Overview
overview
6Static
static
6ConnectA/r...ox.vbs
windows10-2004-x64
5ConnectA/r...fi.svg
windows10-2004-x64
3ConnectA/r...go.svg
windows10-2004-x64
3ConnectA/r...ed.svg
windows10-2004-x64
3ConnectA/r...ols.js
windows10-2004-x64
3ConnectA/r...ght.js
windows10-2004-x64
3ConnectA/r...i.html
windows10-2004-x64
3ConnectA/r...e.html
windows10-2004-x64
3ConnectA/r...y.html
windows10-2004-x64
3ConnectA/r...r.html
windows10-2004-x64
3ConnectA/r...y.html
windows10-2004-x64
3ConnectA/r...t.html
windows10-2004-x64
3ConnectA/r...e.html
windows10-2004-x64
3ConnectA/r...r.html
windows10-2004-x64
3ConnectA/r...t.html
windows10-2004-x64
3ConnectA/r...t.html
windows10-2004-x64
3ConnectA/r...s.html
windows10-2004-x64
3ConnectA/r...on.pyc
windows10-2004-x64
3ConnectA/r...__.pyc
windows10-2004-x64
3ConnectA/r...er.pyc
windows10-2004-x64
3ConnectA/r...re.pyc
windows10-2004-x64
3ConnectA/r...es.pyc
windows10-2004-x64
3ConnectA/r...__.pyc
windows10-2004-x64
3ConnectA/r...le.pyc
windows10-2004-x64
3ConnectA/r...le.pyc
windows10-2004-x64
3ConnectA/r...__.pyc
windows10-2004-x64
3ConnectA/r...ls.pyc
windows10-2004-x64
3ConnectA/r...__.pyc
windows10-2004-x64
3ConnectA/r...ay.pyc
windows10-2004-x64
3ConnectA/r...10.pyc
windows10-2004-x64
3ConnectA/r...13.pyc
windows10-2004-x64
3ConnectA/r...ob.pyc
windows10-2004-x64
3Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/10/2026, 22:35
Behavioral task
behavioral1
Sample
ConnectA/runtime/_tk_data/listbox.vbs
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
ConnectA/runtime/pygame/docs/generated/_static/pygame_lofi.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral3
Sample
ConnectA/runtime/pygame/docs/generated/_static/pygame_logo.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
ConnectA/runtime/pygame/docs/generated/_static/pygame_powered.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral5
Sample
ConnectA/runtime/pygame/docs/generated/_static/searchtools.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
ConnectA/runtime/pygame/docs/generated/_static/sphinx_highlight.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral7
Sample
ConnectA/runtime/pygame/docs/generated/c_api.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
ConnectA/runtime/pygame/docs/generated/c_api/base.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral9
Sample
ConnectA/runtime/pygame/docs/generated/c_api/bufferproxy.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
ConnectA/runtime/pygame/docs/generated/c_api/color.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral11
Sample
ConnectA/runtime/pygame/docs/generated/c_api/display.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
ConnectA/runtime/pygame/docs/generated/c_api/event.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral13
Sample
ConnectA/runtime/pygame/docs/generated/c_api/freetype.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
ConnectA/runtime/pygame/docs/generated/c_api/mixer.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral15
Sample
ConnectA/runtime/pygame/docs/generated/c_api/rect.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
ConnectA/runtime/pygame/docs/generated/c_api/rwobject.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral17
Sample
ConnectA/runtime/pygame/docs/generated/c_api/slots.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
ConnectA/runtime/setuptools/_vendor/packaging/version.pyc
Resource
win10v2004-20260911-en
Behavioral task
behavioral19
Sample
ConnectA/runtime/setuptools/_vendor/tomli/__init__.pyc
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
ConnectA/runtime/setuptools/_vendor/tomli/_parser.pyc
Resource
win10v2004-20260911-en
Behavioral task
behavioral21
Sample
ConnectA/runtime/setuptools/_vendor/tomli/_re.pyc
Resource
win10v2004-20260911-en
Behavioral task
behavioral22
Sample
ConnectA/runtime/setuptools/_vendor/tomli/_types.pyc
Resource
win10v2004-20260911-en
Behavioral task
behavioral23
Sample
ConnectA/runtime/setuptools/_vendor/wheel/__init__.pyc
Resource
win10v2004-20260911-en
Behavioral task
behavioral24
Sample
ConnectA/runtime/setuptools/_vendor/wheel/macosx_libfile.pyc
Resource
win10v2004-20260911-en
Behavioral task
behavioral25
Sample
ConnectA/runtime/setuptools/_vendor/wheel/wheelfile.pyc
Resource
win10v2004-20260911-en
Behavioral task
behavioral26
Sample
ConnectA/runtime/setuptools/_vendor/zipp/__init__.pyc
Resource
win10v2004-20260911-en
Behavioral task
behavioral27
Sample
ConnectA/runtime/setuptools/_vendor/zipp/_functools.pyc
Resource
win10v2004-20260911-en
Behavioral task
behavioral28
Sample
ConnectA/runtime/setuptools/_vendor/zipp/compat/__init__.pyc
Resource
win10v2004-20260911-en
Behavioral task
behavioral29
Sample
ConnectA/runtime/setuptools/_vendor/zipp/compat/overlay.pyc
Resource
win10v2004-20260911-en
Behavioral task
behavioral30
Sample
ConnectA/runtime/setuptools/_vendor/zipp/compat/py310.pyc
Resource
win10v2004-20260911-en
Behavioral task
behavioral31
Sample
ConnectA/runtime/setuptools/_vendor/zipp/compat/py313.pyc
Resource
win10v2004-20260911-en
Behavioral task
behavioral32
Sample
ConnectA/runtime/setuptools/_vendor/zipp/glob.pyc
Resource
win10v2004-20260911-en
General
- Target ConnectA/runtime/pygame/docs/generated/_static/pygame_lofi.svg
- Size 57KB
- Sample261030-2h4bwagy6p
- SHA256 e5e4da03a0257a1ce0d12b9448415aeee38d25efb4587b6111734a3e3ef98f9a
- MD5 0e9c66c15979a1a2a3b32b54baf886fb
- SHA1 508b38b4bfa8d7e544e5ed63f4c6f2c22aadb629
- SHA512 74232232997a30805b9654ae65d697ce333cf9ca06ec38a956c29f1de4ef3479a6e81e054f065147e34103f6339e7b783324816321165068cf9672ce779847a4
- SSDEEP 768:1k8AQ724X/rO/j/ZYbgZw9U50p262YELUVOoi7DB3XqPxhf9urbjFTX3H8Li0APt:GnzNLGAar1ELIKXExhfMrbhcKaS6K
- TLSH T1024309E813B38EE0D985CA86AFE111042C76607B5AB98284F70F569B7F5E4790C75F83
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd788000000000200000000001066000000010000200000001a7d15fe228ceefab29859fe152a144e8b47f0e14fc90f4497911e2fcb37b02d000000000e8000000002000020000000a6ad5efcbee84c68882caffebcc4bbf0039056cf7197c7c3920f0600ee2c14c620000000603387c45e6d8d1b2f123a82ed2ce946b723c0a50e5fb683c74f6b748d4c436d400000007218658501c64f43e8438a07c04d82cd41af247673c9293bee44a9c9a6c7b3dac8b1240120e3e3ec07924da0469c231fc058bf1de6907e480051b4658025aeb8 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "500165004" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 909973369e68dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E8407B89-D4B2-11F1-B7E7-56B788D469C5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3171502512" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd78800000000020000000000106600000001000020000000c61e5f2901f2ea1ae22e8e191cba3a8749beef4ca781d84b85e3970a33cce536000000000e80000000020000200000003db3f6eab21e4301d1c6d9a097635f82c7f07fc166917d35f2bd4f733bc660d650000000cfc7e8b86cfa65701819f3e435321f39638b974b05fec9f4a8274f9359ca0c0c734e66370dfec144a4f91211d02ddc19d24c9b8d729acec0df520d507b52cbab2041979d7857baa794965c8ffb294022400000005238a44a86055df968d758818e4fd29ae8a85cc15379cba9c8c095cc51bf8444e13a90283c93db6db869f17027d7af334f61e44265c81747bb0f3eee1d465cf0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 16fc18bd3942dd01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd7880000000002000000000010660000000100002000000046cc7a3f16ec5253f3aafbc37162b0ada3eb9619bcf6262be09f1a73aed27ec7000000000e8000000002000020000000dbcf4171e3d15c25508676b441be9f69a2c75283d8796b5b1f6ed1e86bbd5c2310000000b5bc3e28d5f91dee9f507702731c143b40000000acce3a1915159ecfc1012d06193da424160a9044e0322f5b500a0ad5a3bf16fd6ddb45fdb01bf8502f361b6ce19f3a45c9c01df3dc3a404c33a8736c841e3002 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd78800000000020000000000106600000001000020000000319453c13128a427f7d878ba08b6c1d89e8733039a9419186072e433fcf1efef000000000e8000000002000020000000e5de88883aa5e88994b00ab12d5d9000ae9e58c48491cfc0f05a4ff780aebfd3200000003c49bd434e138821e73ed91832ea0e36dfe75337cce5891ecf222e1a2efbad7d4000000044d39db6068fa6107ef26a497fe8ed643d6d3dd1a818d5838fa4dbafe8309d436348b74e1df5c47260a14834424a5da3e001fde08935eac48ec845d524199631 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b76e369e68dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31287487" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31287487" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3176345465" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2908 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2908 iexplore.exe 2908 iexplore.exe 3976 IEXPLORE.EXE 3976 IEXPLORE.EXE 3976 IEXPLORE.EXE 3976 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2908 wrote to memory of 3976 2908 iexplore.exe 85
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ConnectA\runtime\pygame\docs\generated\_static\pygame_lofi.svg1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3976
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 9371169177bd42b580ee23483d86dee8a2bf683ca69b86fa12b5f29257ced554
- MD5 80c592871670f8da99f95c162f75d237
- SHA1 6b751a939bafe7cb9db27fff6941fe1b8175642f
- SHA512 00e19248733f9416367932aae9e5b0b364813bc5cf3a4c480d4a3b17f2126e9148c9cd20ada11fad75a228edd5b8d3f4dca406c7a76cd2993470da76b0fcb56c
- TLSH T152F0DCA3E43CF8F02F9619EC04B68B9B343064AB0456410AE63CC9E64598FBBA71003B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 5e046c60717a8744041e258380db589a0174e49c032b199fe4ca8a9ecc393754
- MD5 7e4c0134253b5d5e46a83dbc551a5e82
- SHA1 fd97fdae09d5a8a1ba513b8f3f98f942bc812b91
- SHA512 14bd044a4c4144e056454ee0a860c7c3c07d37db0bc336011b0b495c1cf72eb0b9cd1f901e7c8904305e22156ea4f65d7ce0b713731d0a8246a15b9682bd4c33
- TLSH T17EE0C03415F6426EE4E6E4744BD9B521497AF1321459A2B93AD44B0CA702700AC02A29
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EQ5O6WBF\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LM36AMZP\favicon[1].ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH