Overview
overview
4Static
static
1small_svg/...eM.svg
windows10-2004-x64
3small_svg/...eM.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eH.svg
windows10-2004-x64
3small_svg/...eH.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eQ.svg
windows10-2004-x64
3small_svg/...eQ.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eM.svg
windows10-2004-x64
3small_svg/...eM.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eM.svg
windows10-2004-x64
3small_svg/...eM.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4small_svg/...eL.svg
windows10-2004-x64
3small_svg/...eL.svg
windows11-ltsc_2024-x64
4Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 09:38
Static task
static1
Behavioral task
behavioral1
Sample
small_svg/small1-v10J-m4-eM.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
small_svg/small1-v10J-m4-eM.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
small_svg/small1-v11K-m5-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
small_svg/small1-v11K-m5-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
small_svg/small1-v12L-m6-eH.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
small_svg/small1-v12L-m6-eH.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
small_svg/small1-v13M-m7-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
small_svg/small1-v13M-m7-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
small_svg/small1-v15O-m1-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
small_svg/small1-v15O-m1-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
small_svg/small1-v16P-m2-eQ.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
small_svg/small1-v16P-m2-eQ.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
small_svg/small1-v17Q-m3-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
small_svg/small1-v17Q-m3-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
small_svg/small1-v18R-m4-eM.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
small_svg/small1-v18R-m4-eM.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
small_svg/small1-v19S-m5-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
small_svg/small1-v19S-m5-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral19
Sample
small_svg/small1-v1A-m0-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
small_svg/small1-v1A-m0-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral21
Sample
small_svg/small1-v1A-m1-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral22
Sample
small_svg/small1-v1A-m1-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral23
Sample
small_svg/small1-v1A-m2-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral24
Sample
small_svg/small1-v1A-m2-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral25
Sample
small_svg/small1-v1A-m2-eM.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral26
Sample
small_svg/small1-v1A-m2-eM.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral27
Sample
small_svg/small1-v1A-m3-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral28
Sample
small_svg/small1-v1A-m3-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral29
Sample
small_svg/small1-v1A-m4-eL.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral30
Sample
small_svg/small1-v1A-m4-eL.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral31
Sample
small_svg/small1-v1A-m5-eL.svg
Resource
win10v2004-20260911-en
General
- Target small_svg/small1-v16P-m2-eQ.svg
- Size 48KB
- Sample261002-ll2pfsvs2r
- SHA256 3b57fea1eec2d03a39c344332db1a425f7e728e0bcf2afafd5f90352bfa4e14a
- MD5 36e987192c44bf8a98cc83525c6860ab
- SHA1 c2bbafef0aa4819ca038878ed030e235bf20353e
- SHA512 51b10e0979e1185dd44631fa0e92cb6839b417135169b8d23b95268775147c7b87cb47a12307570476a595a81167526992f137c9009e50d73a3e1d80080f7f73
- SSDEEP 384:cl1tz67bJ/MErSDkAPI9Fs0NsHJCixiIX1dkWs4Cl9sRCOWnCAX+3utANO:cDtimp7s4k9sySO
- TLSH T1202350B537F47C9B8BCC034B5D42EC6C45AF94B784986A8C9BC790E8A548368F7EC590
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F9518DAB-BE44-11F1-B7E7-621E4F736A29} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3457099234" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd78800000000020000000000106600000001000020000000ac3ab89912a344ad25ceb9842a5ab6a0974fff7e775aa7c433fc45d04d7cfc49000000000e8000000002000020000000231bb28340e98e7d9cafc4228a42dcbee5ed1f465dcb8211ea45ce1778702c9f200000007d9a12700848fc98e794ec16f9f10e5c92b8bc094aafcc2c111a711b46e02fd640000000cdc578b8a40e4aa467057fb62fb1d88121da4e4d35182336e637810e513d0d181e3346efc4fbd2f25adf241ba3df83657d3f463c2e75ade85dec9a6a9f38f25e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0714f305a52dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd788000000000200000000001066000000010000200000008a0da615a608e343ff7c74793b4d17f4a9e2e263110036b033188013a25d6bef000000000e8000000002000020000000b85838ae438278339927442ed0b82f53dccddc349d1d7e03230c674db314624650000000013015c32b94176f8b3910815f1bf0a6c1d94e8515ebec8aafc6a75d7bdbe18c064b8f675c19b1e00cd6011a3c0af7d83486806d748b01f74ff5b9656c0c42b0d34d1e4a9b273bb0ed2e5aebdeabdc4240000000e7c5913c2a61cd3907caa8292687a5ce285d3691c935a403fd884b74be4f4c64b711f04e59e16a1bf522551edf7f800d8fbbe106f9138b97b8d44f40d3598d04 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3462255011" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b64a305a52dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497698862" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd788000000000200000000001066000000010000200000004ec661415e2750d5cff71b3831e9be25135b3491d979c261094dbd4875934783000000000e80000000020000200000003b95fbeffd9f0766ec1367fa5d8e1d4256e9e51d1e5198692a341c74f2858e7c20000000722295a2600ebd76ec3b85b98b64b535d2d0e4f831874cf35c24e51383f6a66840000000dc64de16f49e67dc5b5148571c2a9aec51a41c14f5d6a2de31e4fb8b2769bd4a0dfd5ba08f9330148109ec6c7d1f21c1ec5fe491609851eb6157a85fe57bf8a5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 16fc18bd3942dd01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd788000000000200000000001066000000010000200000001d1813d15a376fc44e42a993eb8c82a2fef0aecbe461c89560b05c8206358aca000000000e8000000002000020000000762969aef6466b30bdd8cebb9ba7eb066ec8b30e85e93a37b574d92c20d014d41000000038b9085139f3f25797da79a1c095d7de4000000093d0308c7ec800e3c29f1a16a21e07740c497484b55b1de9c53e2a8307eda6d1680a699c744052b512c0aac6f60f3b1283220a9867ec50a84e7e28620a7dff8c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281745" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281745" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2332 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2332 iexplore.exe 2332 iexplore.exe 3296 IEXPLORE.EXE 3296 IEXPLORE.EXE 3296 IEXPLORE.EXE 3296 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2332 wrote to memory of 3296 2332 iexplore.exe 86
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v16P-m2-eQ.svg1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3296
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 06fe9ecf09fe90f243a993c5257ff5eb95fd9e57c1e8774954d7e247ecc38a45
- MD5 4193e41f442e7d04a7f3d0ebf4ba067c
- SHA1 3469d96329436fd9f3a2f68cdcfbc1e2c5f5aef4
- SHA512 40d5c9f3ff6db2369e45da7be83a62ce3f886ae4e62b4cf23b8744cf020077d8ee1f2047c08af2b3701ba6f10eedccc1388563f9b88282ab33951f1afbc82f23
- TLSH T111F0D4F341BDB8542FD164DC41BDD93E313194A7118342C1357D89E684593776F8E532
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 12fec8edadbc66220058c4bd90a88c6587aa67f55f6d947c4fd596b22dbf78c0
- MD5 e0528a6577663370ca475fa97d57509b
- SHA1 d51f2b6ebda80233486d7f6b887484e7f50afb07
- SHA512 0a872d91f24a9d1d6c11e25535b81779baf5992883d1da819b5f2894f9f8bead2b5586e187dcb20e149eef852aa586878cf62dea377a1716a9419ae40b1f1598
- TLSH T192E0C03411F6015EF4F4E4358BDA7431846DF0220458E6B929D85B08B703E40AC03925
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EQ5O6WBF\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LM36AMZP\favicon[1].ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH