Analysis Overview
SHA256
c3a2218489e5095b43e56e3b28b102761a9bc5b503ff66fe69c6a99cc8b4bff9
Threat Level: Known bad
The file 751e3d7990742b749f1000f7cbd8283b was found to be: Known bad.
Malicious Activity Summary
Kinsing
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-01-25 17:40
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-01-25 17:40
Reported
2024-01-25 17:42
Platform
win7-20231215-en
Max time kernel
118s
Max time network
133s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000009141953fa03004e961f4da6fb03d8f3d47f73e0466f8191a254814c213defb41000000000e8000000002000020000000fc5796ff19736f50cec9d89de239792aed6cd9c3ef59bb0407d8dbfbe98706219000000088726f170f3a3bfadcefb48ff075a25aed27965768af9f7e6023a688f5fe8b36010baa192cae1b4c4c755ad8dbd4a3d6746c6cfd5c19e1b63f1c9831e6e4950f41f7673325c966be5923ea3bd25eb21545e4addc7a373e4f81e0532b91990045bf05a35a966836da80fbeeda94823ea333c5dd858cc21cddf16a224f611c22501e42465165f6aeefc0de9fc53db222e54000000006616b956a7afab802f4637406fca25eb066ea349cf85f103c1642dc9211a665b313019dcd4f75fb6153a4c6fe40d8008b25f2c2071b2306b1a3ee864889b374 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000f466c6a921cd35f575a8207c23f1422a583693e3d3262f2c992a9c0ccefeec59000000000e80000000020000200000003702fca034582acd5b0d3e7aeb2b2ce099457ed85edff964fe717e8fe22ae9f92000000040814dd240984fb537c5ff4c07b818c279a98d708df1ccc36f445f0eb1a7acdd400000004e6f2f29dfcc2bdfd6ed837a0e7a146c3356f751c72eafc5968459de3b208a7137f394087b1e049dbb5f1de6e63c84f41309a17643ba24c17e7990b4a7670bab | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412366292" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D05ED601-BBA8-11EE-8420-EED0D7A1BF98} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302defa9b54fda01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2156 wrote to memory of 2716 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2156 wrote to memory of 2716 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2156 wrote to memory of 2716 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2156 wrote to memory of 2716 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\751e3d7990742b749f1000f7cbd8283b.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | static.cloudflareinsights.com | udp |
| US | 104.16.57.101:443 | static.cloudflareinsights.com | tcp |
| US | 104.16.57.101:443 | static.cloudflareinsights.com | tcp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| GB | 142.250.187.234:443 | ajax.googleapis.com | tcp |
| GB | 142.250.187.234:443 | ajax.googleapis.com | tcp |
| US | 8.8.8.8:53 | code.jquery.com | udp |
| US | 151.101.194.137:443 | code.jquery.com | tcp |
| US | 151.101.194.137:443 | code.jquery.com | tcp |
| US | 8.8.8.8:53 | maxcdn.bootstrapcdn.com | udp |
| US | 104.18.10.207:443 | maxcdn.bootstrapcdn.com | tcp |
| US | 104.18.10.207:443 | maxcdn.bootstrapcdn.com | tcp |
| US | 8.8.8.8:53 | kit.fontawesome.com | udp |
| US | 104.18.40.68:443 | kit.fontawesome.com | tcp |
| US | 104.18.40.68:443 | kit.fontawesome.com | tcp |
| US | 104.18.40.68:443 | kit.fontawesome.com | tcp |
| US | 8.8.8.8:53 | cdnjs.cloudflare.com | udp |
| US | 104.17.25.14:443 | cdnjs.cloudflare.com | tcp |
| US | 104.17.25.14:443 | cdnjs.cloudflare.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Cab59D5.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\Local\Temp\Tar5A55.tmp
| MD5 | 9c0c641c06238516f27941aa1166d427 |
| SHA1 | 64cd549fb8cf014fcd9312aa7a5b023847b6c977 |
| SHA256 | 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f |
| SHA512 | 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3de56daa531d8e47432b6ff3bab82f33 |
| SHA1 | 44f9267708d519197961999c3d2002b915273aad |
| SHA256 | dd5b6e88f33121e8bf50608e6bef914fb25406303279cc6b211d018f19b38fc3 |
| SHA512 | 7cdc8123406dc3dc51b79c6afb471e8af0b73574075e11a9323c1cf430dd290bc621ad007dfd42775909c168be5bc7a81d06d1f581d77a6e0c08972dc7ea0c11 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 85d13a68932462ad6bc28d66e234ccfe |
| SHA1 | 16c39b8e367bca5c356d32d82939d3000b05fc7c |
| SHA256 | a8f4255e03f29a3b52832679970b9c5d1ca0025c601a980ff640bd7a2becdc9a |
| SHA512 | 716f0521b2c6a0c7d09e2527f3c1c3d33800d8ab2a149c1c304d3b4a9dbf1ba2d9e6d9bafc45218338c75457a261722379f3853f0dfabd4a9c004b6c15e0078c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 57a4ec7431a340a765e7a892e8348915 |
| SHA1 | e5a25f22baaf9c418533f5a61c7955317cd23ea3 |
| SHA256 | e76bb43aa2c6afef865df0d2620219db34e5173d1090f8e6b27ef0b5aed9af9f |
| SHA512 | ebea5c6239e71e237dbae9ec4a3ca8bc973bc5dd9853693f25412953639fe00db6062b396421f43ba6d379147f5accca1c735e1228277330e8242acfa6815447 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 972b0ce0da394741c0b86aceb841d66e |
| SHA1 | b06fa221705577dc24bd49bec1910da8d0ef5762 |
| SHA256 | 3a0ded938b47ba9655783fa7ce123d279064dbb3ff4134326c921d7c61328343 |
| SHA512 | d84b4d78ddee4b6f9bb257a8c52fbce7d4d197cb7b9195d7f8dcbe12b038bddc212aeb0cd82c1db37f00e36c00b1a1a0e2d990e4612df9b0752c6f575edba809 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9VC31Q9\jquery.min[1].js
| MD5 | 2f6b11a7e914718e0290410e85366fe9 |
| SHA1 | 69bb69e25ca7d5ef0935317584e6153f3fd9a88c |
| SHA256 | 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e |
| SHA512 | 0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0I6KXNQ\jquery-3.1.1.min[1].js
| MD5 | e071abda8fe61194711cfc2ab99fe104 |
| SHA1 | f647a6d37dc4ca055ced3cf64bbc1f490070acba |
| SHA256 | 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf |
| SHA512 | 53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0e887b07007737898b8095c03992d09a |
| SHA1 | 3c9a8d062268129e67ab6c96a2a9e597a5a11c42 |
| SHA256 | 32c83f3c4af671e159ac46c4eedee930fa678dcbaed7ee038c0c2710e6d38bbf |
| SHA512 | 2290c7131ab042597fefe6c0c6c1ab05ef833dda4807b7ec4b06244aefbdf3c854275baf3bc6c1c6923d498d4812f1db69de86ff8a03e4e2469dab283c9ccced |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 325b37242b63e6f95d63fc2c3c717ee7 |
| SHA1 | f6abb4c084ba4beef03d2ae42e85fe98c14dbc9b |
| SHA256 | b782303a77e916d96af50334828ed28fceff181b50d8d094902fe63ba827ac4a |
| SHA512 | b1cdddad8a662c2eacbe39ae917967b543c2aca92a946f723aef34abb4ef2432e21a263bcf5d2a812ff3ca0c0c4c57ed2d02023d5be4189731e8a3a5bf8b487f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e527e07311accf56aad21f6a6124b9be |
| SHA1 | 99b599d9582ebc1ae3fd282b0896cd81db58a612 |
| SHA256 | 0bcce558e58e42eb68b77c35906ffb6d6d6000cbd056a4692c01a1609f2c71d8 |
| SHA512 | de3d0624a0f414cf75a4c71295929de5d13fe6a18f38b362d2a90685fe527bc191853870d05670e01aae1b4f185f7ae29601a5405acc37679f3642c0bd6a5bed |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 81cfad81520434825e9c9356aad6a9a3 |
| SHA1 | 1a293da0e701a8cee197442404ef36ef00186c37 |
| SHA256 | c4d9d3b8d30765b04734e80c92c1c89cafd45f91fbb51f6079b4418b7372471d |
| SHA512 | decffad0690259aef6c4e9b177fe7922235319b85f1b20d58df47c7c81e08478b8b27a71ff4f66dc75ae64cbfd6186c16516c59dfcf235a0c44e41d0eb073e1a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6cbe86c663a220d8419a99589c4edacb |
| SHA1 | da9d862fca032f2d3db56fcae71f08b36542d0a6 |
| SHA256 | cbbdb92abb47a5cc7438be775d3ea19a8c1ad9d8668ea21525dde7ffb6b5dc78 |
| SHA512 | 23a1674ad47a55666307fda951cddd7ef13b8f05c9186ca6ec6b1157618cc0bb06663f91507cfea3e66141d8bdde962701bfb7426b61d57801bd38dabca1bc6e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6ba5aa0239b896ed96f642b5394f7d5f |
| SHA1 | 8396b60df8236224e26fc59356b606dc8c92dcc0 |
| SHA256 | 5b00a1e22043dbc09b64316a17c0f071598976504e297990cfa866d05cdcede4 |
| SHA512 | 4aac547e7f8692b6530334db806ccea0098f08971014c546f478bdd61997e08969c7b6d99dc95caf6c089c05d167bf99397950f3d5082eb5119b3cf19614e94c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 70c8ad15860feebd28d6b40778d0627c |
| SHA1 | 9eaa04ee6acdcad32a331038a2885b468012247f |
| SHA256 | 047556ab6ec134ecb44e10a7410ab0fea5b2e4e79f4c2967bc17565a284233a1 |
| SHA512 | a600e90a758f3c93d4ea925ad8e02fd0ebda38f0e8d68b60a2d8fb78d1ed6c7df5442e48e6b7528d5481cf98ca8ffc13c3a1d29dae9f54812a5d6d761d052f1a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 712ee854c9f74f75e6f4c3d313d3234f |
| SHA1 | fa75df20225b559004436c7824f8e53ef962b715 |
| SHA256 | 17280a6bbb9e68888369c7b36b102301f0b77bcfd57de8e21edfc89a8199d7c1 |
| SHA512 | 5e0c0f320f773c3f4497cbfb1f45205c41bd34ea311092e8ee01f4c32b9c1c5fc50db54a3d8893f67b2327b2bc47128b128dcaf10ef2c17ab95196b3a257a561 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\beacon.min[1].js
| MD5 | dd1d068fdb5fe90b6c05a5b3940e088c |
| SHA1 | 0d96f9df8772633a9df4c81cf323a4ef8998ba59 |
| SHA256 | 6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101 |
| SHA512 | 7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 43250a92823bb3b0063796d18efdda35 |
| SHA1 | 5c9f05096fb31b0ff1f510173dcfb2add9903659 |
| SHA256 | 1cfcddbd191163aa9258ad951413b5fcfd8a335c70c34bb6054e83eb4e415c64 |
| SHA512 | f7ac8bbfff767c14e91c3ded816651aef706f570e6e23e57c057087a5807e727f84d2fd28d6351d1b76c77650bf0084330c0fdc383040aa4ae784b449c7479df |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6f55cc245fb18b3e573a50df4f843337 |
| SHA1 | 0fa50ce4ba67d883e237ea3bf3666141acf72c36 |
| SHA256 | a58dd57c40f1301cf2e60453dacc0628cfbfadded4dd2d618703e28d5cebc321 |
| SHA512 | dba2e765ba95c56a8db02aad52f3a4717c78ca910785d31f96282688b180f704fdfb3fe1bb2300cc5fc2a1069e41d92a4bff45aadb1d7c8d75ad776e441e3cb1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fde064e26826a68fd52165952f1bc5a0 |
| SHA1 | 7824b8132d4e652535678abce5eb28930ffd6408 |
| SHA256 | e772cd7e634138c744253e3fb0491c978fcaa418f41bf85f136e576c61f61d25 |
| SHA512 | 1b4c791bc5ee9622a76d741adb136f3ade22ca1806f9dc204a1f191e0f9ff6a175148536e7ee2b60d152ad8fb67f3079a4479ec0f546b310ff55fe96b6fa40b9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d175851c91a33402cb9621e0d9d0f63c |
| SHA1 | 1acd219645adc5bb62b74160bda884c18c8aeed5 |
| SHA256 | 9bf32cb0c5cdcd093c4545bb8d4551cd2e50193d97392b6912062fec63ecfd29 |
| SHA512 | a036cc4e666bf832b0e4f29b1e80d261591010f63cb2fc85c611a5addd38a548a40d41686748a17d4dd5ea29a9f30bf4a6763b396dce557b51f1bb1974be65ac |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 21f3cd97a1c4f8c4926fb6d0722de024 |
| SHA1 | ffcaf67fe2a93d1feae53090eff6352c747388db |
| SHA256 | b52dd33660cbe575b9838d3a990735314d521b21e5ab98e1c6c39093ee688f8d |
| SHA512 | 0241b0e445dd364635832e4ae5f80e46b3d4cc5651db23d483788f14fd05d41ec8275ccf1798503d404a2bcbce8f69ade8b25d448e60dc3caa7649b75a0fa8c0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f30f0019197256727b89280f704e3f15 |
| SHA1 | 13a1021dfa87148117cf863345df1992c9136d63 |
| SHA256 | fb4810423702ce3f3673b0a0a2bbce68cb85e1f4b2affa225ee858dae9ce085c |
| SHA512 | 4ef460e8814239b92ec79fb5dd4a8efcddd30ed8f7611cf970955315a6fd0ac50388bd85ac0356f0c6b58a45bb4866f13f7ab9519839f084ca77614d45e3624b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 360dcbf26b676f970cd1463e694c3d87 |
| SHA1 | 78cf12525216d104d175f11239f571218461e698 |
| SHA256 | a227773e94dbf2ff547a321c12f10bc682c1811cc2ecf33af64c77413aa34d7e |
| SHA512 | 0e131b010884df97ab6f72db66e2dc6157c4380acd105df5e9c010b1cb7e02cca04c720926112e0288b1e0b59b65b3de8423195faa962c9b5d24061ec7f9a67f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 343d3169d4d4872d840403c9b6dc61f2 |
| SHA1 | 43e8f0da9b4bb760882ec3df756ff9dd15bb2974 |
| SHA256 | ddff5739e524f787c9aadf1391f68f756ba13ad4e710e00f055681cdf78f343d |
| SHA512 | 875f0e30477db5a7e63abf36195d46d694ad053476f050b0bfa7a694ac52dbd3f740c0831611cc23e72f92a85320566916771bda7f18e16e907e4bb61d603aef |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7d216da375f8a77f5584554fab4ea03f |
| SHA1 | a5948bec477baf99728857217cf94fc9db420221 |
| SHA256 | 5cc03b9f3e8173b245fb06ccc1fcfa68abfb482c8e2dd489b693758f943f408c |
| SHA512 | 56b5228e7717ce5254ae0e1a3bacf73d413e76ff4349911096e4e78e3bef2afbc2c98e9df35bd0b9cfc3c372de60c144c154cc5b72e578138c634cdf9fa944fa |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a903052348f17b35dbf012ada803e6d2 |
| SHA1 | 07df7c053df6b41f9a3f5cb99cd6a6185bb1dd03 |
| SHA256 | b34df33d0c1a9229372bbb981918618fbfe140f15a72b91fabef5d5d76398e57 |
| SHA512 | e9bbeeeefcddf40cb97ac7048e8a28c8111c3bdda1af21440118a071a621556a3704600884c617037a455591dc47b98f869f31727badb01d23769bbcc112184f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ff8697890443ed4d97fb664c3bf245f0 |
| SHA1 | b24e2a2bad3a15e499fdad9889ed7fe5e627b791 |
| SHA256 | 0ff34ec5be6b48a8c43b78afc7b8d04a6a6f7c152fa1293a0b5b8bbad13e1e0e |
| SHA512 | 3789f3b7744deb91385cf92462cd6990547cd37dbfc6f6724ccc70607a2531a4ccfb553c56e7381f86906f2c411254b89c24a0090335cc2e47dec5777fbda40b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1083ec0889de486d31e8dac4e7ea1ec3 |
| SHA1 | 13f1b98e5f2e46ae3d16f01b2707af7c6b550613 |
| SHA256 | e3fb6a20bb610daac6cda084356e4e6d60336400cb86fdfd9f66648718adf9ca |
| SHA512 | dea04b7533d6b43e0900f2c595a8dc76eeab2b1a2511bcf134ae5f0a3d128344d7fd4160eddab6ee7b5f756ffee030a67f00a70b12bf9c1dcb240750cfcb19f7 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | 071a952eb013fac41dc3f1e67921d5c7 |
| SHA1 | b03de371ea9c944500618cb06d475f9a3b32a312 |
| SHA256 | 4bda1bd68227d71d567e0d4f0ba2f382433a1d50d7acf212f69c021d2c1292a9 |
| SHA512 | 941d63e883fd68925614ee5b0027fb13678f49c25ea06fbe5abd810c4ac3bb7e3f62adddd952ee3b1cb5f6b69018cd02e285a468cd44c2fe9a1b705fbf107957 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | bf0dd9f76153e97e31b2923909dd1bf5 |
| SHA1 | 286d12c3566f26393ee759b316d9554f91841230 |
| SHA256 | 7732481a89a2052c0682b3ab8f9df5719f12dbd3fa1d0c51a30e87177ba20d7b |
| SHA512 | cdb7b393af04f19ea7f87c791d492df5d52f119367358c09cdbf705b0af0bf7d7a78340d70eac43b9cd6d56ff3be83e583aa514b0e6c705dac5072e5419c02cc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a9e9e83a669760ccb46888d2ec03cb12 |
| SHA1 | 52ad934b57652da237b6a1bb16faddb201e5e371 |
| SHA256 | 189318796bd13105171b77765d6269e47423fadd1688c2e2281e823ab92e313c |
| SHA512 | 7cca938ad86bf2c09142c8af36b7a741b35f0dbe0840467683dcfc701533b791176f85206ac086614623b836d3f01817cb8584021c09578b6708b93c6a616a4c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | dedcbc74b3489f60f5cd307e7e75e861 |
| SHA1 | 4fbc938c659db53d9f4970f97810a1e59f6cb875 |
| SHA256 | d0ddfe1c8aba6966927f9f4c99d00f5fbf39f3241fdf5cb6d812a04fa3ba032c |
| SHA512 | a1f94505e20c1006161f145ea1548ca665c591f48ad4ba445e8145675a2349fa2d9462da4e8a25c15f4bcfc3637cf69bf93260b1e78df3ff7fc7948ae220269e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f66c3b312dc6fe54d7641878fe7d68e4 |
| SHA1 | dfbadb47f033813dc057d4fde62b9cb229c10a58 |
| SHA256 | 7960e8c67d4c98eba21ad8ae9903122b13599c291851a7d32e2666ae1f4b035a |
| SHA512 | 0f846dd0c549a70dbdf798f399551c56376249ca80449f15543e03544c5de11842f0e93b93c043edd2199e622327ff632abfd2020b1ecd139538462fcde18e5f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 4619eac80eeedbe3754a2c929d35384c |
| SHA1 | b2644303ba3d3abf1459b4f8ca98dd7e3533a0cd |
| SHA256 | c1c4d2d665cb1073a69598db44a38ffeedefe7aa7950e6efddd6d6096048967b |
| SHA512 | ca7a4f3433e6dc5aa6d9ed60b131d0023c157c5187b3187caeeb6ea2d31b1baf74d87337bb9ac6b29001fae73d196ed0e7800a4e46e87bdb51535d4287d571e8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | dee8feba13137afa85fe9cfec6a6156a |
| SHA1 | f7936d6d17eb3636762b5ff4e8d8432a525c8a3c |
| SHA256 | 6a2a77b9c009a9c8d3bcd3dd88ea761923015f494d575550d99403c34e972f5d |
| SHA512 | 8419fb95d328f892060e724f3371572ba17a9c233065f85aa6919a82d26e7188172ce9e7d86035b8c2dc3c57ed1e7d73e334b82efea983efd62a86350dfbb819 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ab9f61b4be53232babd14e100454156f |
| SHA1 | fba15cc685f15a736acb8c55713f8c05d8177eb3 |
| SHA256 | 41b627667d49a477e8e87b869e9a3cccd2724f338351f76b881b9a2254f4202e |
| SHA512 | cbc22ca957f9d5f58c5eb785080c38e280dea11b3fd2580f787a25c1f9d16957567fe148d0e30cf6b34cc2ace8b93dd470024da4c642d4d7ef80c785fa4e7806 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | 7c270f5d172e6d5656a4063bf0a5aedd |
| SHA1 | 16a42a513b763c21bed20af02cb9cc74010c5266 |
| SHA256 | 2f96b2f0fa583c7b0ac2200b3ac60d55038d56884340619a70fd5cc8935f5ef7 |
| SHA512 | ddb0d61409ab11658a1c4d895d1cac14a98c4283394ce54bd7ee06242a31ec146f941522bf706f73012a4e33d6f0d71345c4ba43678cb264abbe031f1a550814 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-01-25 17:40
Reported
2024-01-25 17:42
Platform
win10v2004-20231222-en
Max time kernel
88s
Max time network
142s
Command Line
Signatures
Kinsing
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084469" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015a2f750fe9ee1479ecf0c8cfb11934c000000000200000000001066000000010000200000002b0110dba006b5e404155593aac1b38db8b3d8f20b533253c17bc06f83f30f1b000000000e80000000020000200000007fcfeb7ac75e98bb2d9313b07fa4f304eea86e8e36f27e2514005d7b1558ee1f20000000abf5ebd940575f9cb31af272a360eec7804418481e8a85c37cb4bbd3e7912ce7400000006caea015e006471ecc13afeecfa55c41a484f126b0575e8ee6227a242fe10b88ebbc61ef872a78b5afd50454dd9b7533cb23bae5a7bc4dcbb49ad9316b9eb4c6 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CF57BC75-BBA8-11EE-A0B6-DAD4CCDE76B8} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\VersionManager | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504079a6b54fda01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2747654460" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412969395" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\IESettingSync | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2747654460" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015a2f750fe9ee1479ecf0c8cfb11934c000000000200000000001066000000010000200000006c2d8c53822f5215b07045640c0ecbd1236ce909aa17776020035562ecfc41d7000000000e800000000200002000000028f57c4d1edc022862e78662c8e85fde1c2134f9ca8b79a8c07014d865f701cc20000000444ce801921f87b9e8dd362457f5af2b7722d0ce3b7b5e79fa70154b06a07bb940000000d0c54ec5cf1886e1b7200b2f6db0a1e88050517e1c41949cf2eb2e8188709417d183c01505d19ed1770cdacece060d97cfecb2d9f5e9f0aadd06223a9a8a253c | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\VersionManager | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084469" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31084469" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2750935621" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 408a7ba6b54fda01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3160 wrote to memory of 4500 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 3160 wrote to memory of 4500 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 3160 wrote to memory of 4500 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\751e3d7990742b749f1000f7cbd8283b.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3160 CREDAT:17410 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | static.cloudflareinsights.com | udp |
| US | 104.16.57.101:443 | static.cloudflareinsights.com | tcp |
| US | 104.16.57.101:443 | static.cloudflareinsights.com | tcp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| GB | 216.58.201.106:443 | ajax.googleapis.com | tcp |
| GB | 216.58.201.106:443 | ajax.googleapis.com | tcp |
| US | 8.8.8.8:53 | code.jquery.com | udp |
| US | 151.101.66.137:443 | code.jquery.com | tcp |
| US | 151.101.66.137:443 | code.jquery.com | tcp |
| US | 8.8.8.8:53 | 194.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 101.57.16.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 106.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.204.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 137.66.101.151.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.149.64.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | maxcdn.bootstrapcdn.com | udp |
| US | 104.18.11.207:443 | maxcdn.bootstrapcdn.com | tcp |
| US | 104.18.11.207:443 | maxcdn.bootstrapcdn.com | tcp |
| US | 8.8.8.8:53 | 207.11.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | kit.fontawesome.com | udp |
| US | 104.18.40.68:443 | kit.fontawesome.com | tcp |
| US | 104.18.40.68:443 | kit.fontawesome.com | tcp |
| US | 8.8.8.8:53 | ka-f.fontawesome.com | udp |
| US | 172.64.205.20:443 | ka-f.fontawesome.com | tcp |
| US | 172.64.205.20:443 | ka-f.fontawesome.com | tcp |
| US | 8.8.8.8:53 | cdnjs.cloudflare.com | udp |
| US | 104.17.24.14:443 | cdnjs.cloudflare.com | tcp |
| US | 104.17.24.14:443 | cdnjs.cloudflare.com | tcp |
| US | 8.8.8.8:53 | 42.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.40.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.205.64.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.24.17.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| NL | 52.142.223.178:80 | tcp | |
| US | 8.8.8.8:53 | 161.19.199.152.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 114.134.221.88.in-addr.arpa | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R977VUU4\jquery.min[1].js
| MD5 | 2f6b11a7e914718e0290410e85366fe9 |
| SHA1 | 69bb69e25ca7d5ef0935317584e6153f3fd9a88c |
| SHA256 | 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e |
| SHA512 | 0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db |
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSO8CY24\jquery-3.1.1.min[1].js
| MD5 | e071abda8fe61194711cfc2ab99fe104 |
| SHA1 | f647a6d37dc4ca055ced3cf64bbc1f490070acba |
| SHA256 | 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf |
| SHA512 | 53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NSWVVUXL\beacon.min[1].js
| MD5 | dd1d068fdb5fe90b6c05a5b3940e088c |
| SHA1 | 0d96f9df8772633a9df4c81cf323a4ef8998ba59 |
| SHA256 | 6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101 |
| SHA512 | 7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
| MD5 | 1d7f25dc2d6699e79619c31ff8908f6c |
| SHA1 | de3c1be6c3f3e7f6eadbe715ae575794e5bf1221 |
| SHA256 | 845c8a47772a9c534cf13a177c83c40db250a6dbbd0a369401ea884b8d058d6e |
| SHA512 | 7a6e1765a31821e79b766ea0675ed17d735a40766d5fcd6cc305a8d33b8257d11e492d4ad8626f2909e1c2c2d93e8d04ed133effd0a3ec29324ec3ca36a22a1e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
| MD5 | 6ecda5aa33a9ede99c17ff859e61d997 |
| SHA1 | 46ad9eecd07c63b1bbcae3de6b2011dd055b9f45 |
| SHA256 | 617444666355992da31ee908c0f2a6c58c4055ee4629675df804313c9e964aba |
| SHA512 | 117595bae340d5c37ebe3f3788d861fb497da07fff30cb2fa15f241e55d3edc4222ec8626b85cdba8c721906c332806f0904c544dd94b8095b975d621c5a2a1a |
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSO8CY24\suggestions[1].en-US
| MD5 | 5a34cb996293fde2cb7a4ac89587393a |
| SHA1 | 3c96c993500690d1a77873cd62bc639b3a10653f |
| SHA256 | c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad |
| SHA512 | e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee |