Analysis

  • max time kernel
    227s
  • max time network
    300s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    28-11-2022 01:39

General

  • Target

    DPlayer_lv/file_proxy.intermediate.xml

  • Size

    638B

  • MD5

    139fc2437354c15b9244734676966e39

  • SHA1

    faa1dfedd581a6f2dc9da625fe20499faca64731

  • SHA256

    97b1dfac60ade39e293fb39a093e1fd01fec5438549c9bb1e341c7fc82d102fb

  • SHA512

    1470ae4663eda9fcd0521dea6d2a8cccc4eec8260a423edb73ebc894e10c955984d1ec045c7c5f00593e6454eadfe7e435ce5b1162e5c0dbc18f605e7ed151c1

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\DPlayer_lv\file_proxy.intermediate.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:320
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1800
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1800 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1648

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\XLPRV9GS.txt

    Filesize

    608B

    MD5

    079885ea430ea98e4651ed6267d553d8

    SHA1

    120f5c87d415c2b6d24f2bf24e7715ebc8b5a4d6

    SHA256

    f4f8eef7c71e1a2172abf18c180aa0e67d590b9ce7d722301a1c099b42e7ebf6

    SHA512

    8c4f1e2601374fc3f50227e6ad9ad2d9776f2f8f36ab9648df361544c8946041a9562f0178ade333948ce21d0d2f93bdbb5b7187431d3cc47aec6b9af46e328d

  • memory/1716-54-0x0000000075291000-0x0000000075293000-memory.dmp

    Filesize

    8KB