hxxps://s[.]free[.]fr/Q8RfeHh

Analysis

max time kernel
46s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2023, 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://s.free.fr/Q8RfeHh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "17"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20505b267eaad901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31042174"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "729"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31042174"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.free.fr\ = "729"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "765"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "965"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "330"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.free.fr\ = "719"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "574"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\TypedURLsTime	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "942"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "719"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "550"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "679"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31042174"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "6"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.free.fr\ = "941"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "679"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "942"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "551"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "742"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{536B5BFD-1671-11EE-94FE-7295A88F71B6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "910"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.free.fr\ = "1110"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url1 = 44b31a247eaad901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "498"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "941"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\IESettingSync	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.free.fr\ = "574"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.free.fr\ = "498"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "742"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "741"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.free.fr\ = "741"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "550"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\TypedURLs	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "728429477"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\DOMStorage\free.fr	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "330"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "765"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "6"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3580	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3580	iexplore.exe
3580	iexplore.exe
3712	IEXPLORE.EXE
3712	IEXPLORE.EXE
3712	IEXPLORE.EXE
3712	IEXPLORE.EXE
3580	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 3712	3580	iexplore.exe	86
PID 3580 wrote to memory of 3712	3580	iexplore.exe	86
PID 3580 wrote to memory of 3712	3580	iexplore.exe	86

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://s.free.fr/Q8RfeHh
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3580 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\LA8NYCON\www.free[1].xml

Filesize
994B

MD5
c53bdcdcdb70b5d247be3ad8353a0d54

SHA1
c39da3560bfdd488af5fd4621c6183c14d726455

SHA256
c9cfca3d3b6d690d55ec54c152a85385f365559dcb5f043674e2649823cf1bc1

SHA512
b42255667c8bfad9bcdd23d2e2cf6f466b56056aed45f018339cebf0130c62c493b7ae072185039d7fcc684763b81fdf523b9978918ca394dbc711f02ce71381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\LA8NYCON\www.free[1].xml

Filesize
1KB

MD5
e7d2d05981fbd4504ae5d59fd40b56df

SHA1
d4a7f5357179b4eb0c8cf1706c611f748a3738df

SHA256
0aaa929a3f478b561ea15c4bcccc5bd8df7c3b540bf02a0771b8bd5b26b135ec

SHA512
dd79fd3df2e7873f2bc067c27296ad803a1599748a87f8ab3f6e014215057b75f95ccdd713198c789b1df678bc8d99d98d4307456b4deb9327b007244471e590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\LA8NYCON\www.free[1].xml

Filesize
1KB

MD5
b9d8f8d1df4bca9590327c8b51ab730f

SHA1
247e9d6be62c85530249a3b4216ba89c23ef55de

SHA256
eb4b60175dfb19e327b6c2991ee376f18190a876a84a267a7f034d3f9f397053

SHA512
572be17212d248ee35395d96d4bff4e601f2237923d089e5688b51f3a9fb4093e528b9f1d93e43c07fa05c4c862d37a719204fb1ed1fbe2813f859da1338793a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\LA8NYCON\www.free[1].xml

Filesize
1KB

MD5
ed97f97977f3479300648bc20751049e

SHA1
9e9d203649191a20b754947164cfe402002c91d5

SHA256
b634caff83256a0c6a461e37ffa8ff794e81a6e5749ed35b5996b5d59e3fc1b9

SHA512
915949bb55fda82ca5bc42598de622dc13262454646e7c220232c4ec340c0ac985d97468c8d2877a2354cd6e6ae9c1ed9612524738640b67b6c2ec135b74c001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\LA8NYCON\www.free[1].xml

Filesize
1KB

MD5
ba07a44937e183d3144ea46cefd3dbcb

SHA1
8bfc631511db98f2c7bfe17317cfac5e4231a2e6

SHA256
ad4c74079ba31b78a1b4fc68a2eb9b4cf97cb7f2f5b526dfdd16b552371820e2

SHA512
04d127f406185afb59287658df9208d00e0476289e7f5e2102fc1eee7a9f61842d7ecdc384686214e0de831398a25d3b6a9973087dfbbdeac069cfb12fb8231b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\LA8NYCON\www.free[1].xml

Filesize
1KB

MD5
13411f9226c6a451c03a7632215776cf

SHA1
9000dc65fc97e5d8819fff5fcd1f81585a260856

SHA256
8c3a7acecc61f0be1f3075bb6c869e91b17edc43e510e102d3f949152a607906

SHA512
f11654bf539c17581b8a35a2427504c816d7647fc00c870dfcd9e28091bd40abfb847ef25f7401f7492f22fc1545b6cec8627b33b87a83b9ab20d3e457d7afa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\LA8NYCON\www.free[1].xml

Filesize
1KB

MD5
6d70aff71c5f190796a66eb4b3b51358

SHA1
dce0cdcccac383667161383131ce792d68904c8d

SHA256
abb88b183dcff4453ff36c8f26a8a114f8df90b886f2de6c96de610da91823f8

SHA512
df8c692f995044a31a61fc97ec7bada65b7ffb5101dd4edff33b23f70dc4ddcf0f4637eb7619c8684e0ca031b48c5baf86e549940def1db36b8f4adeb2bafa94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\LA8NYCON\www.free[1].xml

Filesize
1KB

MD5
6d70aff71c5f190796a66eb4b3b51358

SHA1
dce0cdcccac383667161383131ce792d68904c8d

SHA256
abb88b183dcff4453ff36c8f26a8a114f8df90b886f2de6c96de610da91823f8

SHA512
df8c692f995044a31a61fc97ec7bada65b7ffb5101dd4edff33b23f70dc4ddcf0f4637eb7619c8684e0ca031b48c5baf86e549940def1db36b8f4adeb2bafa94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\LA8NYCON\www.free[1].xml

Filesize
1KB

MD5
2f316657a69ed56d822208f572f63d2c

SHA1
ed49e5d06fb47b64927e1e2033c7f2569ad7f914

SHA256
478457b7b94fa4591cfc249a27c0837ba1b98be142591f931d310e922b953b80

SHA512
0f9a48a5ee5311a32806f92273e6e54a9143b18f2a1f443922d560b196874a43d3d882e678ff5c888a07a0541a0f533763d930c76e77a5244e4912a9bf743773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2nx5ayn\imagestore.dat

Filesize
2KB

MD5
ac250fe45cb12344a6083946a4655b48

SHA1
e562df3c62107c3f6cc1ac6022eec6e0ab0b2de3

SHA256
fdacb7698207e0c4b29ac6f1e0cee4ae906382e13c79df6356221dbc6979bfa6

SHA512
0ce8943144952e9c740ac40577639d8522bed2d18964ab901e3115ebb896324fbfb2cdc63d2ca2235aeec1a26e86e794b1e0cd3dc715c48fd26286a3c1ecefb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DBSP7ZL8\favicon-196x196[1].png

Filesize
2KB

MD5
20aa29f1d105096b3cf0521723d07ac6

SHA1
dd5183c93883a89f53b5a3e4b1f7ecf7913d7ef3

SHA256
f6139a7d0466aff13cc81eac1e6501c1a70794dfa46d0bd7ee568ff3df56a7fd

SHA512
937464e66c40fd16a379814d16c1c71e066ed7470b2c476ca822732ac0dc52b0758215a82a997aff0c85c7da6cf05b02dee496967bd5908f11f83e8fc0d1324f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VPN0KP4V\js[1].js

Filesize
211KB

MD5
001a985267f5db4fee76d84475c896b0

SHA1
57b6eeca7ab7f2e9f401c814302e2458670688b9

SHA256
9687b591cca30016173e7751f3136d7e7550079f57caec5153602de52d4bdd93

SHA512
16532e57506622ed9017bb7fa9eae928b039f8da4bf8115bc611369ee15d07e83d57c57b4fd1688d42b5f6dafb485d561e167ed044fd10edfe7ba9d7f266250c

Download Submit