Analysis
-
max time kernel
136s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
15-12-2023 21:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gdcobros.com/tensile/##_d2FsdGVyX2JldHpAY2x0LXVmYS5jb20=
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://gdcobros.com/tensile/##_d2FsdGVyX2JldHpAY2x0LXVmYS5jb20=
Resource
win10v2004-20231215-en
General
-
Target
https://gdcobros.com/tensile/##_d2FsdGVyX2JldHpAY2x0LXVmYS5jb20=
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000937d915e1d6930a372937bfbc85b7fa0d147d7a170f92afb0aa24bf22d5551d3000000000e800000000200002000000035079982898ac1c1628c4a21a999d78df91bbea174ef4f20873e53e7211990d6200000001e4a0961fe0344c5d38db5cdd0b7bef47dee1173d31b88551f8f824200930ee040000000011b61cc859cca2505e89624e42b50353a686e827a705c82cc74497e71e912d00cfa12ca8228c6b71076885c1c4c388db2e79520ddc1b10ab55b0cef06e80ca0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C99CD871-9B92-11EE-80FA-EAAD54D9E991} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70a8479f9f2fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000f6e772723225aaf854e79d19bef59abb0403bdfa2ed40d714508e3d83c6dfc25000000000e80000000020000200000002598afdb886dfdac58fb4fe129767883fdc1271062d9622452906021e738d8379000000020f4a7c4f42e17f95711e64ea12b40e53588f5ba77f609f8fd6149e3eb33e6d006e022acb3fdb3346bd86acd9dc3d1264184e3c96d9334264d5bcbcadaf51f2ebea1044ff6f271ad6f0a4635e5cc922baae9d61df6d803640ee7d80bd1f6b1c8ea0fbc35f6521f583dbb7ca251240e44f063a7efd049d4e14c1b8f0f07d8bbd9c3bf533abd24fb4672ddb6be6831a7764000000081e2331033313c5adad9250a5290632f1b9aa096d4ae70b0dec28ed87f56e698d24780ed2693d7f9e5b210259273a3f2a48945cc2e7d47e94912ca0d9136c0c7 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "408838393" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2500 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2500 iexplore.exe 2500 iexplore.exe 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2500 wrote to memory of 2640 2500 iexplore.exe IEXPLORE.EXE PID 2500 wrote to memory of 2640 2500 iexplore.exe IEXPLORE.EXE PID 2500 wrote to memory of 2640 2500 iexplore.exe IEXPLORE.EXE PID 2500 wrote to memory of 2640 2500 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://gdcobros.com/tensile/##_d2FsdGVyX2JldHpAY2x0LXVmYS5jb20=1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5407ac130004e15fa4bb72ec02672af42
SHA1a340838d3404e7cf47eb42e8e75312057f259718
SHA256096afb9d64281d38e6e454bc9694d4cc2f77871e0f4a64a8b6660d5495163376
SHA5122b6b720ef7aee6ade5c456ff6ca3c64f1ff0a5419866367dc410e2b63441327a2da34b4368402b1b80d2c9ba96f75375352deb7064bb9a460bd694cb0fa55112
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d1b15b2d781916b69d476ff8aa1cb127
SHA131d83e4a2f8af0130731e7d377b17fa66781fcb1
SHA2565fad9e8548a7e2627493ee4515a53f9e01ac2e4fd33c1d7c92c889c40dffafd2
SHA512bcfdc0feca5244ce94dad248cae248221ba67e43307bc3cc1efc4a8c426ae931655fabe9d116602fd19b25ebcbdee76bca6a989669e721da3f2c891436dfd4d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ba76b60beca2d8956e9e4e250ff263f0
SHA13d7107fc3b661a51bc3dae11e0485a57012e5841
SHA2562fc68edf0817093020fb8403ba00a3d42a847237855a2a7581c1578badd299dc
SHA512eaf9eb0bd62723ec0621acdb7592e8140a82a74f0b77957b35e64a21ea59d5c0a866daa1e22a44df8cbc5330172dd1145e516adbd122862df8b461d6f738c6d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50bd3f94cce38b924848bef0ce5c63fa2
SHA1a6e5fb44b5223d0206a8df2efa48f977a8e955ec
SHA2564e2618a042206793d40233d9dca02ea6e070db6cbae7afa5543fece90221da4e
SHA512b20f07b1656b03e326112da5ad3638d8373c7964439f880d0cadc8032c69e9ccd70d51279d7dd1a99aaf0172dfac33223388fbe4e56d495497fe30aae7fc0e5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ff1e6053e25295b749fd3ff2677aa96a
SHA13cda1794640f46df9c550893b52cd799a323eac2
SHA25638a69fc77e9e2fe27ed86ea3b4c4a68ecfbd0d6e94e336ad8358743964bcec02
SHA512faad9494cdbf8c99ff88d7ea94dabf8b376b4d1102f20ca33bde4184bdcd3b8d3ede262914f001258b8d951f4f52fcaaf3c904de5187042ae70005ab661985b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5127003bd121c8f8ef719715c11c6fc7f
SHA1ffb5e4068a3fd08cc223a4af5231205d2b038c33
SHA256c4a733c8980b55b3235ea0d270a97ab4821941e5192f58a758c951872ff3b940
SHA512de6833dde933ca2b3e6c485f50a33370f6abcc4c2ef9c41d737f56b2e285e216cbf8630d6f000a32fbc9ba7469ea9fcab9db67290be2c2263f7563f94e87d7e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58ff4d2af926768a3082aa5fc11a99ea1
SHA1ba4aca9c3eb6b0473be44fe045f66f6ffa1c456a
SHA256ae96742bae4b687322dc1ea9b3ccbcf73269fff52b4d8d4e5d4d32e867854b69
SHA51292a9ba771be49de675c89bed0fe0e77891035bae64d4df55b29f50fee6548627fd092298948d6ce4a4413f0e66222a86a614d0d13c0bdeff28a016336bb7dbde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD534a489142e0ae8a6279bf369058e883c
SHA122f447ee60fa8f7e1b6f5fc7ab4b3945ce8e5056
SHA256c0a9eeda061c306133c914a571e51f1b3c1bd9e8387d28aecf5d615ee23c99e4
SHA512a4ebb71848e719cf4c0421ee7ce5f1e5a79bdb6bb122df79e4d84691031038ced04f380481b5eb771cd63dcd89a126d827fef1c811af2f44e1f446e85b4e190d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52c4904472de6203cf45aef29f006f59f
SHA111e137ec6907ede8458c93a1b8e0e176ce76026a
SHA2561ad27191c0b46fc1f1db6fcba925d3740b1f6b483562f43744b652d16c9df8cd
SHA5128b7fa0c09d68040cd93c86f022a7e12f64bcb95eac487140d993cc9c8cd553a28910eaaf2009e5af56b177a6fb592a77d2c0ffaee316b8b176d0bb7b101f2f4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c0cca5f3a27353120fc60c0e01420345
SHA1e338dbb2a3045e347564ea57e37ea236765e3b9b
SHA25672291b939e11b7f204292faa2d34163df04353a6b21840865a2c4e3c7d5390cc
SHA5120c3917df7585101a48b204f63ad5392ddacf7f74a9525a98b3c10de9420e7302a9899d7d4a0a3f25565a2f9a1926c107bd880d2c2786057a75cfba953730d6be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD53ab1779945b296e117cfab1985a2a147
SHA190dd7e5590aaf3def90af44d1b1e2b80ceb72785
SHA256b05bf0f7e8ca0977e0e6b7f065e2ee2a9c38e9848c23e1deb859fb0c5e0a6aca
SHA5127478076e29f01f21f1d0e9bfae0c06771044eb200eb747dffc0a621dbb0c7da8103a94b1ff9f737c11bb5e7d0038f12cc40b028f143bd2183473d057f7b376c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54d6545acc3839a877a8dccf42bcbe3e3
SHA186017a80b7d937d86be05e2a3a6ecc0ee05f378e
SHA256bf385c28e1fd145a89ea995a0bd5083389293de4e93a07c3720f023217564f49
SHA5126b51b319cec3d6fdf3a10b1d29c6903e1e9f263a1979439a61e57c1cf5785df9e71ee755144e52b1d1e824c2d79e3455b0a2e5f8fe9a3e4a1552986ec60031cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD57c16c0612fa75f43a8e1917ec960b079
SHA12e08fe7ded5b97e679f5eee4b5577592dad6a55c
SHA2566553b4606979723682ad7f37beab8b37b8f522a30777cecec67dd705cea05e0d
SHA512c80e4e1b3d919a50bad7d56b2a4b4a7c081df62ba19cfe5c573b0fa8759023e4bed359601d5dccc99420d663f4f6f0a6191c7a79a1e77ff4281dc67cac04bf56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d2eb9d41f55165bf9548a283b9c4be88
SHA1eda90c7ac905b09025ab9fe6fea3826c7decfacb
SHA256b81b57859aecf4d92b81f50f8f1a441ec076ad0232661a3f0532924d8f9ee290
SHA512fd9f834cd0edf1d4e39f91d54aeb922db0b1cf86bb254021aa5d2b1ab0e831b205b2325eb944f07e6cdea9694fbaf562677d280831ea40a7ecf9f84ed485e650
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b2165d03ef841572404c733467ccc4d7
SHA1f8404655375f5bb33b9eb79ac1062a606d80a130
SHA25606b36f0ff159bf0a17f993acedd5a15eaaf3878f5022439d4baaf0979fef3f06
SHA5123a766d621bbd9b69fce8b756d48b7f075756abcff5d58dbabbe8b7b0991c1ece05edd3b5ec832d75ae2c4374b8a936c0ec57e4064408ac8e0c51869fdec0f44f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a8ea1df807af06f48afbc764181f25ad
SHA1c15eaef1f72916fc32988e3f651d4649b6a0558a
SHA256381fd7cfdab8354d0c384020bcadb337b014a7e353eb2fa50deed5a9fed8b743
SHA512a8d91f289269636bc3aec1879b2cca05ab367e3d0a1de8262d320351a72242f516cac6aae7f183835f9f83d98b0255e3111dee56323af062870cfef62f5705c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD574bf4d7fbe284db5cc239038227f1532
SHA1c66351e4bd840ee3fa1db9af944b482121ebcb35
SHA25653336464ef42337d066d6bfbe7a14940dd7d680cff7f2b9825cbc2560ff118c1
SHA512c06378496b4dbad80640bd2a422f74bd5c56438d2d13cd25965afe472c1130e253333a9313a739bb0fa304ef3a44e12f30a981256694b68d1178d93ce5ef68e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b64a39805bfa7ad457ae87266a26f54c
SHA1285beb5906ca1c70dc49b9ddfc64dcfe07df9cc2
SHA256743e12b8e83631ed7cd9aee3a5e1988141bb6c80ab45a20ad79aa29639697be6
SHA5129909f4dfce65f63d9ba889acc14b19f46e4aaeb21bf3cd882bd249b5887afe32858e2201dbad1dfb9276623da535c463c9cae1ac990bc57c10249819c5dd0191
-
C:\Users\Admin\AppData\Local\Temp\Cab6867.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar68C7.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06