1ef4aa23897477fad4e57aeec8370f5fbdce756efc26be3deae5123efdc86b9a

Analysis

max time kernel
101s
max time network
155s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
13-05-2023 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gd/Resources/DungeonSheet-hd.xml
Size

2KB
MD5

81973b2057bca63dd6ca47a89414b35f
SHA1

5f8b5fcc84c7310dd0fc75c21e9f1afda157620a
SHA256

ebbc757cfa618a93a9170ab505da95ea178f49128113c6fe70c4b121ae3c2763
SHA512

a27c4998a93c84470e430d5269d4c488c9c325885ee0c3f007a8a4857f259f9df19125d5797f17672f2a7fd2628f4b11566788b789cfcde9812caca70705c56d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a8d88bbf85d901	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B42A30D1-F1B2-11ED-B400-EA414CA8A2BA} = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "390763510"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074b2d77a8e7a944ea7c282b9066208cc00000000020000000000106600000001000020000000d5c4df6f580b1f2fbb5bd1b851072c33f820886cea67e65b24a785312a490824000000000e80000000020000200000004d91345289e59f2061094d8a5247194d4985f15fb848b5cd65f82264e3a3d84e9000000037127996bb9b77d9000dcf5eb1e4630aa7ba2d1d236dd9bbebf614082252fb87b31ff3b60107d7db929eb7918a550f47e919fcb6b7a075fb4c5a9c646629c1f5b6919161fd1042fde3e7640a5279c7c2452368528bdc65b0be3c3daf1060c93d76600013a13e6ae0a311bc3b40f45bc086cb0c99a0428215fe9ded7197c4be12a70d737ccad690f07d807db673b22d3240000000d1f79268aea6d02384d2afaf8a5b2cdae2430e80416d0b58d1894becca5b0b2e379670ef76a9e1ea81528a1834fb4db8efb7806309bad442fe4d0c3205df2267	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074b2d77a8e7a944ea7c282b9066208cc000000000200000000001066000000010000200000009c99d58d0baf02793a0cb99541305509b1fa10044470bb75c25598b66d1b788c000000000e80000000020000200000002f8c78c489f844c4a7dbb0726bca927cd3893ae205678812f30e8365c2c64380200000007102c47d5b5cfb8001f4dd78ddc9b2d7e765d0ae2e307907bf4653376818c7354000000017dfa7dd8b53688481a35863caa217c6781a0425eb5d24689794ccc61556e2488456e2d41d7f9369d16ce66ad4dc57116a64da996dcb7b44b24b5e8317e78203	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\es-ES = "es-ES.1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

740 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

740 IEXPLORE.EXE
740 IEXPLORE.EXE
1664 IEXPLORE.EXE
1664 IEXPLORE.EXE
1664 IEXPLORE.EXE
1664 IEXPLORE.EXE

pid	process
740	IEXPLORE.EXE

pid	process
740	IEXPLORE.EXE
740	IEXPLORE.EXE
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MSOXMLED.EXEiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 1992 wrote to memory of 1608	1992	MSOXMLED.EXE	iexplore.exe
PID 1992 wrote to memory of 1608	1992	MSOXMLED.EXE	iexplore.exe
PID 1992 wrote to memory of 1608	1992	MSOXMLED.EXE	iexplore.exe
PID 1992 wrote to memory of 1608	1992	MSOXMLED.EXE	iexplore.exe
PID 1608 wrote to memory of 740	1608	iexplore.exe	IEXPLORE.EXE
PID 1608 wrote to memory of 740	1608	iexplore.exe	IEXPLORE.EXE
PID 1608 wrote to memory of 740	1608	iexplore.exe	IEXPLORE.EXE
PID 1608 wrote to memory of 740	1608	iexplore.exe	IEXPLORE.EXE
PID 740 wrote to memory of 1664	740	IEXPLORE.EXE	IEXPLORE.EXE
PID 740 wrote to memory of 1664	740	IEXPLORE.EXE	IEXPLORE.EXE
PID 740 wrote to memory of 1664	740	IEXPLORE.EXE	IEXPLORE.EXE
PID 740 wrote to memory of 1664	740	IEXPLORE.EXE	IEXPLORE.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\gd\Resources\DungeonSheet-hd.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
2⤵
- Suspicious use of WriteProcessMemory
PID:1608

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:740

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:740 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
372ff249f603762ddc168cb446afc9fd

SHA1
cc95e5d20fe682f9bac5ca518336b11e4a5d2910

SHA256
1294ee02686762e75f44d47a75dbea925f696122e42dd26af18b47ab242c1651

SHA512
5a9bb6d1e717fa3c47b72f9104baece2265ee5184e9351493f67bdf7529cfad559726a01618649ffb2ca2bcaae11cf78a80d3f9b2e2969ad8cd41cc8db35be05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b09824e0a355644d64155eed2c0b89e

SHA1
7628ac94d6a1deb240270bb8e7d785a569c95487

SHA256
a35362680065d4197c2cca6c105e536b93e3288376e42a1b8d119a3201a31d9c

SHA512
5df51ff73e67f318f7c3e7de94c35af6f3df410b66509165db970213b834dd541104be00bd563cd1f36f6ecdf5fdd5723555a3c8ddaea6bc71b4af8de4cc37c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8b65b94b1b9c8b0ef6f8f833f253ce1

SHA1
3c4af9f250dfe592cccb2f0bd4cf2906b519eb38

SHA256
be3f1a3f42bf481024bfeb4bc4cf082b405091e85aac8f2f6aea928c3f54baef

SHA512
c370d1ab0e269208198a07abd48201ab3d31b6bec37eae83ff28272d08024961cd8e2ecb02c78fed6af874d6608f66f5a20ec7323d4b43373a09aff431a0596f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ff3fb8bc7e6b4b4491fe215bd434b83

SHA1
3f449b00a00c599157cd05f287a5ec32e86b8d1e

SHA256
cee1b30b38c766925e29ad360a51d99addb20fcb4a7066e8856a904d38604015

SHA512
c5ac46f68577d18e31122f6baa6ef10e798a39f890b685e5b4aed0d3fe4cd36bc78ab5f55139a41002b2edad6d223f5d0fe19f929a57561b421a65f71713b0cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e19a1bc94e51357dd28665de478f546

SHA1
30e872447679e5cf9e653e08357b7b202f9cbc46

SHA256
7861d041a8437f449fa89c32a2df36ae905f633e5a4af985e83a7552a4a921cb

SHA512
a6c4bcba8a6fd7aec9134fbfb128d94fc1f3742e44a3ab7a943e79a9fbcbf88b90c89f34a9624e6df5092d2fefb07465f575a57a196153405e920ce5c49dd25d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ea4ac7c21df2ca1c01de6aa25bd8dbe

SHA1
a96e9e07ba9d6669efa6b18fd92ff1c371fce4ba

SHA256
dac0a4b063eb69002729bfee6b8f99cf641aee0307ca654d05e6d02d7861e6b9

SHA512
1fe9364ae896be89d33d18e1502614fe471c3d869cc6ac363a81bc85b555bd889b675ca0761ed985e73de0bd4d0bbdf046eeb3562b1106157a2971032c8072ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e236ce9d24c71636d5e23fcb76e9f721

SHA1
6de71ba217f458ac650839f1a13a2207466ce60e

SHA256
cdf6b916ee86ed8232e14e84169e0ff285a35836a8372904ad06e7bb39c691cd

SHA512
5a67c31b2e17d8e5f6e3374d6a597ebac57a43dd29a021430aaae9a7ef34d412aa0b26ee0214c61eb68d025d9c960e0464d58b4c826ce536d4cd6855ce7cf9a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca465fd1b25720339a5d4fd07634908a

SHA1
ef83880900dae4777834b9fc7c1badaa933f576f

SHA256
4c461b6a24036e9cee0f09a616e866551be35ba58314fa1d4f91010b72825b69

SHA512
bcfe204b129c0ecfe0a333d253ef366f5bedbc168a04dafd46e29468c549f12a2f76a6f3dd3726a820beb93be9bfd395592cc85cefa6bc19adbfc5f7960d4946

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NZTPJYNO\suggestions[1].es-ES

Filesize
18KB

MD5
e2749896090665aeb9b29bce1a591a75

SHA1
59e05283e04c6c0252d2b75d5141ba62d73e9df9

SHA256
d428ea8ca335c7cccf1e1564554d81b52fb5a1f20617aa99136cacf73354e0b7

SHA512
c750e9ccb30c45e2c4844df384ee9b02b81aa4c8e576197c0811910a63376a7d60e68f964dad858ff0e46a8fd0952ddaf19c8f79f3fd05cefd7dbf2c043d52c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC4E8.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC79E.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\KFZK84LK.txt

Filesize
608B

MD5
eafdaac0be5990936763a73f33e66321

SHA1
b90c018326303028f517fe5daaa888bd64da655b

SHA256
72c0bc47532bf6d29ceacfa522cad379d63b7b192dbe7595f398fc6ab5434896

SHA512
c90ee7967e6c77ad49ec4df96a826a9d1f9299513f9c172672ff70e2acd83ff120ce980baa96e34a69eb5075eebcf4ac54a98f0953d84ae637b7d3fa9b437ffd

Download Submit