Overview
overview
5Static
static
5Jobsil/LIS...ION.js
windows10-2004-x64
3Jobsil/LIS...ION.js
windows11-ltsc_2024-x64
3Jobsil/app...Pwa.js
windows10-2004-x64
3Jobsil/app...Pwa.js
windows11-ltsc_2024-x64
3Jobsil/app...sts.js
windows10-2004-x64
3Jobsil/app...sts.js
windows11-ltsc_2024-x64
3Jobsil/app...ler.js
windows10-2004-x64
3Jobsil/app...ler.js
windows11-ltsc_2024-x64
3Jobsil/app...ler.js
windows10-2004-x64
3Jobsil/app...ler.js
windows11-ltsc_2024-x64
3Jobsil/app...ler.js
windows10-2004-x64
3Jobsil/app...ler.js
windows11-ltsc_2024-x64
3Jobsil/app...ler.js
windows10-2004-x64
3Jobsil/app...ler.js
windows11-ltsc_2024-x64
3Jobsil/app...ion.js
windows10-2004-x64
3Jobsil/app...ion.js
windows11-ltsc_2024-x64
3Jobsil/app...ast.js
windows10-2004-x64
3Jobsil/app...ast.js
windows11-ltsc_2024-x64
3Jobsil/app...ile.js
windows10-2004-x64
3Jobsil/app...ile.js
windows11-ltsc_2024-x64
3Jobsil/app...ant.js
windows10-2004-x64
3Jobsil/app...ant.js
windows11-ltsc_2024-x64
3Jobsil/artisan
ubuntu-18.04-amd64
1Jobsil/artisan
debian-9-armhf
1Jobsil/artisan
debian-9-mips
1Jobsil/artisan
debian-9-mipsel
1Jobsil/fic...ges.js
windows10-2004-x64
3Jobsil/fic...ges.js
windows11-ltsc_2024-x64
3Jobsil/pub...on.svg
windows10-2004-x64
3Jobsil/pub...on.svg
windows11-ltsc_2024-x64
4Jobsil/pub...ent.js
windows10-2004-x64
3Jobsil/pub...ent.js
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 00:12
Behavioral task
behavioral1
Sample
Jobsil/LISEZ-MOI-FUSION.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
Jobsil/LISEZ-MOI-FUSION.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
Jobsil/app/Console/Commands/DiagnosePwa.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
Jobsil/app/Console/Commands/DiagnosePwa.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
Jobsil/app/Console/Commands/SendAlertDigests.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
Jobsil/app/Console/Commands/SendAlertDigests.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
Jobsil/app/Http/Controllers/CheckoutController.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
Jobsil/app/Http/Controllers/CheckoutController.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
Jobsil/app/Http/Controllers/MessageController.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
Jobsil/app/Http/Controllers/MessageController.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
Jobsil/app/Http/Controllers/MissionController.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
Jobsil/app/Http/Controllers/MissionController.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
Jobsil/app/Http/Controllers/QuoteController.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
Jobsil/app/Http/Controllers/QuoteController.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
Jobsil/app/Jobs/NotifyNewMission.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
Jobsil/app/Jobs/NotifyNewMission.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
Jobsil/app/Jobs/ShipBroadcast.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
Jobsil/app/Jobs/ShipBroadcast.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral19
Sample
Jobsil/app/Models/UserProfile.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
Jobsil/app/Models/UserProfile.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral21
Sample
Jobsil/app/Support/Assistant.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral22
Sample
Jobsil/app/Support/Assistant.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral23
Sample
Jobsil/artisan
Resource
ubuntu1804-amd64-20261019-en
Behavioral task
behavioral24
Sample
Jobsil/artisan
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral25
Sample
Jobsil/artisan
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral26
Sample
Jobsil/artisan
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral27
Sample
Jobsil/fichiers-partages.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral28
Sample
Jobsil/fichiers-partages.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral29
Sample
Jobsil/public/icons/icon.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral30
Sample
Jobsil/public/icons/icon.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral31
Sample
Jobsil/public/js/agent.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral32
Sample
Jobsil/public/js/agent.js
Resource
win11ltsc2024-20260911-en
General
- Target Jobsil/public/icons/icon.svg
- Size 357B
- Sample261102-ag6xtsd121
- SHA256 3ba7085caad5e45e69b4874a026626e0c351d0aa55779890510f70bb442fd638
- MD5 f841d224f77fc91d4603c502bc72654e
- SHA1 3e01f5bf93ac603e222131cd0e5e31c4dd86d75f
- SHA512 95ab2ea13dea54b19afe888e744637a76446e5b71dd171c4bfbb4211870dd70a1c527200ae9d713f7fc297946daefae488fe4f00165fb25719b47d16d0ffebb8
- TLSH T1F9E0C011854CCC1CB91781388B287171016B7186650E07B8D8553138620F7CFFC77A8C
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1144867200" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6FBAC85C-D653-11F1-B7E7-CAA8D6BDFC74} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd78800000000020000000000106600000001000020000000e7021825ef9c1833e8a19117e03a51baaac387d03a0288e1449de42a5641ef04000000000e80000000020000200000007038106909ae333ff19b53751ac19ac8d4a70cf55d22afab24e8c9daa8c249d65000000045f1d88c4603102afd7109cd3a044196c90f3d8b9ad81e695638ab7268150e0c824022a09cdc637343b67981cf68dabd7b0d46efcc599b8d5ada7a321b471ff26972d335295bfbc78d4e210b104be072400000006a2aa004699d7509e66e54395e224b96507d445f3353fbb4e6b8216e5fbf546db8f19d54c277557aa59afc13354d5294c51deffab558478ba5e5ffed3be6def2 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd7880000000002000000000010660000000100002000000099b841757d868833bd32555611537e0cabca0211dd4d48428478a5a76ebe3a35000000000e80000000020000200000003f2c59f5b1b62709b55b9f5c4f7c1b71c85267064975b73609fd9364cd5681aa200000002658b501b5c69e15bb87f39137c643555bd831c4edffa504f14042303f274a6f4000000041e303498f4e5e2734ed154c4fac8bcc82f306273d6b8c67e7898abd5c759cf2cdb1ac935e41e2cc1078f62dcb790a7cfa0fb2b843140b51c45e34697053694e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "500343902" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31287904" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ec8a45606add01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd7880000000002000000000010660000000100002000000028a4e96225e89f903512447f93f4efda974356a9cee4ed5583104b2c3a301784000000000e800000000200002000000076c3d015eee290c198fcc1ed5db10a44d9a1330316ab6b4ae248c13d776e499a10000000af9462d9bda54554c9eb1ee0b58796234000000081ee5babdf69edca16bd87cb3a44ca6a5a9413012a6b0336cb8aec75d8762fcd3902f16dc907592fc57f80014221a815fe3129ab9066e95db8b4c2cb288ecb2d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd78800000000020000000000106600000001000020000000961e641311baa06abdf95f3cdd5cdbb997c81816198e88336b1251c6ca40f884000000000e8000000002000020000000a0d16e659c1bb8f5f2fbcdfa37f45cd6ec7cd59ca77c70be9f0eccc28c4781ca200000001a4e3eb1b381290e1d3c2835e0db9f1e8802ce009c6640cd7c6b5b4d7696fd3240000000116580cc58e771256b3d46f91b7275b5e49042398e377bd36a285d8b5ca501344bccfc2c8ec78cb3a065422373f9090e8063b1da45b62b2d1634c148f0160c34 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1155179769" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31287904" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 16fc18bd3942dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70189245606add01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4852 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4852 iexplore.exe 4852 iexplore.exe 3960 IEXPLORE.EXE 3960 IEXPLORE.EXE 3960 IEXPLORE.EXE 3960 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4852 wrote to memory of 3960 4852 iexplore.exe 87
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Jobsil\public\icons\icon.svg1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4852 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3960
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 de418062023857e86457c3ea1d575a48f10847b9de5f9a9039e4264ce7882ba7
- MD5 25c8cbdccc8ad969363d62803c0229e8
- SHA1 b6cd43276c65cef2983389b37d911f30bd619a71
- SHA512 e20d454ec03bc0fe6f7a2bf13273f620caeaa82d934706e70521adb6795ac80de93cbac9bb5cf76e464bef17936fe6a03b7626bc36d032520bfea3b938d9d294
- TLSH T133F0D4CFD079F9346C2184DC019D49553930E1F5085801B6B47CA5E0941E35E7EDC039
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 d7010b788fc179014d236fcf1da3f5cb43cef46ad0e51cfa8c6ace615f83c482
- MD5 d1c8aa085f2b417833909bb35d0d00eb
- SHA1 deae92f61bf76b685884cfa8e56eebf2143aa1c0
- SHA512 63ca65163475151ac4c2a796fbaa2e233932652e4d1ae036e788b08b58299b30e427b2fa3d7d461510ee4a4f6b0390e11633628846376e3e30d7bd3d4a4dc598
- TLSH T1B4E0C03415F6412FF2F8F03547DAB82166DAF132142DA3B47AD4DB04F702A009C02929
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EQ5O6WBF\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LM36AMZP\favicon[1].ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH