86bfeefce2acee5d39d7bb93461eb5f93a81658579ceb4c8346bb77977f15ef2

Analysis

max time kernel
107s
max time network
162s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-03-2023 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

publish/Ryujinx.SDL2.Common.dll.xml
Size

244B
MD5

2d175f1dad5afd5ff46691db53d9459a
SHA1

1b220dfd4badb4fe6d0f0cf839c76cced2f6e47e
SHA256

ccb8d75668d09da1d56153fef48e62de2ef3c6248cfb1b98169c4d94eac77ceb
SHA512

757e52f3badec151f3abc3da15ef446d6731fff62d2686b5e0f6455c6a823693a011bbd50b5fae35dc70e076ab7db908689778b94dcd1566c4f007001cb29c0b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1381631-BBB0-11ED-98CD-D6914D53598A} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a0000000002000000000010660000000100002000000075d1a2e53d49de7efbb744c3b44be78472701edda26b581e12621d1d2d4507fe000000000e800000000200002000000053b7a4b8d70c673c548855cbe7b1f287baacb6805741f33cb1293167035efaba900000001232c7e7266398efe7174b2c8d7a95238cb7e395b0106206753ea8c1d9bcd3e94df8451141f7aec7f7704a9ed21acbc5bc99907bbc30b94d6748b930936735165d25d7db4db4763fb34a3fb62e63eb11b1bc95affe779851d84763851203c37dc060915add975d8c55a17f04bb35ae64f0e4f5763a9b81274ca8ee0e562130122c580f8a3d14b0585a9462739ff7ab584000000085bbbb789cdf5eafdbfcfaf1259986010b0716ef519782ec4ecacd048de1c5314af131b604ccf8461157cedcc6bdf4c8ab76bc41deabff92bdae1d83b6f1a584	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d7bf99bd4fd901	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "384825310"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a000000000200000000001066000000010000200000006a844acf4b963ccaa82557ff7292cec1d899d26a9df43814e19b4088a8b1f038000000000e80000000020000200000005478a25bef1d01a1c76126bb4a8505f16a8113cb821ff755261b67c1c06f33592000000027c699b3f64d1a0bd6cea7fd72d3ef18ae4122dec596c46f7366f6e39207a40b400000002c86df9dfe0867162134634e7ae608df381f67d72421ade3a4bbc120de2cd6ccc3ecd7ea09d3e6138c719426d6e31a0de2ed2113609612aef439cd8cec2d70e1	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

1480 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

1480 IEXPLORE.EXE
1480 IEXPLORE.EXE
1228 IEXPLORE.EXE
1228 IEXPLORE.EXE
1228 IEXPLORE.EXE
1228 IEXPLORE.EXE

pid	process
1480	IEXPLORE.EXE

pid	process
1480	IEXPLORE.EXE
1480	IEXPLORE.EXE
1228	IEXPLORE.EXE
1228	IEXPLORE.EXE
1228	IEXPLORE.EXE
1228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MSOXMLED.EXEiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 824 wrote to memory of 1028	824	MSOXMLED.EXE	iexplore.exe
PID 824 wrote to memory of 1028	824	MSOXMLED.EXE	iexplore.exe
PID 824 wrote to memory of 1028	824	MSOXMLED.EXE	iexplore.exe
PID 824 wrote to memory of 1028	824	MSOXMLED.EXE	iexplore.exe
PID 1028 wrote to memory of 1480	1028	iexplore.exe	IEXPLORE.EXE
PID 1028 wrote to memory of 1480	1028	iexplore.exe	IEXPLORE.EXE
PID 1028 wrote to memory of 1480	1028	iexplore.exe	IEXPLORE.EXE
PID 1028 wrote to memory of 1480	1028	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1228	1480	IEXPLORE.EXE	IEXPLORE.EXE
PID 1480 wrote to memory of 1228	1480	IEXPLORE.EXE	IEXPLORE.EXE
PID 1480 wrote to memory of 1228	1480	IEXPLORE.EXE	IEXPLORE.EXE
PID 1480 wrote to memory of 1228	1480	IEXPLORE.EXE	IEXPLORE.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\publish\Ryujinx.SDL2.Common.dll.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:824

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
2⤵
- Suspicious use of WriteProcessMemory
PID:1028

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1480 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
1a00a1fa75d360429a7579ba989764cc

SHA1
9f8d32749675006ac5032fe8591c0b1989910eb9

SHA256
92d4fdea8fc5f21e41f1fdc4db2112387f92af564abda09d5e1fb5b699b2aee7

SHA512
592f8be410a4747a02e05529a95b51855fff25ff547392b52c52a2247e4c4b2a3d1a12c5600302add4bccc5f9364f76d8cdaffc9d211836be2e9a7e64d9b1b11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a45cdf0322873bfe5327dc61c8f58bde

SHA1
50cac665950c68b01068ae5d4579f5636e4bc5ad

SHA256
bd1c1cb6b3c3bfd82fb039fca1ca849d770e548d15c0a7a2291e39d1e8260368

SHA512
3bf384764ce3396fcfdbe1803a23d9fdd0af6eec96fd7ab8ae1a9d3130289e2d8d0277732bef78ec52437a2462d2ca76d77eabcfcf04cd8e7fc0cecc29a79b57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
9d81bb656a61ce46659f926d903ed08a

SHA1
be363373063052fad41e24cd249d715912f48b5b

SHA256
7b99ab9c565aef423bff399d68ba4cfc6952e6698eb518070ac9a945bf2eed8c

SHA512
b5b112d445051e10f078ddab7bbb247c7e3ba88ad4f09f67b7ad62356d14cfa515250bfdf45ad29e2763de82ff99b224e3833ed89e888615357dbb91bb898020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a55bc70a0e02b22f646a18984949e56a

SHA1
6c0617e2b3d9ec31529cd1135e194c102a50e410

SHA256
8f7157d274aa7d5b2ebac11f552ea5b61070ea2a859fd6ee058cb2e90f79d74b

SHA512
93de98966ef97efde07906df4a3180f3f99fe073b0cb245167f4c01706bb88ddffe9c7369079846dd0fab0f66c3531cb98e6ee1f3b45a09b0f4543b5a8cffb2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFOBZ3YS\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab844F.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar85BE.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0388JPXY.txt
Filesize
600B

MD5
ba678fa7e4a14b19719f482c5b4e7acb

SHA1
a02db62cfce1d7a33c25493ff4b40b9db912efd7

SHA256
d527319173eee0d304ded1a3d620c20eae0fd236079bebb66a2f215650b6a53a

SHA512
bf9fc5450980e400fe9772e276409097145e6ca25a08fdbb0f369cfe9d8710db294ee4e18f9a76b79a0813577ea6d65b6f5b549eb3a424f672bd62407e836b97

Download Submit
memory/1228-55-0x00000000027A0000-0x00000000027A2000-memory.dmp

Filesize
8KB

Download
memory/1480-54-0x0000000003020000-0x0000000003030000-memory.dmp

Filesize
64KB

Download