Analysis
- max time kernel
91s - max time network
146s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
07/11/2026, 13:02
Static task
static1
Behavioral task
behavioral1
Sample
YouAreAnIdiot.hta
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
11 signatures
150 seconds
General
- Target YouAreAnIdiot.hta
- Size 3.0MB
- Sample261107-p91nvax18l
- SHA256 295dd6c5a81bf4c0d18f095d253d6bbcd50b8b0d42b54546863de518c546016f
- MD5 49dd6edf28b82bae571240bd03665223
- SHA1 fb0ca6c619d13539ef01ae3a7e9e11d3db5e76d3
- SHA512 50bf76102b046f4f5feb3a33945829350ee5cec597069d4f02513ee6910baa7e737e5e8589011b1d2da6b8bd6b8220f1ed807dc72dd649f429ba1f1438c9d4e6
- SSDEEP 49152:pdKC2/zbvZv1ckaT0dKC2/zbvZv1ckaTDy5EMigfk2:L
- TLSH T1FCE5123A340310EF6A0F9A1FEA363FC55D1C1D9F109AF64488D673CF12C9A195EA859E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 29 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ielowutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe - Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = e6c0dc937342dd01 iexplore.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000fffffffffffffffffffffffffffffffff8010000340000007e06000099020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff7200000072000000f8040000d7020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{C1B842D5-D93E-4D7A-AB5D-0D2FF62A69BF}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffa6000000a60000002c0500000b030000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffc4010000000000004a06000065020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffae020000ea000000340700004f030000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1781178880" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "500821538" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff94020000d00000001a07000035030000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff8c0000008c00000012050000f1020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffc0000000c00000004605000025030000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff120200004e00000098060000b3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffb6000000b60000003c0500001b030000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff4602000082000000cc060000e7020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff4201000042010000c8050000a7030000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff600200009c000000e606000001030000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffea000000ea000000700500004f030000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5c0100005c010000e2050000c1030000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\RepId iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1780866563" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff9c0000009c0000002205000001030000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2801000028010000ae0500008d030000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31289016" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{84D04147-DAAB-11F1-A8E9-E6CB39EDBEB6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2584227348-426884507-1572084426-1000\{7D546883-20EB-4ADE-B622-D311CF8C77B5} mshta.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2584227348-426884507-1572084426-1000\{85F996AA-40DD-420A-82D1-3F4E81ACB84D} mshta.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2584227348-426884507-1572084426-1000\{07499D00-D5DA-43AE-9D99-A71A46B8CF05} mshta.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2584227348-426884507-1572084426-1000\{9147A33F-F6F1-48F4-BD10-079BAD20D29E} mshta.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2036 iexplore.exe - Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe 4692 IEXPLORE.EXE 4692 IEXPLORE.EXE 2036 iexplore.exe 2036 iexplore.exe 5808 IEXPLORE.EXE 5808 IEXPLORE.EXE 2036 iexplore.exe 2036 iexplore.exe 4272 IEXPLORE.EXE 4272 IEXPLORE.EXE 2036 iexplore.exe 2036 iexplore.exe 764 IEXPLORE.EXE 764 IEXPLORE.EXE 2036 iexplore.exe 2036 iexplore.exe 5984 IEXPLORE.EXE 5984 IEXPLORE.EXE 2036 iexplore.exe 2036 iexplore.exe 4520 IEXPLORE.EXE 4520 IEXPLORE.EXE 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 1536 IEXPLORE.EXE 1536 IEXPLORE.EXE 4248 IEXPLORE.EXE 4248 IEXPLORE.EXE 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 1284 IEXPLORE.EXE 1284 IEXPLORE.EXE 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 2036 iexplore.exe 3908 IEXPLORE.EXE 3908 IEXPLORE.EXE 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE 2036 iexplore.exe 2036 iexplore.exe 1664 IEXPLORE.EXE 1664 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2036 wrote to memory of 4692 2036 iexplore.exe 86 PID 2036 wrote to memory of 5808 2036 iexplore.exe 89 PID 2036 wrote to memory of 4272 2036 iexplore.exe 92 PID 2036 wrote to memory of 764 2036 iexplore.exe 94 PID 2036 wrote to memory of 5984 2036 iexplore.exe 96 PID 2036 wrote to memory of 4520 2036 iexplore.exe 98 PID 2036 wrote to memory of 1536 2036 iexplore.exe 100 PID 2036 wrote to memory of 4248 2036 iexplore.exe 101 PID 2036 wrote to memory of 3000 2036 iexplore.exe 102 PID 2036 wrote to memory of 1284 2036 iexplore.exe 103 PID 2036 wrote to memory of 2900 2036 iexplore.exe 104 PID 2036 wrote to memory of 3908 2036 iexplore.exe 108 PID 2036 wrote to memory of 2872 2036 iexplore.exe 109 PID 2036 wrote to memory of 1664 2036 iexplore.exe 110 PID 2036 wrote to memory of 4832 2036 iexplore.exe 111 PID 2036 wrote to memory of 2508 2036 iexplore.exe 112 PID 2036 wrote to memory of 2356 2036 iexplore.exe 113 PID 2036 wrote to memory of 5348 2036 iexplore.exe 114 PID 2036 wrote to memory of 4336 2036 iexplore.exe 115 PID 2036 wrote to memory of 2784 2036 iexplore.exe 116 PID 2036 wrote to memory of 1992 2036 iexplore.exe 117 PID 2036 wrote to memory of 4484 2036 iexplore.exe 118 PID 2036 wrote to memory of 872 2036 iexplore.exe 119 PID 2036 wrote to memory of 5980 2036 iexplore.exe 120 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\YouAreAnIdiot.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5560
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:1568
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4692
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:17414 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5808
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:82946 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4272
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:17426 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:764
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:17436 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5984
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:82956 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4520
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:17438 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1536
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:214018 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4248
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:82968 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3000
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:17440 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1284
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:17454 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2900
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:17460 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3908
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:82982 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2872
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:17462 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1664
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:214020 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:4832
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:17466 /prefetch:22⤵
- System Location Discovery: System Language Discovery
PID:2508
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:17470 /prefetch:22⤵
- System Location Discovery: System Language Discovery
PID:2356
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:83022 /prefetch:22⤵
- System Location Discovery: System Language Discovery
PID:5348
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:83026 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:4336
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:17508 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2784
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:17516 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:1992
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:83034 /prefetch:22⤵
- System Location Discovery: System Language Discovery
PID:4484
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:83052 /prefetch:22⤵
- System Location Discovery: System Language Discovery
PID:872
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:17538 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:5980
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:83072 /prefetch:22⤵PID:5488
-
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2364
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1416
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1620
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 d138641fabab14c3b2dc747dd70aaf95f4b6104aac4009507743c0bbe2b0fab0
- MD5 2667ab04f6a5c596ba82c4d7edbe5854
- SHA1 c3a697155006951800bfa3d35e23a52907f0733e
- SHA512 842eb66ddc575e1a33877d365f611f766b00a67b1bed10a5acde7d56bd095ed756d527ece804d5f48bd6ddeba59be6021175d8879ff578f6245d2c5dd3a84887
- TLSH T1E6F0DC22B429F8FA264098DC6179577A3030D57B52A48314703CC5E10CB53ABAA2E13E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 52f32aa5853586c43254d111923129689aa7cc1fd5062241a4865456d9826056
- MD5 9ffb0f4a83c9e221b32e45b3d40f71c1
- SHA1 33a0b5a7a5060ca2f9075401b700a34d761d994d
- SHA512 d84117934ed2721204283d9cfbdd161b6314aece59a689b461c9be1041549874c60041b3751330321702815869c1d261588a31113ee591459d94951778b62441
- TLSH T1A3E0C02411FA011FE4E9F4348BDAB826556BF022141993B43EC4AB08BB02A009C03A35
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8YQES76Z\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~DF7BA8D8E0DF4768D7.TMP
- Size 16KB
- SHA256 9d8c9c6cf52943a2808f8593971386ce875d4dbf0cc697c7778be7d26411d139
- MD5 fd5cb310c039152b7bf9a6cb790ef03e
- SHA1 d04e737f9989291b6462871ddab0b82634a7251c
- SHA512 70286b1e5870750784de0a6edb1c018fe4b53dddb7454e7178c0cdfc57052470b3231de18b2e4ab4a3cb027cd8f7f0d6221060100f8ee9345c7c58b29a6f0d54
- SSDEEP 3:alFXEAUolllbll1nltllNlFlVlZmllol/Hflly7l8t5tXlRslkhlEkllM/llsll7:a/vllLaluqh8tMlkxM6GKBpUW1
- TLSH T1B5728C1587810A02C752033395C00B986733F06027C60F82AB34A1BA2C863D0AA00635
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms
- Size 3KB
- SHA256 50a7b5bd74bab103001cf9a3e926ef8875eca0f6278d60b01632c00b1fe275af
- MD5 2f011ac2e6df3eac32777e6f0990a199
- SHA1 b31d1f9fff0bfddd203e811169c157231bf764d4
- SHA512 79d663ece89f069e5a47a3625949c67865f9c92ec76e56fade66ecac63369302647421c7ff1706a2a8b4538c5c6ecd5c1ea3129367813c3bf5e458a240e2cb2c
- TLSH T13961E10607D2094BE5F35332AC75EB82E377BC01AA05C66F54C8466908F5200E5BE7BF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AWKF1L5SH4O6VTZLZPS8.temp
- Size 3KB
- SHA256 d2c80bb924260cbb7fc42e77c260eed0350b47fa2dbe4de9b41157d156fed8c3
- MD5 3345b507892de51a0ac49685a47aaa09
- SHA1 968d24388b90d1bbe83be523c2c4c287ff502b92
- SHA512 4ae4396680e5d6698881fc484b7ac5841ebe47dd38bd98890eacd9a036a8f03f2795164a2328dea1787c7b331bd19743d748af8aeca62181b1b2f9b892804b9e
- TLSH T1DB61DF0507D20A4BE5F35332AC75EB82A37BBC01A605C95F54C8466908F5600E5BE7BF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\YouAreAnIdiot.hta
- Size 3.0MB
- SHA256 295dd6c5a81bf4c0d18f095d253d6bbcd50b8b0d42b54546863de518c546016f
- MD5 49dd6edf28b82bae571240bd03665223
- SHA1 fb0ca6c619d13539ef01ae3a7e9e11d3db5e76d3
- SHA512 50bf76102b046f4f5feb3a33945829350ee5cec597069d4f02513ee6910baa7e737e5e8589011b1d2da6b8bd6b8220f1ed807dc72dd649f429ba1f1438c9d4e6
- SSDEEP 49152:pdKC2/zbvZv1ckaT0dKC2/zbvZv1ckaTDy5EMigfk2:L
- TLSH T1FCE5123A340310EF6A0F9A1FEA363FC55D1C1D9F109AF64488D673CF12C9A195EA859E
- MD5 SHA1 SHA512 SSDEEP TLSH