Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 08:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe
- Size 4.0MB
- Sample260925-ka3xpstbpb
- SHA256 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0
- MD5 6253f492912b234bb9c6005b36a86ccf
- SHA1 85b36b0ea9a0c6e22fab7939cc134715138bc4a5
- SHA512 5280a72c3f965bfc047c4ec38b77fd973e27e100317d1bc7a98827f7d95e07f3342d1490f10fad2de6fe8045f2e8b730356e44718b318ec44f6d7b2d7239ff83
- SSDEEP 49152:fScAmPWwDSVxKphdY/CW1sBlq7oQVAqq8j0hb/4R6:qcAmPLE6dY/j7oQqV14R6
- TLSH T1A9167C02F98380B6FB4D2530085E677AD231DE894725EBF7A354FD199A325C35D3A22E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4760 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe - Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXAC53.tmp 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXACA3.tmp 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXB06D.tmp 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9CFA.tmp 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXB0CC.tmp 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXABD4.tmp 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX9B52.tmp 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXABE5.tmp 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9D1A.tmp 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9DB7.tmp 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXAB76.tmp 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXB05D.tmp 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCX9E16.tmp 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXAB46.tmp 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9B62.tmp 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe - Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E} 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DocObject 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Printable 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DocObject 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\CLSID 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0?.exe,0" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\3 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\server\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0?.exe" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32\ = "ole32.dll" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable\ 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ProgID 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable\ 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\1 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0?.exe" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0?.exe /dde" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\ = "PDF ??" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0?.exe /dde" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb\0 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb\0\ = "&Edit" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\3\ = "Foxit Reader" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DocObject\ = "0" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultExtension\ = ".pdf, PDF ??(*.pdf)" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0?.exe /dde" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\0\ = "&Edit,0,2" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ProgID\ = "FoxitReader.Document" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\LocalServer32 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultIcon 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ = "PDF ??" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Printable\ 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\0 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DocObject\ = "0" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0?.exe,0" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\2\ = "PDF" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\2 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\MiscStatus\ = "32" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultExtension 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec\ = "[open(\"%1\")]" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0?.exe\" \"%1\"" 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4760 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe 4760 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1768 wrote to memory of 4760 1768 295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe"C:\Users\Admin\AppData\Local\Temp\295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe"C:\Users\Admin\AppData\Local\Temp\295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4760
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 590KB
- SHA256 e4becc859c0638a902deca7d3695d6ccdd75dc0aeaa950f2e8a6099b21f3a6d3
- MD5 44f72a134cc45d74d1d60475e85626b8
- SHA1 f6e1d10474b8a4c62fc91fc2f3552eaef4f8d19c
- SHA512 4027a9c3a433fa572656757efeccba126e35ebca221faa01a09555deb93fe0d9df9a03a7356bb9e2092bd29ec6d1e75d0319319210cd92cd65fd595c5a80f442
- SSDEEP 6144:BkUWWHQCQPj1PBWbSNe10iXI7WTeMlOps4vWoLQLO76tlVr1Il5HlrJHU7kfLeeE:BwMS86nHrUA9HVlK8SQBJ9t4f15rL
- TLSH T1F7D49E81F3D847E8E06AC534CA428645EAB17C921B61B6DF0390767E2F376E54F3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe
- Size 4.6MB
- SHA256 3d2fb8c882f747d738131d4b7ee7698a334567ac49a7b5e16dd25bbe9c9629b0
- MD5 0bea836b76284f52e26c7f5396be3b01
- SHA1 f4fb6e552a7118b7703ebfd8a421153b6c1eb5d5
- SHA512 f0faf2ff6c9473aeb73887206b2d6d6415058169eb6f610d1e34c58bfccb56073851187a06a9c4a6ec382c5b30fe134174e45e654a627a594586fef714fe3ad6
- SSDEEP 49152:0JGYRJLudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:0nJijnUdYd+RaAj
- TLSH T1B0264903B28984D4D049C074CE1AD232AB617C9947F161EF36D4BBEA3A73AD47A3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e589ad4.tmp
- Size 2.8MB
- SHA256 80862717dfc485e9b8dc8f760a5412a8ac195021012507b8c1fdecb55c7828d8
- MD5 fbe3146ec3955463f0c474dec7aeb02e
- SHA1 b5c874e0fdd05cd5e42b36caa6a3f00821de6c26
- SHA512 aefcea75925e5a7e888bc1c85334bcea2768c36b226ed1387a1e1b2f0b56679e018e29db8cff28b08324e047abc93d0ce43671688015dad2aa406001abdeb47c
- SSDEEP 49152:qSY2fF8FhmS86IUJWQn+6h27d+Y2fF8FhmS86IUJWQn+6h27d6:9bOjjst4bOjjsts
- TLSH T18DD57B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e589ad4.tmp
- Size 2.8MB
- SHA256 aa0a34300a93a2882b241b7fbf23e590f594f811fabfb8fccbc789796b7fa80e
- MD5 5fb303dcaf8de9324c9e4824718c0195
- SHA1 068710eaefe9da6aac750553546c08d2ad723b3e
- SHA512 1b117e044862a9a6bfc55984e6fd5093e0baa413507ca3055becd321ee602dbd5fb41c1bfa5e21327390e83ed50f6d1dabfea6e84896c11bb284578df8e7e7ee
- SSDEEP 49152:jY2fF8FhmS86IUJWQn+6h27d+Y2fF8FhmS86IUJWQn+6h27d6:jbOjjst4bOjjsts
- TLSH T1B6D57B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\295c17dbca4809a47b3c23462605c6b43d626e4d0094bc47f2de01c8ab8cf7b0.exe
- Size 4.0MB
- SHA256 250c50bbf267c2208701faba8714acf70d952580900b4c1a2ea6e7a9b9a4ea82
- MD5 b1191e63619b914fe659dd64ddc3b0b8
- SHA1 81d3f0279e4a2ed6177f0b66630a3fc4031ca746
- SHA512 23bc1eb3e5e656e16af76878b212f20237d7f8b258c670fc8a2f512b093ed05945d0cb53179fb16afc3d4ce121c120f91bd0237fe76a0acd90375a83a521c7bd
- SSDEEP 49152:yScAmPWwDSVxKphdY/CW1sBlq7oQVAqq8j0hb/4R6:9cAmPLE6dY/j7oQqV14R6
- TLSH T1B7167C02F98380B6FB4D2530085E677AD231DE894725EBF7A354FD198A725C35D3A22E
- MD5 SHA1 SHA512 SSDEEP TLSH