Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/09/2026, 12:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-21_6bc2c68602153518aa22fa2fba2b18b6_amadey_elex_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-21_6bc2c68602153518aa22fa2fba2b18b6_amadey_elex_smoke-loader.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-09-21_6bc2c68602153518aa22fa2fba2b18b6_amadey_elex_smoke-loader.exe
- Size 2.8MB
- Sample260922-psfmcaee25
- SHA256 3fee1a86625f5610c64d00324bddc97163cf482f9d008df7738df5667539c74b
- MD5 6bc2c68602153518aa22fa2fba2b18b6
- SHA1 55def81a1a3abd4e9074eee93d10527acc390754
- SHA512 02bd257ea35aedd9b8616069a2fc3c03f3203a57aabab9930d3e480efa0f912b024c0c80f5a6001681139b6a5d99832b4d23e60c99596aab8f49a0668474dd6a
- SSDEEP 49152:zACqIwBXHuZStR6BohzEOZ/VEoyJGKQkE0oTW:zACXeXHfH6WVEo4XE0o
- TLSH T105D54B00E241412AEDF724F44EED726EA11CAFA0176450D782C46AFE9F7AAE13D3535B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
gozi
Attributes
-
build
217111
Extracted
Family
-
gozi
Botnet
-
3555
C2
-
settings-win.data.microsoft.com
-
v60yuuu1415.com
-
jlb81hdvernon.com
-
b99vxjju.com
Attributes
-
build
217111
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-21_6bc2c68602153518aa22fa2fba2b18b6_amadey_elex_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ielowutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007e2c040b5a3bc54ba73777c6c589b44c0000000002000000000010660000000100002000000099664a6eaad9c6ffdce33e3e6e27568879c8f4ab9f16d30d8a132ba0ec3238e5000000000e80000000020000200000001d95db7243495411cbb5de6830b9e0c71bae6a5ee289b6f86bfda7acb1ab56e020000000eee58909a5b11ff88a84e11cba2b247ee3fe18b447453766eb08bfd06e708291400000000456b03959d0b4c5bcaa48936a4c797fb4644704f521a944ac3d90dbd8494b0fad76d707c619818f4ac0515e4fb36304ccfc1e202660d9ae9740f757995a034e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70a06483974add01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007e2c040b5a3bc54ba73777c6c589b44c0000000002000000000010660000000100002000000091a3a0584f27457ba66f42b33d2642327aae0b8b30b2def2068554aecf136226000000000e80000000020000200000006d603c67f52c762f3e5a5b3319f2cbb2df9f4815079df79165d53bd3977579b650000000ae5df2ad84a80ac8ff543a81d083415104065fc04a69ef08b6a33a5648d93a3030c8aa1315f8d405810f223ba1bea6235cbb60503b4dd0f926b8760ed3d2a028424a039320b54c8d011c324accf3904440000000ae730c758e23c3d39f94c01702ff8b3a6a626b15fd814b38a807d863cd3b24f2a8dd5c2772fb6a52158ea33bd5bbbfeb0b3ab9d3e0c3264a9205cc9ccb6dc91f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007e2c040b5a3bc54ba73777c6c589b44c000000000200000000001066000000010000200000007294eed47568ef2f496e24f53a3ba50f1a70593345a9273644e78961cebbc7ee000000000e8000000002000020000000bef002e9ef5e051f5c2b493b2120c9b43f64a2ec5d0866668f213f112e8a0a9250000000726cdf913964fe55d96050b0af623774b4aef1e1a2a7926f13d3b521e26b2d3e195a8730bfa830e65b53178930c7141614a4af78fd506d840624e1afdf88bf32874cd06d41f71016a187ea4702243eab40000000495eeaecafe13d159bbf192f5af8659a8600ddb188d0cc4979451104da6dcfb27dd5a9f5c12c8de65c653f2d50d9093ef9294f7e411e845212aa202d07b47436 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7068935a974add01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20A97DAF-B682-11F1-A93A-721A714DA675} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007e2c040b5a3bc54ba73777c6c589b44c000000000200000000001066000000010000200000000e8a6c7fb42564118e2c18d2e24e98c711b0b925de56d3e9f25a14833b963574000000000e80000000020000200000002358a86f959c0beaeb9ba6aad52abdb0306ea023841ca74c4bef57dc5e7b933620000000326d1c41d3efb240b83f2a56b11200878838a06ad882cc63530c25808bdbedfb4000000078e1f4c7c875f339bc65a1ac12e0169a8cffa0dd8cce20f4195b7dd2657a2722b86c1e760af84207108dba9b3c7c663a0b6a9ae1db51fde78a551417639330a1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\SearchScopes\KnownProvidersUpgradeTime = 2de166d84542dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007e2c040b5a3bc54ba73777c6c589b44c0000000002000000000010660000000100002000000052c4d6c7c64284c9f29c8dbfc5c316413cb330b9658b33386cf81536328fc890000000000e80000000020000200000006a37ea6796afece92d17964aa53d519757bcf255e2062a345756247ff9aff7c720000000d42e3940c07ffbf1d1dd1f833fda2586ce661ddd2ee6bc6d6d41c6726ad30913400000002600e5ff81fd02f9dabb0bc81d9328300f9ae8cad6927a9c74f44793155698f52d7767188152f146201b7ecb5c56f90c563c3ca3d3ade23a6c20e7ff3532e46b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007e2c040b5a3bc54ba73777c6c589b44c00000000020000000000106600000001000020000000e499c40c7b23e06b54e6e26825a8deebe7802e9232a73396738beb64922c4ce0000000000e800000000200002000000028a8335395305c81f02a7ea3a7a27836a21325b84c6d89b595a8d2e5f19f49a320000000e74596faf30688c7c0b06c957151c78ba23cf517fdbf1d8094ba0e7cd4c0403f400000000539fad732637c72f4adaa126f741063dd2ba59d23bc9d613f8711844b4ed882c6bbb3f52618869b30152c1334ae667fb5cb522d3a0e15e90316496d371954f9 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{565AD510-B682-11F1-A93A-721A714DA675} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Suggested Sites\MigrationTime = 2de166d84542dd01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3CC2C1D4-B682-11F1-A93A-721A714DA675} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007e2c040b5a3bc54ba73777c6c589b44c000000000200000000001066000000010000200000009b26d3b7e081d4d27765b884aee5e67cf27fd1528c049cc9af7f01039e1efa5a000000000e80000000020000200000005f7af445d7a453ff68b79bbfb5712d8f21ab02fdb5eb1b7647e4aab2c0f8e7c210000000b47251d2e242608c7516be5f9b87f4bc400000000d011852375a9f362295945a9d4d144f91465c8f494f7fc0401a8f313786c7fc673d4ca4e817fb113ab751a591ba1c0c98cff9afc215151169d913bcef9164c7 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1924 iexplore.exe 1496 iexplore.exe 5140 iexplore.exe 3388 iexplore.exe - Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 1924 iexplore.exe 1924 iexplore.exe 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 1496 iexplore.exe 1496 iexplore.exe 3452 IEXPLORE.EXE 3452 IEXPLORE.EXE 5140 iexplore.exe 5140 iexplore.exe 6032 IEXPLORE.EXE 6032 IEXPLORE.EXE 3388 iexplore.exe 3388 iexplore.exe 972 IEXPLORE.EXE 972 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2564 1924 iexplore.exe 92 PID 1496 wrote to memory of 3452 1496 iexplore.exe 95 PID 5140 wrote to memory of 6032 5140 iexplore.exe 97 PID 3388 wrote to memory of 972 3388 iexplore.exe 99 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-21_6bc2c68602153518aa22fa2fba2b18b6_amadey_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-21_6bc2c68602153518aa22fa2fba2b18b6_amadey_elex_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2520
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:3504
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2564
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1496 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3452
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5140 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:6032
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3388 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:972
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~DFBCD934B05682CEB5.TMP
- Size 16KB
- SHA256 92de9bb9b6a13edaef394545aa83049a1b1f0c2c8ee6dcfa869a64d32edb3c2a
- MD5 963cac5a998365d77b8ea254a67b7faa
- SHA1 3457caa1fe720bfa194a032b1c6acdeabe1988a2
- SHA512 51507870d6fdaa87b8b122a14a344c6b585081bfeef2a497de0a38cc6c926fd5f8cb75b038e87cbce3ec177640defca42841ace2c9b12834a4f00c6427b2065f
- SSDEEP 12:i9l4atL+NK7vbzIVJKg7580q7bKd6Lsb6gl5DGKreMlSgAF:i9lx+NK7Dz6/7M06LFgl53reMA
- TLSH T15C72247C3ED70020FEB3DA3E0EC65A70262EF1D12A8A937841F50229C703284FE52829
- MD5 SHA1 SHA512 SSDEEP TLSH