846a04a5a04dad7129abe56d82b0578d4e2af6d6f73cfdf9de364c001d00c24d

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "401833099"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5069C5D1-5BDC-11EE-BD03-CE1068F0F1D9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac20000000002000000000010660000000100002000000009be95aefdae84a922e0d2f29c212de3b362fc8465fad2ddd9937ef03836dcb1000000000e8000000002000020000000ea0cc50b1e15e1a54a78891ae8c45412cce05aceec6e746ecc1257635913ce3f900000009bd4e42b83e58015ced91fd6f32eca8db0470ef4b2b01a1113373710bccdd3512649383c296e449e17d4cc8f3e29afa5800ea2335fd2522d646f1e86ef501839bf198cce42b228697324d23de638701017dd343f776f6acbab05c608a4f1454778ffd85681cff8223645be57475107410cfe5efce4a3b783f86781a4390c463272555d3b3e08c99c65299957f4803ad140000000e2725257d35844ced5a6c6dc675864a84df254d96948041a1932d0612e2bafcc0cf15290d2712356cdb40d45de04921e3db6a35050441d320c91a105ab068469	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000da4787793071bb64dc2011243dcada3657c4bf5feb7ca247d570f0c05805e8c9000000000e800000000200002000000044a49c1c4233278616af6e6be9be106678431397a6dd490567f8b25686a767f520000000337f8cac9479e1411c240c7d677239714f466a89de4edcc68625d32f96ab177340000000f50da281001b3929f058301caa5ad6839d0692bd3345f76d0583a424bce9155941ccbbf4fd7e12c33debdc0d71737974d5b87bf89fe3b1710e6561159be51472	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e17c25e9efd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2416 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2416 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2416 iexplore.exe
2416 iexplore.exe
2612 IEXPLORE.EXE
2612 IEXPLORE.EXE
2612 IEXPLORE.EXE
2612 IEXPLORE.EXE

pid	process
2416	iexplore.exe

pid	process
2416	iexplore.exe

pid	process
2416	iexplore.exe
2416	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2416 wrote to memory of 2612	2416	iexplore.exe	IEXPLORE.EXE
PID 2416 wrote to memory of 2612	2416	iexplore.exe	IEXPLORE.EXE
PID 2416 wrote to memory of 2612	2416	iexplore.exe	IEXPLORE.EXE
PID 2416 wrote to memory of 2612	2416	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\blood_glucose_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03ca170985c9c667b59a75ef129c0ec5

SHA1
4be225773ea844906d2f280daab5aa6226a8dd8b

SHA256
0ddc226010dc00146dbe48c6c3bb10a7e33a23aaeedf96cc97195f4270e88a6f

SHA512
bc7fef2324458b48778e5f3a0711b8ac0a0cc302a87acc44fdfcc3ddd7613f474c1b6528a46c2501a18cea43b67e6bfd8b448934a7d673d17c43296ac6f5f382

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8604f5e8f7b082479666370078c1c7be

SHA1
c010a0bd97a8e39c2fc2ff4cc58fb91052275406

SHA256
33b9e22016aaa0630f4bf068ac0913007467d6a87f5ba16b4beb7a41ec2a40e1

SHA512
d3c16345e666e8baf17788866a9303e29ed495d0ce44998ddf03a85fbd73bac370f87c2bdf9ee8e949b53917ac8f42abf5cf39126766698f2483f811a682345c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b09127a36a34651bc01c2dadfbbee70

SHA1
b2db5e174f98af89e33b6348c7d2508f2fb17143

SHA256
0d6e352df8f6dd2c0c91b857f00b3140ef51491c9e27c37645ddf34ae09a5fa1

SHA512
43465a301e8db1d9d32b5ffa27c59e374e87a7a25a0c4c4f8a706875b3cbb00c07af7c560a9c9e93aa1321685364650c1b4d59fcd45a0e48a7a8091f0ff42a71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5caae9e08300cb3061f23178730b9a6b

SHA1
b55874713fd95f901a59c20d4c0fd384342d6975

SHA256
4af3d116a2d668c78cafa4d659ecbf34621accac9d983f3c73e8c46767dcbb64

SHA512
559501e4c80f3500ec3cbc3966f8780dc2af986770cf0d3261a71465ef895feaa51fb0a71b35b58c45bd089a0bc698623890d92a82bece5c5b798016acdbabe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe23bda73eda1433d02a2f1b5b0f3c01

SHA1
e18be45f8bc54e3fbefe67d05b4c65c8a666b1f4

SHA256
7dffeb4e909e5406413dd4d6f00e1f51bdb79d10bf4b534849a663e05fa9b256

SHA512
5d860de3274bae9a498b5ae228b29b128c718187ef6a162f4aea959453dee64569b601972bfc6ae18f1968c5ee268d3c54d46b2429f90c5dffa145f3e2b13881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea8a26965f2760c6e01c1970ff5e668b

SHA1
8294d1e79892a41b1f80bf2d564248ae02742497

SHA256
4bea950bda81d5edac3f9280472aa0df5b4001673ae4a4753db0b3078db3dbfb

SHA512
190b66b80e37f3f0b8b9a6a0d2350201e45209fc2ee9c39d4c1014d292780e26927545d400bf5d60980daf5e85b244a3a0634d30b004b8c73c65e2e05c4918fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07fc5fdf98ad6b87a4073d5907465740

SHA1
806fc0acdf6385c1b0909c03047b971b2efa6d24

SHA256
767d83f86391cf4bda1358b6264817f6203da28eaaf564093b535cdc0906b896

SHA512
6d5de1c2d5fc03ec5163223077dc6d60510cf4ca1ee90e596228fc3fa72cfedbd6fc81eca5403a0c47e584aa806ac3450e75eb0837065983bd312fea248123d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce66a68ced885f8e90321be12385ac66

SHA1
d8ac314d1a6d639353a69ec54d371adceef98046

SHA256
ed4415402dc2515af04b07bcf9f0ca076ff11133ccea294824f94f3e8de8e817

SHA512
a458279c4bf64f2aac318f39a7d2e8ea1cee0b74f39d1a62ba33aaf990ea777927c43b0eb40370149d44118baf8fccec7c4dd47555f1dcc6b7ec1f9942797224

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec8f74116ea088819e36411b5df5cac4

SHA1
13f880b5f2143de372058dbf1cd9f1a80c309356

SHA256
f484785dea1eda589fcbc569d4a8a58e9cab3032717cdf53e44f12ba6346e954

SHA512
ceb9893730c69018a2ed176d9b7569f598132e6465f5d713dcc2cb0302e993dcb34d6438e632edb43110df7e1ab517f5982740472c6b59678891638e0cad29b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf02ee9abfa85821719e95dfc5d2e7ef

SHA1
2da3f5f24a295333ff80dd0c0c51e209b80235d4

SHA256
8d5edb3b05f77c8c368e95a861e4203d8f1c266f3f5ba8b6ef03f7258aed7e62

SHA512
3211f171eef9a9d7a3ba2d82f12aa7934bd63159634a094a1cbca18712aba4e3303c26aada98b1e1e688912999b92edfdfc35ff34fd110ecb7c53e547f389da1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d495945467e4cab2b82ba825cf6994a

SHA1
3e147d04cfbaf6bf7c0864ae025e96321b95bfa5

SHA256
10ae8513ee985bd715547eae163975fa3a41cd83933211b0ec4df247a0b589f1

SHA512
3acefdb5d4bc43ddc2853c65723158666523d7a35bd6152b3b4edcc5db6de8798c4cb2fdc42f2c834dd76e6750ffaaa9550902a546e481cd242a1af1e4f08dd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cbb58d6240a67d69f82bd47a90ae75b

SHA1
154a04201bc499e5005ecb8c4cf341a0bf8c354c

SHA256
05b5dfd754e91bd99199f5303389e5883622eae5b1a9051d08ae79141458717c

SHA512
ca56b0bcc91456417a1c50ee3b5ecfd407b1f0641378fa6cbf0942bf6990b1b04c5d82480361304db1e6fce1bd227378bf44410a3f5e4b89bb203d8c25169fd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1319fec4a8daac9ae15eaf85c75c7676

SHA1
7b6da2d3cf9f6d6787a547d830417e1072e901ae

SHA256
a803d173db1c6b4ca708c110d0d2d0aae9b01f9862f6ab557dfff23fd16ac528

SHA512
16886f3e77d5b29f1f5468429c8e3ef67302c4b8d6c3d4d7172393ef3b639475617e6a401405bae5e914c8fcf3eb599359150238833c8632fa856aad7d682960

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a13fba48bd79b4aa8fcee6df13e456d9

SHA1
7247af1cc9965cb668922e972f9d76ad607452fa

SHA256
c2e3fb45ee89a0f4c45c97a22c1267106876cd6a1445bd77a936a26b1255e655

SHA512
d381752f7b52292d3e42153bcee205fe33b24674ed47dc4f36594865e9eff69cc102a6fc3bdd15aaf36da09bfaf657dbcd6f4f0bd427f168306028ed480733f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18a80a2864dd0b2deef299d184ddb763

SHA1
b347f351282e7f24a285723e8d37f0bef5058c3d

SHA256
d94c65e0a5acbb5ee29f24b9e17ba13e39c76cb689d03ab000f796ea8d7c2150

SHA512
e08db379dad4c0ea148fb945dd605a852e07f257290a127a4829e7a7474676bea8b6ae289d028873684e5f7d84034661022427a635ea7f6d49bc9eb4a745b6d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e243344f252c693d6afc07686a8dc1cd

SHA1
43c8a941994c77893aca4b26a31329fa8a3fecca

SHA256
cc7769c72dd8b7984fd840c3671fa51346df53467d930fbefbe74a957a4c2204

SHA512
76d1c0e5f3e887ce20e2c6d317004b6a35d9953e93e94957d3e84208fa0bb561b1c7c991c4ac53091f4e4d87f61454bf52d8168c7126589be7ef78f8b7c3bb63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c90e0b7bad9633081eba8404c8e1a46

SHA1
10ad4b09f38f0fe13461418c2b1634a81fcc8eed

SHA256
0e29454e7906b000a2998148b236c34b33038ce673adc2cc9a4f1d7477bb7aa1

SHA512
36b387c09293401e29f20d1a327bdca3376da0e25cbec7869279a239bdaf7ff874e74dc464ad7b475c97253482b3fb4e2d87ee15f788a8b9465cf5dbd501475c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5016.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar50B5.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit