846a04a5a04dad7129abe56d82b0578d4e2af6d6f73cfdf9de364c001d00c24d

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "401833129"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef00000000020000000000106600000001000020000000ebfc66a89249d419d01c419ebdddad0790289f8f08b1ea29ee38aaa553f778c5000000000e80000000020000200000009f65003380268e4978af6b8d164c3f10f046948e52dc91e18dfcb8f06e30f0bc90000000b8acea82170265812efdc0811a09ed47ee51e332e042b0bd7beb541dc4c8bd3f2c5620b85d4b0004a4bace7420c8f22a97a2b31ae3443896942fc26f874b58741d569c7d84422649630906e40de60c88f6014f9d2920b4d476d33f8bb6c07885f44746556e6caafc22da370f81ff3f4a72a957119febff5fb5dfd5380e2ef0d4ee7f745935d8acaa59df31dfc213b9d3400000003ec7d73425aad0b536407678f11fa447f83b42ac6011444cd5a93f2dd2cbe1665838874cb586b0ab1f98997720fb63a7ac8b48bfef13ed21853b31c0b84584f0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef0000000002000000000010660000000100002000000078b8e17a9d1254fccccc602c818f47dd81c6e203761e0126f00c5e87c148e82b000000000e8000000002000020000000280e53ff3c333ee0722294b5aac872029ee86ff3e58ebe37ea4b96bac89a5f9f2000000076d851aa3cc00a21bcbfeeaf160e47c64e20d66362542ee8500a90b19e1b234d40000000d64ea02ae0ae4c11c33d0107674115aa04599b36717c390ccb80f7000f698e5ff75b9442d3c1e7f952cd3eda61a35cf0fa96e6a7b3709a1f731193096cc31e0f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6098452be9efd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56969551-5BDC-11EE-A335-5AE081D2F0B4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1200 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1200 iexplore.exe
1200 iexplore.exe
2760 IEXPLORE.EXE
2760 IEXPLORE.EXE
2760 IEXPLORE.EXE
2760 IEXPLORE.EXE

pid	process
1200	iexplore.exe

pid	process
1200	iexplore.exe
1200	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1200 wrote to memory of 2760	1200	iexplore.exe	IEXPLORE.EXE
PID 1200 wrote to memory of 2760	1200	iexplore.exe	IEXPLORE.EXE
PID 1200 wrote to memory of 2760	1200	iexplore.exe	IEXPLORE.EXE
PID 1200 wrote to memory of 2760	1200	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\edit_medication_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98abcfb77f72dbb9e463360ca99b048e

SHA1
bff85d8118a78b6c5d52f7858805813bb9576341

SHA256
7e40998f788cd5875baff05b29d7ffe90fc373232224ea3d72a0d4715937071e

SHA512
ef0571f717ff65c890c2264c00d5d927be2d069004e3dd2490bd05af57e7b5844c96d507f33213f3a568d1f2d0d4fe33ef829ea570f3abe273705613fbd2098a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ccf892ecaf1f4028fa853a36d741cf9

SHA1
cae5baa5cf36ea53faef274445388ff6f8352b46

SHA256
582e6c0f614cc86de991adb931d6d38eefe636a4f8d31f79cb3fb72f6077e147

SHA512
0142db353f796cf626909655076096ee8554603f13ceb3b9608d9c7ebc422dfd813a2063e2c3302f8e1a67cb5e9d020817c77ea262c989acb2035f99c4c3f92f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fdcd9c49442b3e6c082bab05c3fbc5a

SHA1
86c82bcd54aa989a1dca1ad576bacc73f59bc364

SHA256
1c15ee1a731402eff615606fb3ee6a21deec8b5f744af06d2854e406b67a47dd

SHA512
a7eea706a3d7d651372a0136a6d1d54ea01e717cc0e38fd2ea6502a1eb566e2b1a083bce23d33cebd08494155b0b673f7507cfa364f1f9daeb8b5d68e637c4da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
431ee10512d8aebc773b83d25a5ab0b6

SHA1
e1cf56ca6a0e6b12c13fcabd4ccfa701259d3756

SHA256
5e061b483374f660492064c228aeb83fa15fae1557ad6b19d26326a1cf20a0a6

SHA512
3456fdaa85768d42b9551e151a8e9141f52036be9d7dc831f9b76da74bdc816119371df6d65e3d0a52ff75ba8e36289e72c9837960c3f9262e47d24ade64f5f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5620368f9ef43e33f861b6575f2eb3c7

SHA1
156b2cfd8f6e0f0593cbbc0a931e5ba568723016

SHA256
b6e784d695946b49bde24caa7983159e80c9df4b65b9fe868266e9c56540ffb3

SHA512
d0bc0801df00f0fc66f393567be6e40b8f2444c7f3291bce1beb3cd6982bbc172004d8696aa6418bd853c7c13d3e2ae5424ef20682a94ace942233b06c4c7b9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ae6be2ebb1612359340691e4b243b9a

SHA1
40cb5fad2a43b17dc114badf7b9e94a2675401b1

SHA256
c2a027c114d350d543efb8854b4ac14b2864467497f6aec770c695d17a00bcef

SHA512
342b1ad8ddd29fc3028fa98822e6a2cf98b746370db7160353a7dd3def8a161bd8c03ab4b752e3cb4bd9b58f70b6fefff1eecd09fb14d4502bdfd03ba6fae9f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26ecde5f635dec6ac4a8a06b6eae6484

SHA1
47ac73f76289a1985f08bf6893b39aa6a758fdd8

SHA256
40dfbabeddf693e6c839176d2c96143a70e1a6f2d38d02407f4a442c732578da

SHA512
aa91f1ed060b8031b2d8986a3932d188381597d43da2792e2cae5f58007b8ac54bfd69dfbdbc3a3be81794686c2ec8ee6dba1b37ea3e1ec124cfd433f14ebfa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c54982b575aa3b2bd29a4c9b835ac13f

SHA1
8bdb1e919ada192f0ea6e4d6f54ecf76a640b441

SHA256
8a85c1095bb2d2343f4cac7f6330198853e57fdc7449f833cf1e84be8927b411

SHA512
507d9f4715e261f0e1bdbf7e4ed02ea5d1cad170eb9b3faa51506af05af30bb138a12773e34e5fa73cf6f11871734626f485ca60b1be6e9646ec782935468321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2b839064c37f6179e008bfce87968a7

SHA1
52987cf8b8bda2265233976d80ae3f683aa2f83e

SHA256
d00242b527fa45c2594a62ea47251b3148780807c1d3e3130fc7b405f8eda77b

SHA512
e1af9ecb09947a3ab320fd8f2327e12d9847fec9800a1bfcbbbd916fda6ee25902d9bdd22fbdeb46b4b50b2966d3b792aa6846ce43e569d07f20770090817c86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
028b766be8062a73f45a549003b28246

SHA1
31b0708517764746a67166dbc4487a27e9a0a320

SHA256
71816fbe9a1287317e88a48c1a35584bba970183abeabc7dbd138b4b4b36d75d

SHA512
febfc591710bbb6ac2ce187e2fb2c930678bb7640f851ef1cf11ee9dbe7f0983e97846b343d6c804276f59b5279d891ac3f37828030223af7f5109d3acb60699

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8AF3.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8B83.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit