Malware Analysis Report

2024-10-19 08:29

Sample ID 240125-v8yezscgfm
Target 751e3d7990742b749f1000f7cbd8283b
SHA256 c3a2218489e5095b43e56e3b28b102761a9bc5b503ff66fe69c6a99cc8b4bff9
Tags
kinsing loader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c3a2218489e5095b43e56e3b28b102761a9bc5b503ff66fe69c6a99cc8b4bff9

Threat Level: Known bad

The file 751e3d7990742b749f1000f7cbd8283b was found to be: Known bad.

Malicious Activity Summary

kinsing loader

Kinsing

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-25 17:40

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-25 17:40

Reported

2024-01-25 17:42

Platform

win7-20231215-en

Max time kernel

118s

Max time network

133s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\751e3d7990742b749f1000f7cbd8283b.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000009141953fa03004e961f4da6fb03d8f3d47f73e0466f8191a254814c213defb41000000000e8000000002000020000000fc5796ff19736f50cec9d89de239792aed6cd9c3ef59bb0407d8dbfbe98706219000000088726f170f3a3bfadcefb48ff075a25aed27965768af9f7e6023a688f5fe8b36010baa192cae1b4c4c755ad8dbd4a3d6746c6cfd5c19e1b63f1c9831e6e4950f41f7673325c966be5923ea3bd25eb21545e4addc7a373e4f81e0532b91990045bf05a35a966836da80fbeeda94823ea333c5dd858cc21cddf16a224f611c22501e42465165f6aeefc0de9fc53db222e54000000006616b956a7afab802f4637406fca25eb066ea349cf85f103c1642dc9211a665b313019dcd4f75fb6153a4c6fe40d8008b25f2c2071b2306b1a3ee864889b374 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000f466c6a921cd35f575a8207c23f1422a583693e3d3262f2c992a9c0ccefeec59000000000e80000000020000200000003702fca034582acd5b0d3e7aeb2b2ce099457ed85edff964fe717e8fe22ae9f92000000040814dd240984fb537c5ff4c07b818c279a98d708df1ccc36f445f0eb1a7acdd400000004e6f2f29dfcc2bdfd6ed837a0e7a146c3356f751c72eafc5968459de3b208a7137f394087b1e049dbb5f1de6e63c84f41309a17643ba24c17e7990b4a7670bab C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412366292" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D05ED601-BBA8-11EE-8420-EED0D7A1BF98} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302defa9b54fda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\751e3d7990742b749f1000f7cbd8283b.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 104.16.57.101:443 static.cloudflareinsights.com tcp
US 104.16.57.101:443 static.cloudflareinsights.com tcp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 142.250.187.234:443 ajax.googleapis.com tcp
GB 142.250.187.234:443 ajax.googleapis.com tcp
US 8.8.8.8:53 code.jquery.com udp
US 151.101.194.137:443 code.jquery.com tcp
US 151.101.194.137:443 code.jquery.com tcp
US 8.8.8.8:53 maxcdn.bootstrapcdn.com udp
US 104.18.10.207:443 maxcdn.bootstrapcdn.com tcp
US 104.18.10.207:443 maxcdn.bootstrapcdn.com tcp
US 8.8.8.8:53 kit.fontawesome.com udp
US 104.18.40.68:443 kit.fontawesome.com tcp
US 104.18.40.68:443 kit.fontawesome.com tcp
US 104.18.40.68:443 kit.fontawesome.com tcp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab59D5.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar5A55.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3de56daa531d8e47432b6ff3bab82f33
SHA1 44f9267708d519197961999c3d2002b915273aad
SHA256 dd5b6e88f33121e8bf50608e6bef914fb25406303279cc6b211d018f19b38fc3
SHA512 7cdc8123406dc3dc51b79c6afb471e8af0b73574075e11a9323c1cf430dd290bc621ad007dfd42775909c168be5bc7a81d06d1f581d77a6e0c08972dc7ea0c11

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 85d13a68932462ad6bc28d66e234ccfe
SHA1 16c39b8e367bca5c356d32d82939d3000b05fc7c
SHA256 a8f4255e03f29a3b52832679970b9c5d1ca0025c601a980ff640bd7a2becdc9a
SHA512 716f0521b2c6a0c7d09e2527f3c1c3d33800d8ab2a149c1c304d3b4a9dbf1ba2d9e6d9bafc45218338c75457a261722379f3853f0dfabd4a9c004b6c15e0078c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 57a4ec7431a340a765e7a892e8348915
SHA1 e5a25f22baaf9c418533f5a61c7955317cd23ea3
SHA256 e76bb43aa2c6afef865df0d2620219db34e5173d1090f8e6b27ef0b5aed9af9f
SHA512 ebea5c6239e71e237dbae9ec4a3ca8bc973bc5dd9853693f25412953639fe00db6062b396421f43ba6d379147f5accca1c735e1228277330e8242acfa6815447

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 972b0ce0da394741c0b86aceb841d66e
SHA1 b06fa221705577dc24bd49bec1910da8d0ef5762
SHA256 3a0ded938b47ba9655783fa7ce123d279064dbb3ff4134326c921d7c61328343
SHA512 d84b4d78ddee4b6f9bb257a8c52fbce7d4d197cb7b9195d7f8dcbe12b038bddc212aeb0cd82c1db37f00e36c00b1a1a0e2d990e4612df9b0752c6f575edba809

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9VC31Q9\jquery.min[1].js

MD5 2f6b11a7e914718e0290410e85366fe9
SHA1 69bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA256 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA512 0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0I6KXNQ\jquery-3.1.1.min[1].js

MD5 e071abda8fe61194711cfc2ab99fe104
SHA1 f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA256 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA512 53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0e887b07007737898b8095c03992d09a
SHA1 3c9a8d062268129e67ab6c96a2a9e597a5a11c42
SHA256 32c83f3c4af671e159ac46c4eedee930fa678dcbaed7ee038c0c2710e6d38bbf
SHA512 2290c7131ab042597fefe6c0c6c1ab05ef833dda4807b7ec4b06244aefbdf3c854275baf3bc6c1c6923d498d4812f1db69de86ff8a03e4e2469dab283c9ccced

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 325b37242b63e6f95d63fc2c3c717ee7
SHA1 f6abb4c084ba4beef03d2ae42e85fe98c14dbc9b
SHA256 b782303a77e916d96af50334828ed28fceff181b50d8d094902fe63ba827ac4a
SHA512 b1cdddad8a662c2eacbe39ae917967b543c2aca92a946f723aef34abb4ef2432e21a263bcf5d2a812ff3ca0c0c4c57ed2d02023d5be4189731e8a3a5bf8b487f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e527e07311accf56aad21f6a6124b9be
SHA1 99b599d9582ebc1ae3fd282b0896cd81db58a612
SHA256 0bcce558e58e42eb68b77c35906ffb6d6d6000cbd056a4692c01a1609f2c71d8
SHA512 de3d0624a0f414cf75a4c71295929de5d13fe6a18f38b362d2a90685fe527bc191853870d05670e01aae1b4f185f7ae29601a5405acc37679f3642c0bd6a5bed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 81cfad81520434825e9c9356aad6a9a3
SHA1 1a293da0e701a8cee197442404ef36ef00186c37
SHA256 c4d9d3b8d30765b04734e80c92c1c89cafd45f91fbb51f6079b4418b7372471d
SHA512 decffad0690259aef6c4e9b177fe7922235319b85f1b20d58df47c7c81e08478b8b27a71ff4f66dc75ae64cbfd6186c16516c59dfcf235a0c44e41d0eb073e1a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6cbe86c663a220d8419a99589c4edacb
SHA1 da9d862fca032f2d3db56fcae71f08b36542d0a6
SHA256 cbbdb92abb47a5cc7438be775d3ea19a8c1ad9d8668ea21525dde7ffb6b5dc78
SHA512 23a1674ad47a55666307fda951cddd7ef13b8f05c9186ca6ec6b1157618cc0bb06663f91507cfea3e66141d8bdde962701bfb7426b61d57801bd38dabca1bc6e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6ba5aa0239b896ed96f642b5394f7d5f
SHA1 8396b60df8236224e26fc59356b606dc8c92dcc0
SHA256 5b00a1e22043dbc09b64316a17c0f071598976504e297990cfa866d05cdcede4
SHA512 4aac547e7f8692b6530334db806ccea0098f08971014c546f478bdd61997e08969c7b6d99dc95caf6c089c05d167bf99397950f3d5082eb5119b3cf19614e94c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 70c8ad15860feebd28d6b40778d0627c
SHA1 9eaa04ee6acdcad32a331038a2885b468012247f
SHA256 047556ab6ec134ecb44e10a7410ab0fea5b2e4e79f4c2967bc17565a284233a1
SHA512 a600e90a758f3c93d4ea925ad8e02fd0ebda38f0e8d68b60a2d8fb78d1ed6c7df5442e48e6b7528d5481cf98ca8ffc13c3a1d29dae9f54812a5d6d761d052f1a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 712ee854c9f74f75e6f4c3d313d3234f
SHA1 fa75df20225b559004436c7824f8e53ef962b715
SHA256 17280a6bbb9e68888369c7b36b102301f0b77bcfd57de8e21edfc89a8199d7c1
SHA512 5e0c0f320f773c3f4497cbfb1f45205c41bd34ea311092e8ee01f4c32b9c1c5fc50db54a3d8893f67b2327b2bc47128b128dcaf10ef2c17ab95196b3a257a561

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\beacon.min[1].js

MD5 dd1d068fdb5fe90b6c05a5b3940e088c
SHA1 0d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA256 6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA512 7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 43250a92823bb3b0063796d18efdda35
SHA1 5c9f05096fb31b0ff1f510173dcfb2add9903659
SHA256 1cfcddbd191163aa9258ad951413b5fcfd8a335c70c34bb6054e83eb4e415c64
SHA512 f7ac8bbfff767c14e91c3ded816651aef706f570e6e23e57c057087a5807e727f84d2fd28d6351d1b76c77650bf0084330c0fdc383040aa4ae784b449c7479df

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6f55cc245fb18b3e573a50df4f843337
SHA1 0fa50ce4ba67d883e237ea3bf3666141acf72c36
SHA256 a58dd57c40f1301cf2e60453dacc0628cfbfadded4dd2d618703e28d5cebc321
SHA512 dba2e765ba95c56a8db02aad52f3a4717c78ca910785d31f96282688b180f704fdfb3fe1bb2300cc5fc2a1069e41d92a4bff45aadb1d7c8d75ad776e441e3cb1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fde064e26826a68fd52165952f1bc5a0
SHA1 7824b8132d4e652535678abce5eb28930ffd6408
SHA256 e772cd7e634138c744253e3fb0491c978fcaa418f41bf85f136e576c61f61d25
SHA512 1b4c791bc5ee9622a76d741adb136f3ade22ca1806f9dc204a1f191e0f9ff6a175148536e7ee2b60d152ad8fb67f3079a4479ec0f546b310ff55fe96b6fa40b9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d175851c91a33402cb9621e0d9d0f63c
SHA1 1acd219645adc5bb62b74160bda884c18c8aeed5
SHA256 9bf32cb0c5cdcd093c4545bb8d4551cd2e50193d97392b6912062fec63ecfd29
SHA512 a036cc4e666bf832b0e4f29b1e80d261591010f63cb2fc85c611a5addd38a548a40d41686748a17d4dd5ea29a9f30bf4a6763b396dce557b51f1bb1974be65ac

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 21f3cd97a1c4f8c4926fb6d0722de024
SHA1 ffcaf67fe2a93d1feae53090eff6352c747388db
SHA256 b52dd33660cbe575b9838d3a990735314d521b21e5ab98e1c6c39093ee688f8d
SHA512 0241b0e445dd364635832e4ae5f80e46b3d4cc5651db23d483788f14fd05d41ec8275ccf1798503d404a2bcbce8f69ade8b25d448e60dc3caa7649b75a0fa8c0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f30f0019197256727b89280f704e3f15
SHA1 13a1021dfa87148117cf863345df1992c9136d63
SHA256 fb4810423702ce3f3673b0a0a2bbce68cb85e1f4b2affa225ee858dae9ce085c
SHA512 4ef460e8814239b92ec79fb5dd4a8efcddd30ed8f7611cf970955315a6fd0ac50388bd85ac0356f0c6b58a45bb4866f13f7ab9519839f084ca77614d45e3624b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 360dcbf26b676f970cd1463e694c3d87
SHA1 78cf12525216d104d175f11239f571218461e698
SHA256 a227773e94dbf2ff547a321c12f10bc682c1811cc2ecf33af64c77413aa34d7e
SHA512 0e131b010884df97ab6f72db66e2dc6157c4380acd105df5e9c010b1cb7e02cca04c720926112e0288b1e0b59b65b3de8423195faa962c9b5d24061ec7f9a67f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 343d3169d4d4872d840403c9b6dc61f2
SHA1 43e8f0da9b4bb760882ec3df756ff9dd15bb2974
SHA256 ddff5739e524f787c9aadf1391f68f756ba13ad4e710e00f055681cdf78f343d
SHA512 875f0e30477db5a7e63abf36195d46d694ad053476f050b0bfa7a694ac52dbd3f740c0831611cc23e72f92a85320566916771bda7f18e16e907e4bb61d603aef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7d216da375f8a77f5584554fab4ea03f
SHA1 a5948bec477baf99728857217cf94fc9db420221
SHA256 5cc03b9f3e8173b245fb06ccc1fcfa68abfb482c8e2dd489b693758f943f408c
SHA512 56b5228e7717ce5254ae0e1a3bacf73d413e76ff4349911096e4e78e3bef2afbc2c98e9df35bd0b9cfc3c372de60c144c154cc5b72e578138c634cdf9fa944fa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a903052348f17b35dbf012ada803e6d2
SHA1 07df7c053df6b41f9a3f5cb99cd6a6185bb1dd03
SHA256 b34df33d0c1a9229372bbb981918618fbfe140f15a72b91fabef5d5d76398e57
SHA512 e9bbeeeefcddf40cb97ac7048e8a28c8111c3bdda1af21440118a071a621556a3704600884c617037a455591dc47b98f869f31727badb01d23769bbcc112184f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ff8697890443ed4d97fb664c3bf245f0
SHA1 b24e2a2bad3a15e499fdad9889ed7fe5e627b791
SHA256 0ff34ec5be6b48a8c43b78afc7b8d04a6a6f7c152fa1293a0b5b8bbad13e1e0e
SHA512 3789f3b7744deb91385cf92462cd6990547cd37dbfc6f6724ccc70607a2531a4ccfb553c56e7381f86906f2c411254b89c24a0090335cc2e47dec5777fbda40b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1083ec0889de486d31e8dac4e7ea1ec3
SHA1 13f1b98e5f2e46ae3d16f01b2707af7c6b550613
SHA256 e3fb6a20bb610daac6cda084356e4e6d60336400cb86fdfd9f66648718adf9ca
SHA512 dea04b7533d6b43e0900f2c595a8dc76eeab2b1a2511bcf134ae5f0a3d128344d7fd4160eddab6ee7b5f756ffee030a67f00a70b12bf9c1dcb240750cfcb19f7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 071a952eb013fac41dc3f1e67921d5c7
SHA1 b03de371ea9c944500618cb06d475f9a3b32a312
SHA256 4bda1bd68227d71d567e0d4f0ba2f382433a1d50d7acf212f69c021d2c1292a9
SHA512 941d63e883fd68925614ee5b0027fb13678f49c25ea06fbe5abd810c4ac3bb7e3f62adddd952ee3b1cb5f6b69018cd02e285a468cd44c2fe9a1b705fbf107957

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bf0dd9f76153e97e31b2923909dd1bf5
SHA1 286d12c3566f26393ee759b316d9554f91841230
SHA256 7732481a89a2052c0682b3ab8f9df5719f12dbd3fa1d0c51a30e87177ba20d7b
SHA512 cdb7b393af04f19ea7f87c791d492df5d52f119367358c09cdbf705b0af0bf7d7a78340d70eac43b9cd6d56ff3be83e583aa514b0e6c705dac5072e5419c02cc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a9e9e83a669760ccb46888d2ec03cb12
SHA1 52ad934b57652da237b6a1bb16faddb201e5e371
SHA256 189318796bd13105171b77765d6269e47423fadd1688c2e2281e823ab92e313c
SHA512 7cca938ad86bf2c09142c8af36b7a741b35f0dbe0840467683dcfc701533b791176f85206ac086614623b836d3f01817cb8584021c09578b6708b93c6a616a4c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dedcbc74b3489f60f5cd307e7e75e861
SHA1 4fbc938c659db53d9f4970f97810a1e59f6cb875
SHA256 d0ddfe1c8aba6966927f9f4c99d00f5fbf39f3241fdf5cb6d812a04fa3ba032c
SHA512 a1f94505e20c1006161f145ea1548ca665c591f48ad4ba445e8145675a2349fa2d9462da4e8a25c15f4bcfc3637cf69bf93260b1e78df3ff7fc7948ae220269e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f66c3b312dc6fe54d7641878fe7d68e4
SHA1 dfbadb47f033813dc057d4fde62b9cb229c10a58
SHA256 7960e8c67d4c98eba21ad8ae9903122b13599c291851a7d32e2666ae1f4b035a
SHA512 0f846dd0c549a70dbdf798f399551c56376249ca80449f15543e03544c5de11842f0e93b93c043edd2199e622327ff632abfd2020b1ecd139538462fcde18e5f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4619eac80eeedbe3754a2c929d35384c
SHA1 b2644303ba3d3abf1459b4f8ca98dd7e3533a0cd
SHA256 c1c4d2d665cb1073a69598db44a38ffeedefe7aa7950e6efddd6d6096048967b
SHA512 ca7a4f3433e6dc5aa6d9ed60b131d0023c157c5187b3187caeeb6ea2d31b1baf74d87337bb9ac6b29001fae73d196ed0e7800a4e46e87bdb51535d4287d571e8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dee8feba13137afa85fe9cfec6a6156a
SHA1 f7936d6d17eb3636762b5ff4e8d8432a525c8a3c
SHA256 6a2a77b9c009a9c8d3bcd3dd88ea761923015f494d575550d99403c34e972f5d
SHA512 8419fb95d328f892060e724f3371572ba17a9c233065f85aa6919a82d26e7188172ce9e7d86035b8c2dc3c57ed1e7d73e334b82efea983efd62a86350dfbb819

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ab9f61b4be53232babd14e100454156f
SHA1 fba15cc685f15a736acb8c55713f8c05d8177eb3
SHA256 41b627667d49a477e8e87b869e9a3cccd2724f338351f76b881b9a2254f4202e
SHA512 cbc22ca957f9d5f58c5eb785080c38e280dea11b3fd2580f787a25c1f9d16957567fe148d0e30cf6b34cc2ace8b93dd470024da4c642d4d7ef80c785fa4e7806

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 7c270f5d172e6d5656a4063bf0a5aedd
SHA1 16a42a513b763c21bed20af02cb9cc74010c5266
SHA256 2f96b2f0fa583c7b0ac2200b3ac60d55038d56884340619a70fd5cc8935f5ef7
SHA512 ddb0d61409ab11658a1c4d895d1cac14a98c4283394ce54bd7ee06242a31ec146f941522bf706f73012a4e33d6f0d71345c4ba43678cb264abbe031f1a550814

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-25 17:40

Reported

2024-01-25 17:42

Platform

win10v2004-20231222-en

Max time kernel

88s

Max time network

142s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\751e3d7990742b749f1000f7cbd8283b.html

Signatures

Kinsing

loader kinsing

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084469" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015a2f750fe9ee1479ecf0c8cfb11934c000000000200000000001066000000010000200000002b0110dba006b5e404155593aac1b38db8b3d8f20b533253c17bc06f83f30f1b000000000e80000000020000200000007fcfeb7ac75e98bb2d9313b07fa4f304eea86e8e36f27e2514005d7b1558ee1f20000000abf5ebd940575f9cb31af272a360eec7804418481e8a85c37cb4bbd3e7912ce7400000006caea015e006471ecc13afeecfa55c41a484f126b0575e8ee6227a242fe10b88ebbc61ef872a78b5afd50454dd9b7533cb23bae5a7bc4dcbb49ad9316b9eb4c6 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CF57BC75-BBA8-11EE-A0B6-DAD4CCDE76B8} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504079a6b54fda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2747654460" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412969395" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\IESettingSync C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2747654460" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015a2f750fe9ee1479ecf0c8cfb11934c000000000200000000001066000000010000200000006c2d8c53822f5215b07045640c0ecbd1236ce909aa17776020035562ecfc41d7000000000e800000000200002000000028f57c4d1edc022862e78662c8e85fde1c2134f9ca8b79a8c07014d865f701cc20000000444ce801921f87b9e8dd362457f5af2b7722d0ce3b7b5e79fa70154b06a07bb940000000d0c54ec5cf1886e1b7200b2f6db0a1e88050517e1c41949cf2eb2e8188709417d183c01505d19ed1770cdacece060d97cfecb2d9f5e9f0aadd06223a9a8a253c C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084469" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31084469" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2750935621" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 408a7ba6b54fda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\751e3d7990742b749f1000f7cbd8283b.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3160 CREDAT:17410 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 104.16.57.101:443 static.cloudflareinsights.com tcp
US 104.16.57.101:443 static.cloudflareinsights.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 216.58.201.106:443 ajax.googleapis.com tcp
GB 216.58.201.106:443 ajax.googleapis.com tcp
US 8.8.8.8:53 code.jquery.com udp
US 151.101.66.137:443 code.jquery.com tcp
US 151.101.66.137:443 code.jquery.com tcp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 101.57.16.104.in-addr.arpa udp
US 8.8.8.8:53 106.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 137.66.101.151.in-addr.arpa udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 8.8.8.8:53 maxcdn.bootstrapcdn.com udp
US 104.18.11.207:443 maxcdn.bootstrapcdn.com tcp
US 104.18.11.207:443 maxcdn.bootstrapcdn.com tcp
US 8.8.8.8:53 207.11.18.104.in-addr.arpa udp
US 8.8.8.8:53 kit.fontawesome.com udp
US 104.18.40.68:443 kit.fontawesome.com tcp
US 104.18.40.68:443 kit.fontawesome.com tcp
US 8.8.8.8:53 ka-f.fontawesome.com udp
US 172.64.205.20:443 ka-f.fontawesome.com tcp
US 172.64.205.20:443 ka-f.fontawesome.com tcp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 68.40.18.104.in-addr.arpa udp
US 8.8.8.8:53 20.205.64.172.in-addr.arpa udp
US 8.8.8.8:53 14.24.17.104.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 114.134.221.88.in-addr.arpa udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R977VUU4\jquery.min[1].js

MD5 2f6b11a7e914718e0290410e85366fe9
SHA1 69bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA256 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA512 0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSO8CY24\jquery-3.1.1.min[1].js

MD5 e071abda8fe61194711cfc2ab99fe104
SHA1 f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA256 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA512 53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NSWVVUXL\beacon.min[1].js

MD5 dd1d068fdb5fe90b6c05a5b3940e088c
SHA1 0d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA256 6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA512 7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5 1d7f25dc2d6699e79619c31ff8908f6c
SHA1 de3c1be6c3f3e7f6eadbe715ae575794e5bf1221
SHA256 845c8a47772a9c534cf13a177c83c40db250a6dbbd0a369401ea884b8d058d6e
SHA512 7a6e1765a31821e79b766ea0675ed17d735a40766d5fcd6cc305a8d33b8257d11e492d4ad8626f2909e1c2c2d93e8d04ed133effd0a3ec29324ec3ca36a22a1e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5 6ecda5aa33a9ede99c17ff859e61d997
SHA1 46ad9eecd07c63b1bbcae3de6b2011dd055b9f45
SHA256 617444666355992da31ee908c0f2a6c58c4055ee4629675df804313c9e964aba
SHA512 117595bae340d5c37ebe3f3788d861fb497da07fff30cb2fa15f241e55d3edc4222ec8626b85cdba8c721906c332806f0904c544dd94b8095b975d621c5a2a1a

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSO8CY24\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee