Overview
overview
7Static
static
3gradle/wra...er.jar
windows10-2004-x64
7gradle/wra...er.jar
windows11-ltsc_2024-x64
7gradlew
ubuntu-18.04-amd64
1gradlew
debian-9-armhf
1gradlew
debian-9-mips
1gradlew
debian-9-mipsel
1gradlew.bat
windows10-2004-x64
7gradlew.bat
windows11-ltsc_2024-x64
7src/main/r...64.jar
windows10-2004-x64
1src/main/r...64.jar
windows11-ltsc_2024-x64
1src/main/r...ux.jar
windows10-2004-x64
1src/main/r...ux.jar
windows11-ltsc_2024-x64
1src/main/r...64.jar
windows10-2004-x64
1src/main/r...64.jar
windows11-ltsc_2024-x64
1src/main/r...os.jar
windows10-2004-x64
1src/main/r...os.jar
windows11-ltsc_2024-x64
1src/main/r...64.jar
windows10-2004-x64
1src/main/r...64.jar
windows11-ltsc_2024-x64
1src/main/r...ws.jar
windows10-2004-x64
1src/main/r...ws.jar
windows11-ltsc_2024-x64
1src/main/r....3.jar
windows10-2004-x64
1src/main/r....3.jar
windows11-ltsc_2024-x64
1src/main/r...nt.svg
windows10-2004-x64
3src/main/r...nt.svg
windows11-ltsc_2024-x64
4src/main/r...at.svg
windows10-2004-x64
3src/main/r...at.svg
windows11-ltsc_2024-x64
4src/main/r...ud.svg
windows10-2004-x64
3src/main/r...ud.svg
windows11-ltsc_2024-x64
4src/main/r...sc.svg
windows10-2004-x64
3src/main/r...sc.svg
windows11-ltsc_2024-x64
4src/main/r...nt.svg
windows10-2004-x64
3src/main/r...nt.svg
windows11-ltsc_2024-x64
4Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 09:56
Static task
static1
Behavioral task
behavioral1
Sample
gradle/wrapper/gradle-wrapper.jar
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
gradle/wrapper/gradle-wrapper.jar
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
gradlew
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral4
Sample
gradlew
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral5
Sample
gradlew
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral6
Sample
gradlew
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral7
Sample
gradlew.bat
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
gradlew.bat
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
src/main/resources/META-INF/jars/lwjgl-nanovg-3.3.3-natives-linux-arm64.jar
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
src/main/resources/META-INF/jars/lwjgl-nanovg-3.3.3-natives-linux-arm64.jar
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
src/main/resources/META-INF/jars/lwjgl-nanovg-3.3.3-natives-linux.jar
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
src/main/resources/META-INF/jars/lwjgl-nanovg-3.3.3-natives-linux.jar
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
src/main/resources/META-INF/jars/lwjgl-nanovg-3.3.3-natives-macos-arm64.jar
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
src/main/resources/META-INF/jars/lwjgl-nanovg-3.3.3-natives-macos-arm64.jar
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
src/main/resources/META-INF/jars/lwjgl-nanovg-3.3.3-natives-macos.jar
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
src/main/resources/META-INF/jars/lwjgl-nanovg-3.3.3-natives-macos.jar
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
src/main/resources/META-INF/jars/lwjgl-nanovg-3.3.3-natives-windows-arm64.jar
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
src/main/resources/META-INF/jars/lwjgl-nanovg-3.3.3-natives-windows-arm64.jar
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral19
Sample
src/main/resources/META-INF/jars/lwjgl-nanovg-3.3.3-natives-windows.jar
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
src/main/resources/META-INF/jars/lwjgl-nanovg-3.3.3-natives-windows.jar
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral21
Sample
src/main/resources/META-INF/jars/lwjgl-nanovg-3.3.3.jar
Resource
win10v2004-20260911-en
Behavioral task
behavioral22
Sample
src/main/resources/META-INF/jars/lwjgl-nanovg-3.3.3.jar
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral23
Sample
src/main/resources/assets/sixsevenclient/icons/client.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral24
Sample
src/main/resources/assets/sixsevenclient/icons/client.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral25
Sample
src/main/resources/assets/sixsevenclient/icons/combat.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral26
Sample
src/main/resources/assets/sixsevenclient/icons/combat.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral27
Sample
src/main/resources/assets/sixsevenclient/icons/hud.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral28
Sample
src/main/resources/assets/sixsevenclient/icons/hud.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral29
Sample
src/main/resources/assets/sixsevenclient/icons/misc.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral30
Sample
src/main/resources/assets/sixsevenclient/icons/misc.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral31
Sample
src/main/resources/assets/sixsevenclient/icons/movement.svg
Resource
win10v2004-20260911-en
General
- Target src/main/resources/assets/sixsevenclient/icons/combat.svg
- Size 197B
- Sample261002-lyc7mav13j
- SHA256 475bb0aa3eb062a22e2df88c70bbcaa66f012b143a5fb992980eca470530c497
- MD5 a55475a1640ef5327a2688287582998d
- SHA1 79d2431abdd6885df5d4712045c7b1ec9ccedeca
- SHA512 383ea1d4928ead3212a70631c21d0abe885b32b406242b6629ffa64b952410dddfcfb9e9de3a6add2c6b0992cc5ac4b665fc27add3dc099d27fbccc60fadc417
- TLSH T182D01216A24DED1C955481AC937734A5103F20D9138E1219F040686358055D7383B2FC
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281748" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd788000000000200000000001066000000010000200000004c38e8d208c54525ec25c7431a4befe3d0295588d9733b9dfc743179317b9f8f000000000e8000000002000020000000838b757c3b1f92a101c7a31a81f893d98d8fed27f28529176c74920ead8862ef20000000aefd3c4197a9855bb8bc10efec3bdeb8e85c131865b55a3abef6504a6190f53b40000000a0fce9909551fbd78e5e4a616db6e19fce0a98cb3b7a69939ae9036f80c44ebcd7538210aa65ac55a23abfd58b8aa405157a690b63d45bec16678ab14665e05e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497699991" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd78800000000020000000000106600000001000020000000088536069695d86e1f9e114f111dc1ed7309384cb175ae052d91d2be0a43949a000000000e8000000002000020000000069c7fc196e4de2dfbeb969df6c34ffb2e5a6ac19ddecedd06b89570c998701220000000fb6f3532d0dede1d05e27cf280c0c3a09a14daeadb963516e43d591a181215bb400000009f82b075955ac4e01387f1a17feae1c9ea268ea8fa31701249ce6adb19976f06d86c9fb3fc53c73c972c54e7b5ae911ee5c7e45cfa6d1ecc98e83edb047e6ed6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 16fc18bd3942dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1858897395" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d75dd15c52dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9A4FE36F-BE47-11F1-B7E7-F674913B7AC0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b962d15c52dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd78800000000020000000000106600000001000020000000a51a9d8dace66fcc28a8c54ae33e6b52a73f5b065a5557cdf75174f589c05ba2000000000e8000000002000020000000d915f5551cd8e409c3e889f5cdf25fc16262e4a6c8244419e533165ab0b4b2c750000000aa133406e5a07374bb422a483049450c3c825537dd74716188481454dddcf09ededd31106f22298c23ea0b4aa0834e818822a70b614b1d30865c9bdc4a67048c29dca65c1a82d90fce01f73d98bf96e040000000e6f1ccd1f02aefd17c23bd1aa37ed16c9d6f03296c716f5ecd817475bd03576a08f873eff00aff14e98791d369099e640fdbacbb96a1af06077a1821c4358883 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1864834847" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd78800000000020000000000106600000001000020000000e6b6ce3ababe2e76491b6d4dbc729790b9161d0d9b813347967985f87d8d68e1000000000e8000000002000020000000d7cf7e33f9a97e8dbdcf6c29ab4480929029a03d6e8f14c98353a6257b441cb5100000007304e3a741ce3fabb74e9c0dd7343d03400000009077d8d12af0f7f868619ae4715c49a874aa79846ed571ae789ffdd77c29a4aab1535f94de1040a02da3e35817bc27313c12581dceb9bb87760b267166c262c0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281748" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3716 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3716 iexplore.exe 3716 iexplore.exe 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3716 wrote to memory of 1676 3716 iexplore.exe 87
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\src\main\resources\assets\sixsevenclient\icons\combat.svg1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3716 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1676
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 06fe9ecf09fe90f243a993c5257ff5eb95fd9e57c1e8774954d7e247ecc38a45
- MD5 4193e41f442e7d04a7f3d0ebf4ba067c
- SHA1 3469d96329436fd9f3a2f68cdcfbc1e2c5f5aef4
- SHA512 40d5c9f3ff6db2369e45da7be83a62ce3f886ae4e62b4cf23b8744cf020077d8ee1f2047c08af2b3701ba6f10eedccc1388563f9b88282ab33951f1afbc82f23
- TLSH T111F0D4F341BDB8542FD164DC41BDD93E313194A7118342C1357D89E684593776F8E532
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 7e1e73d3708a4a0481fe8406a1fc7bf594d40b765589286520ef8005f5fe7449
- MD5 4ce5f2eb89d67b9cfce0266ceb831ae0
- SHA1 76f01e786d890847af468c4d147e3edc29cf613e
- SHA512 a40ede1ddda69d0412ee3e13dd44f1f77b89ec9646aff9e0af2069c6efb3a10d0b1744f966d44cee46d5e6cb48438d53a9c6f059104e6296b267afe258810c43
- TLSH T13AE0C03411FA415EE0F4E8358BEA743184A9F0270468A7B42DD45B04A702A00EC03925
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EQ5O6WBF\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH