Overview
overview
4Static
static
1small_svg/...eM.svg
windows10-2004-x64
3small_svg/...eM.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eH.svg
windows10-2004-x64
3small_svg/...eH.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eQ.svg
windows10-2004-x64
3small_svg/...eQ.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eM.svg
windows10-2004-x64
3small_svg/...eM.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eM.svg
windows10-2004-x64
3small_svg/...eM.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 03:44
Static task
static1
Behavioral task
behavioral1
Sample
small_svg/small1-v10J-m4-eM.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
small_svg/small1-v10J-m4-eM.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
small_svg/small1-v11K-m5-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
small_svg/small1-v11K-m5-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
small_svg/small1-v12L-m6-eH.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
small_svg/small1-v12L-m6-eH.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
small_svg/small1-v13M-m7-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
small_svg/small1-v13M-m7-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
small_svg/small1-v15O-m1-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
small_svg/small1-v15O-m1-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
small_svg/small1-v16P-m2-eQ.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
small_svg/small1-v16P-m2-eQ.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
small_svg/small1-v17Q-m3-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
small_svg/small1-v17Q-m3-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
small_svg/small1-v18R-m4-eM.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
small_svg/small1-v18R-m4-eM.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
small_svg/small1-v19S-m5-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
small_svg/small1-v19S-m5-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral19
Sample
small_svg/small1-v1A-m0-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
small_svg/small1-v1A-m0-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral21
Sample
small_svg/small1-v1A-m1-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral22
Sample
small_svg/small1-v1A-m1-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral23
Sample
small_svg/small1-v1A-m2-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral24
Sample
small_svg/small1-v1A-m2-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral25
Sample
small_svg/small1-v1A-m2-eM.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral26
Sample
small_svg/small1-v1A-m2-eM.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral27
Sample
small_svg/small1-v1A-m3-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral28
Sample
small_svg/small1-v1A-m3-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral29
Sample
small_svg/small1-v1A-m4-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral30
Sample
small_svg/small1-v1A-m4-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral31
Sample
small_svg/small1-v1A-m5-eL.svg
Resource
win10v2004-20260911-en
General
- Target small_svg/small1-v10J-m4-eM.svg
- Size 24KB
- Sample260930-eagftazx5k
- SHA256 d78815299fd2ba2b3fea05f7c5662295c55e9b87f5659718b5dfc273f4fe78dc
- MD5 8c786d4da80ac1948a137a727a12fd7e
- SHA1 0fb0844fb479811339f7104eb281a91b930ca91d
- SHA512 838d9d0ec608d1e47dd3722b8ccd401e03eb334982cd433a7f896e66b62a9e69b9d2d3e8209914dd8563af8734ee368742a979b7e861efd480707c961c193a0e
- SSDEEP 384:c5veJtU7WSADG+2tM8LSB7XXZwuw5wE1/7PRP3uDCr:c5vQjqZmDK
- TLSH T11FB21F6437F87C978BD803479D02FC68461FA877C4A8678D93D7D4E8A988368FB6C560
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a000000000200000000001066000000010000200000003a259ac3e979d05c3f4dfe01f18bf6afbd15cf13f4484b1f2019fc990e11fd5c000000000e8000000002000020000000e39f98765d5321cf6a460bd88e3c344ba0a303c6d6931230558ee9b1b576dd2f20000000c2509f8ee3943d5fa377de086a719e25667c5b97899d78055599afbbcac4a1c940000000b313d7cafb1f8c0f2ad8ad4b5cfb86704921581e545fe4b2d7d4cb04374219d6835827474c5b520d3ddd67e263e0328d85b07c3e3509051e5a94dcbe1f1c50fe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281294" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a000000000200000000001066000000010000200000002f67e18b3aa935fd2291a5a08c2a5a71e87d504cf3e3e0daccd723d02b94ea79000000000e800000000200002000000000e1cc6dbf961a7046967652842cdae57fb69cbaba37d796f4bb15afc3ef27a75000000076445fedceadd01c86154f9467115ab6a67ffa38b7779920cf3a814b985401a67747557a7827065d31466ae49c14dcba452abee640762f58c65c28cf6e5b9b0ae02516b4285138e5dbd6e44019d4c21c400000009eddfebd5cebe5a3bd4babd25d45c32e3be35c0e8fb2c927bac90b322943809a9853ddeabe657ede0bb5a389849f6532257f4512e012a056c4e9c3fb7a662e49 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 705da5679650dd01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a00000000020000000000106600000001000020000000b163319515297bc282ccb98c22fc5624131006273f182846c790c8211861115e000000000e800000000200002000000042317b9fe72bb90729d61dd82dc5070feb6a3677ec78a8531e7d64472416336120000000120bc0bb0bbdaec3526a87983e858f8ea30cac376dc087b84be4bc0f376c1069400000001725e7e6129d81cfc1d15de9736f0524d4faba469a2cb431b05e87a36f4423f2d6624dfa5661cdb84450b1a7eedb03dda69c1328d7f8a3b50f8c04da9e12f871 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "90200994" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 606bb1679650dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497504822" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "83950613" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 3b57edeb3942dd01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a000000000200000000001066000000010000200000008a9b9b40d6e686ad1a9d2b6fbaa31a456fad12de8048bdaa60380879edcc5764000000000e80000000020000200000006888dc944152a243e118857e676b2f70b3693b790120faba49205dda5c56e8ac1000000044223a17e4254fce881cfca2659f015e40000000526363508bc9d86f66557c1a12bd19496b1230e20a6df78f4f6ad6ea09883d94e0357bffebba8864d59fe81cd3a9b0587d24f2f1a21fd44dd4b2f92ad5573731 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{306BCA19-BC81-11F1-B5F1-CAA8D6BDFC74} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281294" IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4572 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4572 iexplore.exe 4572 iexplore.exe 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4572 wrote to memory of 2176 4572 iexplore.exe 87
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v10J-m4-eM.svg1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4572 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2176
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 7bbfea3c4b86e052f6c7c043ab8b86695e9e7f525cf54670ea3fed7eeb8fc07b
- MD5 c594b726a66926272d1a36f611dbee07
- SHA1 06692a4ae7abe3082ff08b78812de3b1c5e11251
- SHA512 0f0ee6de9885af7f67ac2aa53f021b49d3d9cb828025cfac627a6c9ca4b6b684c76d4f551763ed290b404695060b76901b701fb45288a58fd82e184ac9e1a309
- TLSH T11BF09E11A3B9D0D05BCEF4DD076D01B93160995F20D2032664BB49B45A417E73559530
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 60e2be1ac2b2885b5209f573b0fb050ad39e4cf802ab56cea0c09c88984ad6a2
- MD5 5330ddb2763b2145c7b8ebc525707071
- SHA1 fb9329c911856c944c7af8c57e9af9e9f2da94dd
- SHA512 18f70104ef75630e567cbf0f57b8af193b0a93b195382e235c77878468c9e496a5a8c9f4dbd1c70491a2cf49a9017f8aacab8db6d3d0a848dcfae583f2d0f75e
- TLSH T176E0C03815F6421FE0F8D8344BC57421547DF023141992F82ED48B18B746640AD12B25
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DV9ET3T5\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH