Overview
overview
6Static
static
5MobiX Unlo...ck.exe
windows10-2004-x64
6MobiX Unlo...ck.exe
windows11-ltsc_2024-x64
6MobiX Unlo...er.dll
windows10-2004-x64
1MobiX Unlock/app.svg
windows10-2004-x64
3MobiX Unlock/app.svg
windows11-ltsc_2024-x64
4MobiX Unlo...le.svg
windows10-2004-x64
3MobiX Unlo...le.svg
windows11-ltsc_2024-x64
4MobiX Unlo...us.svg
windows10-2004-x64
3MobiX Unlo...us.svg
windows11-ltsc_2024-x64
4MobiX Unlo...le.svg
windows10-2004-x64
3MobiX Unlo...le.svg
windows11-ltsc_2024-x64
4MobiX Unlo...or.svg
windows10-2004-x64
3MobiX Unlo...or.svg
windows11-ltsc_2024-x64
4MobiX Unlo...ei.svg
windows10-2004-x64
3MobiX Unlo...ei.svg
windows11-ltsc_2024-x64
4MobiX Unlo...ix.svg
windows10-2004-x64
3MobiX Unlo...ix.svg
windows11-ltsc_2024-x64
4MobiX Unlo...oo.svg
windows10-2004-x64
3MobiX Unlo...oo.svg
windows11-ltsc_2024-x64
4MobiX Unlo...vo.svg
windows10-2004-x64
3MobiX Unlo...vo.svg
windows11-ltsc_2024-x64
4MobiX Unlo...zu.svg
windows10-2004-x64
3MobiX Unlo...zu.svg
windows11-ltsc_2024-x64
4MobiX Unlo...la.svg
windows10-2004-x64
3MobiX Unlo...la.svg
windows11-ltsc_2024-x64
3MobiX Unlo...ia.svg
windows10-2004-x64
3MobiX Unlo...ia.svg
windows11-ltsc_2024-x64
4MobiX Unlo...ng.svg
windows10-2004-x64
3MobiX Unlo...ng.svg
windows11-ltsc_2024-x64
4MobiX Unlo...ia.svg
windows10-2004-x64
3MobiX Unlo...ia.svg
windows11-ltsc_2024-x64
4MobiX Unlo...us.svg
windows10-2004-x64
3Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/10/2026, 12:21
Behavioral task
behavioral1
Sample
MobiX Unlock/MobiX Unlock.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
MobiX Unlock/MobiX Unlock.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
MobiX Unlock/WebView2Loader.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
MobiX Unlock/app.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral5
Sample
MobiX Unlock/app.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral6
Sample
MobiX Unlock/assets/brands/apple.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral7
Sample
MobiX Unlock/assets/brands/apple.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral8
Sample
MobiX Unlock/assets/brands/asus.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral9
Sample
MobiX Unlock/assets/brands/asus.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral10
Sample
MobiX Unlock/assets/brands/google.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral11
Sample
MobiX Unlock/assets/brands/google.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral12
Sample
MobiX Unlock/assets/brands/honor.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral13
Sample
MobiX Unlock/assets/brands/honor.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral14
Sample
MobiX Unlock/assets/brands/huawei.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral15
Sample
MobiX Unlock/assets/brands/huawei.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral16
Sample
MobiX Unlock/assets/brands/infinix.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral17
Sample
MobiX Unlock/assets/brands/infinix.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral18
Sample
MobiX Unlock/assets/brands/iqoo.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral19
Sample
MobiX Unlock/assets/brands/iqoo.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral20
Sample
MobiX Unlock/assets/brands/lenovo.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral21
Sample
MobiX Unlock/assets/brands/lenovo.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral22
Sample
MobiX Unlock/assets/brands/meizu.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral23
Sample
MobiX Unlock/assets/brands/meizu.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral24
Sample
MobiX Unlock/assets/brands/motorola.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral25
Sample
MobiX Unlock/assets/brands/motorola.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral26
Sample
MobiX Unlock/assets/brands/nokia.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral27
Sample
MobiX Unlock/assets/brands/nokia.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral28
Sample
MobiX Unlock/assets/brands/nothing.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral29
Sample
MobiX Unlock/assets/brands/nothing.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral30
Sample
MobiX Unlock/assets/brands/nubia.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral31
Sample
MobiX Unlock/assets/brands/nubia.svg
Resource
win11ltsc2024-20260911-en
General
- Target MobiX Unlock/assets/brands/honor.svg
- Size 281B
- Sample261001-pjphwsshjg
- SHA256 4a6d2bd46f87bb3abf9e7cafc7672e3803a542868a712d87fb1195d36d1afbb7
- MD5 1c83c4ddfcc66449e1f84847b9c0ab73
- SHA1 5e0e72e70659fbc8b6e2aea7748554a636c33ac2
- SHA512 c76154ff97048d42489549828d34cfe38904ae8595514f45729650bc59c868cb592eb2d7d0e9e0b1753089ea0b797d7f3279708c14dcbffc790405825e456843
- TLSH T179D0EB9BA0C4672AC3080F013E863098B68C11CC4CC00C26F6D2872A08C78B313C832C
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a00000000020000000000106600000001000020000000bdaa1f9939157bd33de9ab32ce642259818c41d1b6bdc2e4ea9a6387eedaed1a000000000e80000000020000200000002912aa2a3e49e3454d116d6f09042799e23c0505378f2f8ae22ebd482b587e47100000002ead065bd254016c7e249082f50af49c4000000022181221343fd7856b4fa0eba05dd34c1d28e3cd178c89d273c903f7280e33c922aad47cff22af0d43aaed463c8692d8f596b1938b43c00e48d746cdadee4141 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497622310" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BCB12B69-BD92-11F1-B5F1-E629188E6DFA} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 3b57edeb3942dd01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2443979314" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281567" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c03fdef3a751dd01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a00000000020000000000106600000001000020000000d9c01eeecb60bb22bf47ea48910d2576e98a2040d9e9b5716eb4e8723e9f5b39000000000e80000000020000200000000c2751699285cff0e07c0996429c08c70ea15c2a45f7edeae35a1986e149d9fd200000005e6b3a165a47f97e3b347350cdaa550b58898087531f56e63b618b5a43fa82364000000017867fa3a4c035a34b68ffe556c566347f90c3f1176050f174a8b5922bd54183d648acb6c44d4708e4e97d1fe5cc5d7617265bff7cccad930aac7fd5c50cdfc3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281567" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a00000000020000000000106600000001000020000000921cf77eaca919bcfdbc7118cf25be8f01d607b6ed56351cda6c7928bad9abe3000000000e80000000020000200000006b1ef8b166d0dcfe88f35fd17b7cdda1ce5c3e9ae953bacecf42e69c52476a762000000055d73c665fb156bb5c4928de8d7733f6c85f066a8bd97cd8683075721bd30bcb400000006b62c227242714ca9b8546323652db3b6770c0579af74d6d6d4186a785817bd2d2e1e1d305f846f496d48ea1c7cf1084a7c403d4cc76849c6fc345a9344bade2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a044e5f3a751dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a0000000002000000000010660000000100002000000061223cb0156b4451ce00e0ccfa5f21eef21b236989ace36301ad2cbd92901857000000000e800000000200002000000025a9bb1e760b172b451008150091d4167e2d5a56a27fe51fde18c388e1ee1c4750000000b183d16dc3dadb9585e4cf438dee3b4a845c35c1ba0109c50041352b675a20c28083321365ab7aa7e2ce7b3096f5616fe450fadd5028dd2ff2c23aec2abed2ac831a3facc8dd16ff86000da825af6540400000002cedb9dbe36dbfa3b0c69fc39f6b28538ae4019e34cddbc330ae956d6be78ae1af1f8943352ab7725e724f4e23b0c039ea55b297988cc3d47be9505cfd6a622c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2437573176" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5692 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 5692 iexplore.exe 5692 iexplore.exe 5900 IEXPLORE.EXE 5900 IEXPLORE.EXE 5900 IEXPLORE.EXE 5900 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5692 wrote to memory of 5900 5692 iexplore.exe 85
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\MobiX Unlock\assets\brands\honor.svg"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5692 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5900
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 a8ae89c4320a877bfdc7fa166071f811f55589e0639c14cffe37d659daac0db6
- MD5 7949983f78ba72edb5343d94a6da399b
- SHA1 bbc848bec8705929e36130a2e059bbf690431dcf
- SHA512 0e492c2145956f11c245b71ed207a1552c58e7ffaf003524b48142a28f52ccfc2fd03b7b3de862cb9844b476297c77c8e41f92625c6fd17e3c8b4be36aae859c
- TLSH T1DBF0DC82233CEFF078610D9D1AAC979EB130FAE354C8080FA02D4AD591E636F280E535
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 c796ed4f2bbef25f478e6eac4ce26f1036b979f0d251426d26cf910bee1ce399
- MD5 4d70cb7e233ad7cb8d4b33b7022b588e
- SHA1 4460bc7757c13ade1251027324cc47211069311c
- SHA512 c0489d718f36125b09d8efa6e2bc465ef4869e96144987224709560efad7a16eea3f8fe723f5cb2349bb195da026ccc1ce62ca84f5da8a51c9365ecaf5ce301d
- TLSH T1FEE0C03825FAC11FF1F5E53847D5747555A9F036042DE3B829C44B08E706A009C03925
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DV9ET3T5\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH