Analysis
-
max time kernel
147s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2023, 13:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.ikorealestate.eu/fr/
Resource
win10v2004-20230220-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
https://www.ikorealestate.eu/fr/
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31019864" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c01556065953d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000782bf4233cbda072dbdd78b3cee8c66e1f7b895925fb4f276a9065e71c8d754d000000000e80000000020000200000003e27e54eefa9ec46356d3afc16e2a6eb0fa23545f8f6227b0383d8787e2d5eb520000000e014613d3e400fa0cce4f6c2205c8790eafe4cef91f1f2ff205e6690bc67b02e4000000013148d2a6a00f914c1e2b12a4d2f653687cde9e39f2dce4fcd932711fe53f3b111ecc075fb5b4f475acc9ecbe18dae36f5964f1da142c57bfdbf060e85cc67ff iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4250427311" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4250427311" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31019864" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "385221908" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801f64065953d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2817F04D-BF4C-11ED-ABF7-FE76446D24E5} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000f265a725dad1ebaaa82f15a00724c70630de15af7a1f24b1d5afce3e80b8f788000000000e80000000020000200000007c6621ea2218a6ee1bfe9555a5b4b80e6bc845b7c08805a163dab1b986063d3c20000000ce4f56cd351bbfca25796fe685d27a034265d38d46042d63c1fd5b2a1326769e40000000f34210e49fe1c4e1b1258b23056fd78a32c2216832e5af5c19458f800db6c6b0119b1f7821924c0b21c8b5d6cea4b9b10518894aff233e26c6afa92dfa1e54c2 iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1529757233-3489015626-3409890339-1000\{7EA7101A-A49C-4395-BAD7-64C1E5B904CB} IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3992 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE Token: SeShutdownPrivilege 4924 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4924 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3992 iexplore.exe 3992 iexplore.exe 4924 IEXPLORE.EXE 4924 IEXPLORE.EXE 4924 IEXPLORE.EXE 4924 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3992 wrote to memory of 4924 3992 iexplore.exe 86 PID 3992 wrote to memory of 4924 3992 iexplore.exe 86 PID 3992 wrote to memory of 4924 3992 iexplore.exe 86
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.ikorealestate.eu/fr/1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3992 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4924
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD57fd18fafed5476ac55791eb8f242fda4
SHA15a3f020d75cab0eaf95e867e0775c379324f86ad
SHA256ae5eb9ee7b8417716664e98b8903946debdb8d7ef81cdcb6259383857f0eeac4
SHA51252d7a7bb3b161ec4d525145ce2e7f0b3db07f158215446688f9e3a892c84eb8d953093480c2f1ddf1f139f6c9eacd6bf84774d8940c2b6a1f62971f9d38394f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD537d2e89cd4bc5e3afb53fefc127ca6a8
SHA1c375a27b42108a3af9a86a25663b2b3e1b835343
SHA2563438b05266228a3a13dacda5d3ff4a1ba306982d7e46a04f9b7396ea9f5a09df
SHA512651ad43abbeeda8515331a92d34c72d1622668c03ce982a558dad17beaadf8095de447004fbec5d1623c99f3ede99e72f85a04be79472f09aa766f3980c11b6e
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
828B
MD5d6c0f03d0d6a9069d1d129ecfb10279b
SHA166eecd44a13f4ac28af5194ccb9f1b77426e8d12
SHA25690cc6e7de3307e9c373ebdce50293cb8f31f608efd8190f15dc803ee26da1e21
SHA512e6a2c8b0c315f455abe6902b1ffc89532458fc81d9b03b66f3c0982f17c28401dbcc3e4e642f1a1c3bc1abf841e05075570860a9f1ea30c075d695f15d8c9685
-
Filesize
674B
MD50bf4256e7f46e6c649312e3043ca95be
SHA1704ddf2292f326d8dc1f861eadbfc8216de7b92e
SHA256cdd8b99b8b5ec08530bf7eb62472e8ef0d5f3566c57c85c8c46ec4fdbc5aa867
SHA512b387dbc1589fe740289089089b38d1204585d5373ddfb2260a2430334491d0a595f3de48167c566a6c6fe41032ceab35baf24f2cd8bb7034bbe430a20ca24b23
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
