aa720d271e37d6001c076c
- SHA1 90ed9c8e5bb83d13993f0d7da8420c1ce6541153
- SHA512 28780c833000c585af4ba9b746a3bb8b106fe50240d2eb53d58a02246019eb47483b29a61a04416fa3e163ff8ce80cdc429f6df0a068f349929bdae163ee3e5a
- SSDEEP 24576:lyoteh6euUHmEhK7eTuNdfxINakEtv9kWG2L1oaedpEukUoygGmq/Sl:lfehjvHHKTdfxINPEt99G2Bo7EukU1a
- TLSH T1D9757B03F29900E8D059D1B4C7468536EAB2BC454B24B6EF0B90B75A2E7BFE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e58dd6b.tmp
- Size 2.8MB
- SHA256 aa0a34300a93a2882b241b7fbf23e590f594f811fabfb8fccbc789796b7fa80e
- MD5 5fb303dcaf8de9324c9e4824718c0195
- SHA1 068710eaefe9da6aac750553546c08d2ad723b3e
- SHA512 1b117e044862a9a6bfc55984e6fd5093e0baa413507ca3055becd321ee602dbd5fb41c1bfa5e21327390e83ed50f6d1dabfea6e84896c11bb284578df8e7e7ee
- SSDEEP 49152:jY2fF8FhmS86IUJWQn+6h27d+Y2fF8FhmS86IUJWQn+6h27d6:jbOjjst4bOjjsts
- TLSH T1B6D57B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\39f1ca5bb19df7e346cd3c4f165d8df6344804047302b4601c35d7e0bfad5e53.exe
- Size 4.0MB
- SHA256 250c50bbf267c2208701faba8714acf70d952580900b4c1a2ea6e7a9b9a4ea82
- MD5 b1191e63619b914fe659dd64ddc3b0b8
- SHA1 81d3f0279e4a2ed6177f0b66630a3fc4031ca746
- SHA512 23bc1eb3e5e656e16af76878b212f20237d7f8b258c670fc8a2f512b093ed05945d0cb53179fb16afc3d4ce121c120f91bd0237fe76a0acd90375a83a521c7bd
- SSDEEP 49152:yScAmPWwDSVxKphdY/CW1sBlq7oQVAqq8j0hb/4R6:9cAmPLE6dY/j7oQqV14R6
- TLSH T1B7167C02F98380B6FB4D2530085E677AD231DE894725EBF7A354FD198A725C35D3A22E
- MD5 SHA1 SHA512 SSDEEP TLSH