hxxp://identifiez[.]fr/login[.]orange[.]fr/return_url%3Dhttps/rms[.]orange[.]fr/webmail/fr_FR/

Analysis

max time kernel
144s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20-03-2023 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://identifiez.fr/login.orange.fr/return_url%3Dhttps/rms.orange.fr/webmail/fr_FR/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000517a96c14dbcde07d370c08bd7e2f34f5b10b7c99e168a6c0cd4dd2a61e9cf18000000000e80000000020000200000008561c9bc3f12b51e71d61ad2bbe86c7770b992c234cb4afe046c3c0f98062639200000008d16147ae8379cbaeb1ab4b73f7c3c03370e55eaf2bdcd6ffa7bc9e5cddd914b40000000c35f6416aa2c66e94162c36e86e74a995520e14b37e865c3967c8e3710946c57868b3faa6f0a574af0eba73508544689ae73a3c10bd895ac14067f404ab42aea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000729f44ca1e63c76f3802965ffb0d46a1fc67e23b9d74b9f928593234e8819799000000000e8000000002000020000000ed9ae20b09e91dc66b29673cd6f67e89eb447f264705448100b22c26f74710ac20000000aa9437ffd2895814e0b269dda524380f752a3fbe8ef962cf0be1827b164b9aaf40000000bddaf14eb6c345889c897f9f2884c42327993b7869108deaa07cc07098df72fff5ee717a0e08e14235058263f3a4dfe58cd410189b4a94a206a2c4ddb8088bdb	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a97000000000200000000001066000000010000200000002074c717ee679c90622896299fcbd91b0c87603c508a3dd75ae77f25165ad147000000000e8000000002000020000000a4682be6a33996494d0792aebd6d5b3d0d8df9de311987d2ddd4bbca5115f95220000000b15306509666a9d112ef0757d1f05d3986ea3ed4e93d3652af08550a7977fd4940000000b995ac5b75360ac2a1ac1b892b448c481e7fcd5aeb2761233ef77de951e40ffbc36c128f92e794f04be83e47c5fb68bb150c72281079a5823e036042240114a6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31021870"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000cec0ca54dd3196e38e1239c64b109d76394e2fbeec1d57028071883257dcdf2c000000000e8000000002000020000000494eb059f7cbac56d1ca56cbc35314396ffdcab48fee70cb1e34c8a1dfc2281920000000d60f4440daf4aee406b77a471f9717a656663184c17cfd3762f295c908ea1378400000001597c0fbc6ea329ac1902a45dd3157629ece0f452fe2244685bef3a0205385e5e73fe456907d460dc2b1b167ca2b15fa72259caaa9c831d6cc11412d11ba40d2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a97000000000200000000001066000000010000200000006f5633e8ffd07c365300306ba1f559bf5ec9f6f091f4743528d7510fbfb7f19e000000000e80000000020000200000004d94c6a4905be84a95d98105fecec959345558588f56e61fca952f37bbc169c020000000e8568a3e24724b413ac8b72935ece070887dcba0926989f70b8051ae87912d9540000000701703959d7347b082591b08b7be62741480d2febdfd5c4cae3e2ca07ef2c78cba610c0c6e002385adfdd28fe1b8fd0d8575d79a8031ba7f9155ee79b1c416a3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a97000000000200000000001066000000010000200000006ee1906496011f4afef66edee42c2069e4d8b3803a998662439960cedec8e9b9000000000e8000000002000020000000d38f6a0188d1c450b42a47aca5e9eabea9c18b05f6af01328d240b103d422a7420000000c9623f266f3443ba5c56d6a6148557743d498fcda421cf2d87fbec2f7c9e7b8840000000fbfbd3e38f7da21ef07ccec8fa206195f30b15820c7c484d6a0bbe485b48848b4eb83b1149156ef903d987e99e32e2d4b7df870d29169b7d55f38b5a2f642031	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ba06ae2e5bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000f195ade36afc8e88122852c546037010ed1c0b5b8580706afaf5b65bbc46d9f4000000000e800000000200002000000070649a57f85e67f9d8c67c1d4b9334d8d1d55e1bd188db8ec1b2cb0cacf5f512200000006059fb17d2896938e2f60de9217a548fbc4f52471de69c2fc363a5b117dfeda440000000eb71f3c48aca148a059777333b51b4127a0cb75c10cc886c18c60389853886be55713850f1a8976967a2555053c7b0a1726915a385f0097a481abfbe1fc365f7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0a3b4e32e5bd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c39aab2e5bd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000839247a9f99f39e4c10cb6e1696d3c0f087e0e8124d54fa9ad45c43d6aedecce000000000e80000000020000200000008ecc9931dd6d8ea266be504cf13afcd198ec518b325f7ff2f4039fe92ee19daf20000000c9695c42dd2fcf526e896f8a7a7a8cceb348e63b75616fff19ac2f20d0bea82b40000000e83a7b7a4f71d3267edadb74fc678bd6d8bd714e27d94f57496284a95e452a31ed06f65a016a425eeabdab617323b55360a5254983bbdbe941e4f944207607e1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e23ee42e5bd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b0c6e42e5bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000cc8a32e5bd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f02c92aa2e5bd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c97bab2e5bd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 507a32ad2e5bd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0105bad2e5bd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4022f3e52e5bd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807928ab2e5bd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0add4ad2e5bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a970000000002000000000010660000000100002000000045aa0746bbfdf76d25dc8610e86d0a4929cd31540e207fe4a7fedbb7b3b5fe01000000000e8000000002000020000000cd91a3d2e520c3fbd0a1f948b80755936a6bba69b103ea220a0e330bad00b94520000000036258a97c5626ceb492b8bac54b4caf30136b7886a1a5d20b0922ddb4e03f8f400000008d797112efa5ceeafc237048339e2432017e6fd5abef509513a02338284a5b2494343cb27c773ae8fc53228a82cb6354dadd5b9661e48a9b6fd393ade6e7e28c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a970000000002000000000010660000000100002000000037c457aa338b2364518ce830747e7abdf305789cf63ef443c3643d05a3831365000000000e800000000200002000000044cc3a4fa8b835cf19b35ff6ee50a93d5c4fd4c5e4287e343dbb7c4de8a062b420000000c6da849b22c1f7092f2e02d975bb1f7bd9a00c9305b6f2bf085fa1ab49e2edc04000000037c5e0b7ddb2d193aaa0d78c0f8ddcd2a2ce0c8474c60ed6311e345695da26de10481dd9a65f7a39dd12e33c3881e4edf0c44a2337757b19c9376fb148439cec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000f1c03c1305417a5e85950fde56d37dc59131ed228f2f5233d4326fe8750f1d7f000000000e8000000002000020000000c55dd1d8855d84e431a3bd2db425d88ed34db20fde88dfe43508b6cee32e4efb20000000489c02b354b3ff44a6de2355891908b6e2d171bfdf541377f517dac7802b7dd440000000137e14b7c55a03a09e237fa27cc14befda8274493187293ccab9baad95df5564a5fa3089d08fbac912e09f327b32813f7f9c8054e3e673b546e95c11cbc8a3b5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d08937aa2e5bd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7039c4aa2e5bd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000c32145a535856bf1182aaea0de62055c575b52ae47b61d4c37d9d32b151db091000000000e8000000002000020000000fae43159b36b905d80a757508107675c5e1262f87224eb68649cb21904996ece20000000501bb58df88709481a85b8fd15801b8a8fc6f32a41e54fc8882d0c8741f85eb5400000008d66c03e254a14d8652b3b9c4879e92ee98ca623bf61ea60d53f0b7dfa9b2e6ada7e5155f3afe78ea4cb500396dce7a4ac93009240f29083b735d32c89b8d780	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d06d00ad2e5bd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d38aad2e5bd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5088bce22e5bd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000eba6b2a6da5c20cf93be2512cc1ac6a16bd97544def58fb86f6696bc368b1dd3000000000e80000000020000200000004f908344081c841e5052cab56b7ddea8c61dcc7a060e1a62d2a4a96671e7ef1d20000000b41021a57c44b6ec79921fb778a579aff7f84a9a6fbbb9d205606ba277e41d9f40000000569f76691a16f243e260c41b0f78f0d1a5da1b432a9b6a35760434400125f2af1eb13ef18dce69371c1ed545e536343613a1ef8709e26ca38e7e0a548cb912f0	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a97000000000200000000001066000000010000200000000186491bd53a7507690132e4c825d9fb7c608acee239a6bf4292f58769f43630000000000e800000000200002000000017799224923d1ebd170548d9639e44bdc8e07475b5d1ee9d395e3c26397a214b200000009a49029ec2cc60185af4f81e731abb8e687e4ae539764644f46a9cf2a160a53a400000004cc4f9569eaf1b5d2db8d6e78460bd1638544216560b3e9298ae1774e529a5cb26bb8b1b79b15591cf71431336468967619ccb692318fefe64dbc8f2547fba69	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31021870"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2959368823"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DAD74286-C721-11ED-ABF7-D660CAC54930} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000d5b1d76a8189b15a3179c2dd4f176440f3d7fe196c5d092e93ca89680fc869fe000000000e800000000200002000000076cf0d17461b73332eff67c725b27a485406e00402e558a210fbb17852d074c62000000050a18e57f30dc6799a93582bbc01bc980f4eed41e32d33b07e88bad181bf1b02400000001ef8d33c1eaf8028a8214e2d21bf39b494ffdea331d53513c3a3f5cd7010e12bdff7ed0be51309a8a96158705f0544f4f8d43617c7cf630e4d4792cea1a60d98	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a97000000000200000000001066000000010000200000000a93b686b43508800918178caa84bbda6ed4fd2224cbc1ddda13db30df451177000000000e80000000020000200000004f3315eb6db8133c2d8016fcbea4d3d8f8d62a979a505cd63be0a77a302e67472000000096ab62bd3fb74b0a73602e5c6d9fb00c755edc6eb37a964ec2e3ea927c2c83f04000000037f6d687d1ebcddbbba8c1623372c934c5f056f708e0563c7c1f846d3e1b8c55669676126a373120bbfde79c584b305000612a3adf906f86fca8335f808fbbf2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2947962704"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31021870"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000fbe564a580b54668f6d4bd0728764e90f3c2ea2c72c938ea6560d7a7b4c10c31000000000e8000000002000020000000c64a5a91cfc8464d643354440780438d811a03bdbbd5e92cb7f0989c2c325e45200000005335380fff90556b135af0f21265bb21084d4744e3a6665fc13bebb7ad74c7394000000049ac26454b803056f99f3f6f7f7d6cf2b860cf1a5fbed1248a163f6adaf50804d7546f56e04b34a2a0f8cf03e1b54a45facc0ffb8e48414199b05986eb95318e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000bf6257dca618587bb191e6cc27fd80da5a86886bbc76555a99176395c905bad2000000000e80000000020000200000000ea1da864a4802910a8fb84d6f9193f45076ccba4dda283e7d03c7beb59a21e1200000007fc637a003b3a54512b0f035c865b3b8f72f7db549809845751064f01a91f32e40000000590615160fd3107b5f115f3b0c180e0cfb78fc3e37a53c9e8024630f94f7550cf894b64e3392d0a7ec463df3ac54c31444e62fa5341612ac6356117708d36b8a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000641992643e1b76e7116afe07c1fb6091e847de5e716197aa59a1d4f50ca45479000000000e80000000020000200000002fa2b8899fc6be3806f00ba18538fc39d5d5aa37c2d1489a159334b7f52fb3ca200000004b7ed2072fa6973149c614055a0307ef5d885d900b1bfa4d6686c1b2a4081d154000000047bc563faff58e3c77488f4b310f533eb49722ab4fdf61edce39103a3417ce0c2c9bcbc19cf15b34a4cef2bd48380e3a295c20541d63dbc5630b17852d919871	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a97000000000200000000001066000000010000200000007361ec4d4d7cff391e8001d104bcd7ed6344df89e924b349ad7ccae1cd98106e000000000e80000000020000200000006f80b19bc2fc7eef7db0b281908899ba318ef573e39ba2ff86feb6715f04d72a20000000d7f973db92d0ee6078a997dcded1470f5664cf4ef462abde2ed068f320c2312140000000d8cb7fd7ad41eddb0359ead6eb53d5057aa580ddba44c0635b75a1b9fb2d3b68bb26ab1b1801f261ccd5337685312d41a6467ae05e98b4dfaed13197430a2f30	iexplore.exe

Suspicious use of FindShellTrayWindow 15 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	process
2368	iexplore.exe
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE

Suspicious use of SendNotifyMessage 14 IoCs

Processes:

IEXPLORE.EXE

pid	process
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	process
2368	iexplore.exe
2368	iexplore.exe
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
4624	IEXPLORE.EXE
2368	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2368 wrote to memory of 4624	2368	iexplore.exe	IEXPLORE.EXE
PID 2368 wrote to memory of 4624	2368	iexplore.exe	IEXPLORE.EXE
PID 2368 wrote to memory of 4624	2368	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://identifiez.fr/login.orange.fr/return_url%3Dhttps/rms.orange.fr/webmail/fr_FR/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A6FB9B7411C4737DA0876F5E23C9356
Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A6FB9B7411C4737DA0876F5E23C9356
Filesize
422B

MD5
a386f6958e56a389c4a5c3bfe0365c34

SHA1
a278960bbf12f167006751556da2c5f98362cf7b

SHA256
2987d532fd9bce805600e6469c06c4ae75c5ff28a0edcdbbb5c2ad2559fe18bc

SHA512
94cc92e4c95bcedce109d39385dd51f3bd59b5d35ca438bd99a631a9ac692e78df767c3d0ef540ce2faa19f5c7f5bcebb0b08e0d9c8c05805140ade124015edc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S64KWKX9\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit