846a04a5a04dad7129abe56d82b0578d4e2af6d6f73cfdf9de364c001d00c24d

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80455d28e9efd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf81200000000020000000000106600000001000020000000b7530903cea64420c71b2c224ad81d15383f27121b6aa5315c39c1483fbbd382000000000e80000000020000200000006a8d5beea6642fcf1677f024b6d8cb00ea868d093c1c0c5142fe204bf36d3475900000007bfd2803f6ca17feeca4fe0912d2d238cebb9a39c1af862f357f95414aa338bd63676bd3600e92649b3b7d87938acbd7a0a86b4bf0f03d1e72ca8c80366224708fe867895045faf804eef85af33ec790f2ad59c42ebc8f405456df1b73014c6e73ff7738eb4c9257b4b57369a32162a0c29ed0b9e78da40d40df6206ddd4b65ab4c230ca1b7a1193f8e6bf1732365f9f4000000016088a260f4480074e4425b771d2e3074e91eac8d5f77d2c0fd80790cac31db21e3d976705c13f2fb27272b29e21cf9798cb88a9405c9fb716309427044604f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf8120000000002000000000010660000000100002000000080897e091b80a3a093edfbab842706ae960ced783c30ad2aa75b9364589c3da6000000000e80000000020000200000004f24339ac6562628032aed8a075f82710413cf12905a3b74545ae38ed5519ef82000000073166f58164ae6ff8b4261d6b15b9a65e9b7557e2a2309593fa27ce03a9f6033400000004c749acb30a455f4f8a01130b09ac1a7fbdf63525a35f1b8e9a78f3c835653637e69db8184302d760b137acd7993d7e0af2eb389a24a09e6dd548be99a3dae98	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{52C86E81-5BDC-11EE-A0E4-CE1068F0F1D9} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "401833122"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

1732 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1732 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1732 iexplore.exe
1732 iexplore.exe
2012 IEXPLORE.EXE
2012 IEXPLORE.EXE
2012 IEXPLORE.EXE
2012 IEXPLORE.EXE

pid	process
1732	iexplore.exe

pid	process
1732	iexplore.exe

pid	process
1732	iexplore.exe
1732	iexplore.exe
2012	IEXPLORE.EXE
2012	IEXPLORE.EXE
2012	IEXPLORE.EXE
2012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1732 wrote to memory of 2012	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 2012	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 2012	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 2012	1732	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\edit_labels_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74c119a055fe282c87ddf74298d324c3

SHA1
651ddc9608a2e90b3706c80ed07629809c425744

SHA256
afe990a3c84e591793bfde7bd302f433a8f71cc44ca7c01d073711ebf847559b

SHA512
a40c80d9776d3feffdb7da5ce00b792dc7332e4be8af01645b70b1dfa2623fe336c5eea42ccc4d709ea182e2506a752207e64ca6ed9613727ee4b2ba57a942e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3f3b4e56b7df011471a341d68279452

SHA1
fde182a28e54202410945246631bea637caeb4b3

SHA256
810535e86b0ee5d840c8c64987869d671568c4208615ab07e903f64114e02ee1

SHA512
ecc13200d5d17a2c61b9262da7aa91468e60b51baf991a288802fdcd5680c019bc495924eadcb2eb34c1548c798715cd81fdc84fcbb0c1bfd259c9b4bceb0000

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c87ecab6e0e0b9378dc84f96c7f019f3

SHA1
09bf5d9cb03daea8df192ad9188fe0b84318161c

SHA256
cf520a93147b929955f1507abd1485fad14085537a825ffa54fc37be6af3f434

SHA512
4239f1dfae1a20b152e019cadb57480da596135d633b764d0793afad06405b146a40408c8470493e708e475e78acc522acaeffd5134272b6877aab8cc2f4c2ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fa74d2af9edafe4f1623c01b521f3be

SHA1
df9926aee08af329c8e1b8a5207bbc76dd4b7d8c

SHA256
765d8d8385c992d8fb48f27c93fa75b562ebedfe226eafb6639463b284590ad2

SHA512
1f96628db35c7504ae14f22751eb4247a5878499463b06fa63ff1b1ebd3c44e1e57e522b4415857c54b17ceb32c1cf39f4b9c87cd8228ef19aa42a7966e0d720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92cb4b94d5cc3953757a7ffe3b2e4af0

SHA1
06968f5372c983c502fa1c6f303cd8862bdc70d3

SHA256
99c6760e53d4ffcadea324ade8b7a6e9f4ee7b70a4a802e5da0078ec6d55e969

SHA512
0d193afe6f63a75af8623c86810a62eef27da8e9fb625741ca1d4b6db7a86710d721352ebd23a88d58b1376eb723cfeb7a2b30a8ba40ad282a0745cfd0abeb49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce5dc0613597ce65488a7c41881715ed

SHA1
40fd97bf15969fd40460e8d8055b8740be104baf

SHA256
b481fb448c98c1a66c59b5d411f0bcb4187d4f1494f0092883441bc12f6d6ad8

SHA512
8e2aa6756e8a91ec109a331d8677148ea45976df4466951637fd632fb4838f90bea43312e435eb468c5e561eb2d9aead3e61481b2f0c5602d2ed7a245dc39f48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1edcd19b7d62e5d98e0468f69c686222

SHA1
dd7541a23f03e42ed7883af30f021d21ddd3d840

SHA256
a577a5a8abdbee1b199b271db237b8b37fcd723dd1401cbbe3200ffbe077ed1a

SHA512
9f8c3ca2dafed78428449154e0e8827c31ea05c17bc43cd7d8377d7b208866e5258eaad2328e5fa8870b780ffcf9ef9ce2a0f2bc764bf7e396a70d55fedac6ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1da8aba35fad3f6953478dcc8982c1e

SHA1
837fbc917c4d3ce31e85d44a978d6c1880ca024f

SHA256
f562720b9e558c83d93db44e187d71bf5fa2d9cbd6060139c96da7475d56b032

SHA512
42df98c62261f90d99f981815dad1c54ac818da5534c60074581ae2cf2ed63868afe41442f492458c82a4b6f2ad69fa67cea48a3951879d7788202d7e7886f0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDA1A.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDB19.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit