Overview
overview
4Static
static
1extension/...on.svg
windows10-2004-x64
3extension/...on.svg
windows11-ltsc_2024-x64
4extension/...go.svg
windows10-2004-x64
3extension/...go.svg
windows11-ltsc_2024-x64
4extension/...3d.svg
windows10-2004-x64
3extension/...3d.svg
windows11-ltsc_2024-x64
4extension/...ap.svg
windows10-2004-x64
3extension/...ap.svg
windows11-ltsc_2024-x64
4extension/...bc.svg
windows10-2004-x64
3extension/...bc.svg
windows11-ltsc_2024-x64
4extension/...pt.svg
windows10-2004-x64
3extension/...pt.svg
windows11-ltsc_2024-x64
4extension/...da.svg
windows10-2004-x64
3extension/...da.svg
windows11-ltsc_2024-x64
4extension/...is.svg
windows10-2004-x64
3extension/...is.svg
windows11-ltsc_2024-x64
4extension/...de.svg
windows10-2004-x64
3extension/...de.svg
windows11-ltsc_2024-x64
4extension/...rw.svg
windows10-2004-x64
3extension/...rw.svg
windows11-ltsc_2024-x64
4extension/...tm.svg
windows10-2004-x64
3extension/...tm.svg
windows11-ltsc_2024-x64
4extension/...pp.svg
windows10-2004-x64
3extension/...pp.svg
windows11-ltsc_2024-x64
4extension/...id.svg
windows10-2004-x64
3extension/...id.svg
windows11-ltsc_2024-x64
4extension/...nt.svg
windows10-2004-x64
3extension/...nt.svg
windows11-ltsc_2024-x64
4extension/...ve.svg
windows10-2004-x64
3extension/...ve.svg
windows11-ltsc_2024-x64
4extension/...rd.svg
windows10-2004-x64
3extension/...rd.svg
windows11-ltsc_2024-x64
4Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 07:47
Static task
static1
Behavioral task
behavioral1
Sample
extension/assets/icons/icon.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
extension/assets/icons/icon.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
extension/assets/images/plikai-logo.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
extension/assets/images/plikai-logo.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
extension/assets/vscode-material-icons/icons/3d.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
extension/assets/vscode-material-icons/icons/3d.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
extension/assets/vscode-material-icons/icons/abap.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
extension/assets/vscode-material-icons/icons/abap.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
extension/assets/vscode-material-icons/icons/abc.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
extension/assets/vscode-material-icons/icons/abc.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
extension/assets/vscode-material-icons/icons/actionscript.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
extension/assets/vscode-material-icons/icons/actionscript.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
extension/assets/vscode-material-icons/icons/ada.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
extension/assets/vscode-material-icons/icons/ada.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
extension/assets/vscode-material-icons/icons/adonis.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
extension/assets/vscode-material-icons/icons/adonis.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
extension/assets/vscode-material-icons/icons/advpl_include.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
extension/assets/vscode-material-icons/icons/advpl_include.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral19
Sample
extension/assets/vscode-material-icons/icons/advpl_prw.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
extension/assets/vscode-material-icons/icons/advpl_prw.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral21
Sample
extension/assets/vscode-material-icons/icons/advpl_ptm.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral22
Sample
extension/assets/vscode-material-icons/icons/advpl_ptm.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral23
Sample
extension/assets/vscode-material-icons/icons/advpl_tlpp.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral24
Sample
extension/assets/vscode-material-icons/icons/advpl_tlpp.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral25
Sample
extension/assets/vscode-material-icons/icons/android.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral26
Sample
extension/assets/vscode-material-icons/icons/android.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral27
Sample
extension/assets/vscode-material-icons/icons/angular-component.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral28
Sample
extension/assets/vscode-material-icons/icons/angular-component.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral29
Sample
extension/assets/vscode-material-icons/icons/angular-directive.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral30
Sample
extension/assets/vscode-material-icons/icons/angular-directive.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral31
Sample
extension/assets/vscode-material-icons/icons/angular-guard.svg
Resource
win10v2004-20260911-en
General
- Target extension/assets/images/plikai-logo.svg
- Size 172B
- Sample261024-jmkffsav6r
- SHA256 c7c54cf953102eabf3fe67cce4148ca922bd1fd0f753240d1e2b4d291836cd39
- MD5 07689eb09fda57c946855c614708786a
- SHA1 90d07c9e4defb8d77a302b601480e8adc88a95b2
- SHA512 a075c607bbb0bed7fa18bd430a7e305d3fad587fea7d6666760ad778e1affacd0d70e9f936712bfd1f829cff9e1b1a6003ed8fd28bd98ed175cf0715917ed3db
- TLSH T107C08016478C0A50AD0497E4A9F5551521BB50D8008541B9E5E55569F0000CDF4D4990
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "174296962" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "499593044" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a000000000200000000001066000000010000200000006da3855ecd307ee57d0635ac37b33a46e5e3bb67065d683ef4362bf05e012b9c000000000e800000000200002000000028896379b5b38269794460b1ed6fce1e26888b84444d2e6baebd655f36cdd894200000005c6cc95e7c4973e066d718a3d80db38b836a15fe24e5ac3e4036fd66f246b01b4000000027bef36a89b473072b60c2c1e0b4ae39aec2224efae7afa250f286ad2f1b16cd7d8783e86e8d737c17463076d7290fc8c40e191ab304963dc189451c0e489fe7 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b5c76c9463dd01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{357D68D9-CF7F-11F1-B5F1-C6B1AE79E33D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 3b57edeb3942dd01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a000000000200000000001066000000010000200000007e1b4400216835b2ca15f9ca801babdb3f82cef8aed170edf5850629b1d617e6000000000e8000000002000020000000c077dc8c165327153fed73921c745ae9283de56d2d2f8872e55c814083a3d7375000000006dec20b7b98bf6c4cbfbf3b2e19f5875591c4b08565bffc8c5fa5efb1b04b1244283675f9a9e29c3f8de3b11450e27b26da3b42084f29e40493dfee35a03a472c039d7feb26f7eeb9522a71ecaca3c64000000030c128a3d113ec6162548f77e9ff221c0c1c335387ed2f12c032149756e07b8cf2597a3fb77f3a9e9c8db11313b14007418196d05ad5ecab67c8005a7fc984e2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a000000000200000000001066000000010000200000003d498600315174586511c37faa1dbde46a078c7b142a230b6415e6fd6625eca8000000000e80000000020000200000008c263b4287dc59c65fcf349e6a20b5d647397a5fa7ab4b070e55701749fef35510000000dec431c4cd5dcf430f2c2d94adb75dd540000000a12909f3d0f8225000ac3cebfb4b91acce92497f11afd3b45d3014b25a7814c531e2ed5afca1077203f18179fd843f77b02e597651d455a4463fa3046bdc9f21 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "168671919" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7070cc6c9463dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a0000000002000000000010660000000100002000000089c5713a99b36806d5dbc2c0809dac5428e549dbd2feeabff864bbd5962f4619000000000e800000000200002000000031067c13df90c4e3a42ae5a52790d16b0916519390365873ffc64b46f09de6902000000040e236a3cb0903360dd7aa5e213cd6adc42f1609b8f5a1eeb00c4d28ce07ef4740000000b728c0b50d0ba4bbaaaf488e5c09a2ed351696490d682cd3bb4e8101fd3944e2fd8cfecac51b1bc1dc5218ba8abc11e78dcd5a0f313c01b59a2fa2ead9f22af3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31286156" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31286156" IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4092 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4092 iexplore.exe 4092 iexplore.exe 5844 IEXPLORE.EXE 5844 IEXPLORE.EXE 5844 IEXPLORE.EXE 5844 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4092 wrote to memory of 5844 4092 iexplore.exe 85
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\extension\assets\images\plikai-logo.svg1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4092 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5844
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 63860c6866ccdc8ca3947367f5666fafe8f90df7697bc84c560f96e9b87d39c7
- MD5 0f22e37dc2aff46d7ef1b16e7c2cd680
- SHA1 32a82a6ba010dd92542b742ff6b77be2f9453de8
- SHA512 fcb3ea575ccec8c20bf872befeb0ecccdac0c3916264b1ae7ef7f4dee3d3ac49526eb683eaf72e6b141f4c58e3f3ec8afaf327d7de76447cb8c16f5e9168c1bb
- TLSH T179F09772E13DE8626CD585FC16A403FA3662B97B14048003A0BC489A448DB762F9D434
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 d79bc0d44ee1212b3b82fae9b8666642b03f861985e1af260dc231427c1a47ad
- MD5 132246dfcfc0bb3479cd1947196251b8
- SHA1 bb6defc80ce716e7ed7bdb51cd8d0a23d83bf9e2
- SHA512 0c687a721ee2e69753ae222043443cf5cc5c6af0e8ed28f49b6eb38394ed4ad538d440b403a2a6feb8323d3faabd8f765b9f4def186aa3eb7ce512bc0733a771
- TLSH T1B5E0C02811F6821FE0F8D0B44BD974219E6AF122082893B83DC45B04B706680EC03A37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DV9ET3T5\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH