Overview
overview
6Static
static
5MobiX Unlo...ck.exe
windows10-2004-x64
6MobiX Unlo...ck.exe
windows11-ltsc_2024-x64
6MobiX Unlo...er.dll
windows10-2004-x64
1MobiX Unlock/app.svg
windows10-2004-x64
3MobiX Unlock/app.svg
windows11-ltsc_2024-x64
4MobiX Unlo...le.svg
windows10-2004-x64
3MobiX Unlo...le.svg
windows11-ltsc_2024-x64
4MobiX Unlo...us.svg
windows10-2004-x64
3MobiX Unlo...us.svg
windows11-ltsc_2024-x64
4MobiX Unlo...le.svg
windows10-2004-x64
3MobiX Unlo...le.svg
windows11-ltsc_2024-x64
4MobiX Unlo...or.svg
windows10-2004-x64
3MobiX Unlo...or.svg
windows11-ltsc_2024-x64
4MobiX Unlo...ei.svg
windows10-2004-x64
3MobiX Unlo...ei.svg
windows11-ltsc_2024-x64
4MobiX Unlo...ix.svg
windows10-2004-x64
3MobiX Unlo...ix.svg
windows11-ltsc_2024-x64
4MobiX Unlo...oo.svg
windows10-2004-x64
3MobiX Unlo...oo.svg
windows11-ltsc_2024-x64
4MobiX Unlo...vo.svg
windows10-2004-x64
3MobiX Unlo...vo.svg
windows11-ltsc_2024-x64
4MobiX Unlo...zu.svg
windows10-2004-x64
3MobiX Unlo...zu.svg
windows11-ltsc_2024-x64
4MobiX Unlo...la.svg
windows10-2004-x64
3MobiX Unlo...la.svg
windows11-ltsc_2024-x64
3MobiX Unlo...ia.svg
windows10-2004-x64
3MobiX Unlo...ia.svg
windows11-ltsc_2024-x64
4MobiX Unlo...ng.svg
windows10-2004-x64
3MobiX Unlo...ng.svg
windows11-ltsc_2024-x64
4MobiX Unlo...ia.svg
windows10-2004-x64
3MobiX Unlo...ia.svg
windows11-ltsc_2024-x64
4MobiX Unlo...us.svg
windows10-2004-x64
3Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/10/2026, 12:21
Behavioral task
behavioral1
Sample
MobiX Unlock/MobiX Unlock.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
MobiX Unlock/MobiX Unlock.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
MobiX Unlock/WebView2Loader.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
MobiX Unlock/app.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral5
Sample
MobiX Unlock/app.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral6
Sample
MobiX Unlock/assets/brands/apple.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral7
Sample
MobiX Unlock/assets/brands/apple.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral8
Sample
MobiX Unlock/assets/brands/asus.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral9
Sample
MobiX Unlock/assets/brands/asus.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral10
Sample
MobiX Unlock/assets/brands/google.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral11
Sample
MobiX Unlock/assets/brands/google.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral12
Sample
MobiX Unlock/assets/brands/honor.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral13
Sample
MobiX Unlock/assets/brands/honor.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral14
Sample
MobiX Unlock/assets/brands/huawei.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral15
Sample
MobiX Unlock/assets/brands/huawei.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral16
Sample
MobiX Unlock/assets/brands/infinix.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral17
Sample
MobiX Unlock/assets/brands/infinix.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral18
Sample
MobiX Unlock/assets/brands/iqoo.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral19
Sample
MobiX Unlock/assets/brands/iqoo.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral20
Sample
MobiX Unlock/assets/brands/lenovo.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral21
Sample
MobiX Unlock/assets/brands/lenovo.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral22
Sample
MobiX Unlock/assets/brands/meizu.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral23
Sample
MobiX Unlock/assets/brands/meizu.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral24
Sample
MobiX Unlock/assets/brands/motorola.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral25
Sample
MobiX Unlock/assets/brands/motorola.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral26
Sample
MobiX Unlock/assets/brands/nokia.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral27
Sample
MobiX Unlock/assets/brands/nokia.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral28
Sample
MobiX Unlock/assets/brands/nothing.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral29
Sample
MobiX Unlock/assets/brands/nothing.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral30
Sample
MobiX Unlock/assets/brands/nubia.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral31
Sample
MobiX Unlock/assets/brands/nubia.svg
Resource
win11ltsc2024-20260911-en
General
- Target MobiX Unlock/assets/brands/google.svg
- Size 695B
- Sample261001-pjphwsshjg
- SHA256 3d531818e804465d6c087b7f023149b581c071add45d114d9eb121da29bd1b29
- MD5 fdff4e73e50d5896eaf4a14c18398593
- SHA1 30211777cb8c32305bd59cadce21b025dc055be9
- SHA512 b064b75fa6da727383b23c31bcedaad1d5595da125a782a581416a420b14b25c64847c2e352e2f4dcb6a1d9e722331f25ab9f8cdf884827e8d9ca336a5d42c7e
- TLSH T15401C0EB6E55781D855383AD8C9438C2B71E30BA70C901F47A5E9A383156BD6ECC3804
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd78800000000020000000000106600000001000020000000c5fd3023012fe095b484a5cbe73ea77978ebd71682337ebfd413f309c916b2cc000000000e8000000002000020000000a7d28d858aca0a058a97642a423525d2ebaf8922e7ca40db94a48ba344da584b500000008ef57c48ef966881df71609e287763fbb9b246ebb968f2cec763bc92fb15411176c3c5e60cbb5f223ad2d0adee4e93f2c846607f43d325bac20081e36b67da551db4b46eb9fa5f41270093d9239d1c1b400000005dcac4ee7ea1bc9fee4a5aa9b96282e9c307d37d5bcbc512fe7c9c6873556d37994ba74aefbc0fc999d20cb7ebb8a48587fbb3cda841515784b9d38745f32daf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281567" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497622304" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2375925035" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c02010f0a751dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2380768989" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd78800000000020000000000106600000001000020000000727d204e0451b5647f1281dbcdbf04db8b74bde376365fdcd6228221a9b29b95000000000e800000000200002000000096765184b2d62c16cd3647de6c76b057e99007a5b73edc54b0dcaa8e5199774510000000f025f139cbf04b3f9c6a2c283d60ddd64000000039d94c0c9c9734a01ea04dc617495695a224a6cf08fd5c1c6427c6fda7938278c9c6eb02274c930631071a64a6674b731e535feabd255524aaa3aee84140158d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281567" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd7880000000002000000000010660000000100002000000047dc78905bec12189dc609124f6543ae0a1f1ca41f1392b0fb572885315ca898000000000e8000000002000020000000d509d2c15a7e5806e36e01c8a5b8540175e6cfba8d44b09143869524975a50d82000000080f1b3120e660c675bf843754eadf2327acc68f46521482251067eaad509bab240000000706919b3682cad34c726161248f687245c54ce08befe95cc38ac95dcde0073225f791ea285bee2032094b4e728259568bb8c9c8038122c09d22550f64c004340 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B91D1E0E-BD92-11F1-B7E7-62BF8547FD78} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b04c17f0a751dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd78800000000020000000000106600000001000020000000a70284b3f567ab252e28b6c6d800d3c94290b16d5407a3046a79d53194a6a9ce000000000e80000000020000200000007cbbf4fc1dc5eed755b82d039ce688240acc18ccf56e4d28797e9d53195a6e2120000000ad61b02e708b895af3c6a2734a4e2fbc03d2d08762f4061ae29ce857198d41d240000000ad5788bba0b49d971831f7c91bde5f5f9499a4b996311a3805c503b5d348410b421a78ef690ea8dbdc4b7901a2a5492af9b4fee9a019a9ab951a44def19ae1a5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 16fc18bd3942dd01 iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2292 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2292 iexplore.exe 2292 iexplore.exe 4044 IEXPLORE.EXE 4044 IEXPLORE.EXE 4044 IEXPLORE.EXE 4044 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2292 wrote to memory of 4044 2292 iexplore.exe 85
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\MobiX Unlock\assets\brands\google.svg"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4044
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 a8ae89c4320a877bfdc7fa166071f811f55589e0639c14cffe37d659daac0db6
- MD5 7949983f78ba72edb5343d94a6da399b
- SHA1 bbc848bec8705929e36130a2e059bbf690431dcf
- SHA512 0e492c2145956f11c245b71ed207a1552c58e7ffaf003524b48142a28f52ccfc2fd03b7b3de862cb9844b476297c77c8e41f92625c6fd17e3c8b4be36aae859c
- TLSH T1DBF0DC82233CEFF078610D9D1AAC979EB130FAE354C8080FA02D4AD591E636F280E535
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 fb0c9e3610ab6716baee6300b1fc59e7c644786770b1582d533b31eb3b99b282
- MD5 e8523ef197f012b7f1a323c897321144
- SHA1 38d1d0767981f0bb48b44f8c31bf68b9832aad71
- SHA512 ac90f7081d0d9eee88711f1f4c3591f92ed6bc40dd88e6d31df1c6d0c7ee44858eabaec8cf4615ffadde70bfb77746ad04df4317661d1ce8689a8cec82dd851f
- TLSH T170E0C03826FB811FF2F5E6384BC5B4219599F136182DE3B82DD45B04F717900DC03925
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EQ5O6WBF\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH