5dd8a02a0d54e2390aa3a703e8776c94e23eba9128edac3b8a4c41a454abebab

Analysis

max time kernel
138s
max time network
135s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
07-08-2023 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dpr_report.html
Size

1KB
MD5

054e373de9f9a37790eaa1769b2ab108
SHA1

6305078cad8cfb75a4c79066c03a742601be7f45
SHA256

f9689be3f17411447ea7ac066654cc65271d5552edc55b186b33797af5e6813a
SHA512

3f7c13292d3ccb5cdfec2892c6e3c2f1746614ffeb71a1b1b07564082bc6377dd655ed315fcd4ab5c67161e242c5ae2a4bff669b7e029a66eae99039c156353e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a91d4b999c9854dbdd04be1b9b2202d0000000002000000000010660000000100002000000080e78c6bd338a27f08df6b9c80cc109b52c5b084bfdea191f18a6db3f16a34d3000000000e8000000002000020000000847d5fa507f8f77284a836c4cf5d8b6f6371a466ed0f31894c7fe287219b4d2120000000eca00c126fc8ce8baed09d4445e2889e9313a17d4651692dda7dfa723bab13be400000009a74fb20613148973993df4c4431e282c7b21f31bac32deb362f7e4770926df793cc579f78ae13e2631c5a54ef12f5fd8d82424d557a35afbcd41186d6eb8b33	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01bfebf6dc9d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397601958"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAE477B1-3560-11EE-88A1-76CD9FE4BCE3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a91d4b999c9854dbdd04be1b9b2202d00000000020000000000106600000001000020000000a5908852163f399759b807a4f9ee95a745559127e119a85333ac115a7ea568f0000000000e8000000002000020000000285a5f8ddff1b4e1c532fa72fcceaa998f1ec6a152c82957b3bbf3c79a498547900000007aaed5dbc94c57ecf10c9ab833c8a53a1597e406d89d4edeb7576b4c7fc6c840004b11bfecd3304c82b42d64438d7eec40c84f213e5f53f289067cdb64d534d4accbd4af1c7af66940c302ea7b31aa0b624805899a020105d982f5d926c1f461c3b0d3471bcddc4867f0f1cfa0f5255341b70a58ad153f320a851ecc8787a5a64a46584f87f131e8100d4c9da8a0f8a7400000004669789231e74298c5cfa87971ba1f190bd457ebcb1377efb17d2d732cb55bc3a4fe1a45d9051fbe7a400a285da721d6ab8cb77e1d6fff41c1e80cc3adcd14e9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2624 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2624 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2624 iexplore.exe
2624 iexplore.exe
2448 IEXPLORE.EXE
2448 IEXPLORE.EXE
2448 IEXPLORE.EXE
2448 IEXPLORE.EXE

pid	process
2624	iexplore.exe

pid	process
2624	iexplore.exe

pid	process
2624	iexplore.exe
2624	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2624 wrote to memory of 2448	2624	iexplore.exe	IEXPLORE.EXE
PID 2624 wrote to memory of 2448	2624	iexplore.exe	IEXPLORE.EXE
PID 2624 wrote to memory of 2448	2624	iexplore.exe	IEXPLORE.EXE
PID 2624 wrote to memory of 2448	2624	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dpr_report.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2624 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c734d83b9b7e76ad197a4432d048c12

SHA1
02d07a21837498654af0fca3779d7ffc4d60c66a

SHA256
c47565acd4ad21f779dd08e3009b9b7fbad950e4231d9aafd460c80b66e24684

SHA512
44571592e30037f186523030894589696bf06afe450280dada494613d2a32ff372b2e7f6267275a16f0916dc56a202cc445d6f52a717d1d098eedb254e6aaf30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8ea708eacd46120728620986340f4a1

SHA1
eaeb310c0e5f6a144270f22411520d580b42d7db

SHA256
9564e83076e3c18a3e0cf62c8333f4c74b8305d2a363ac61a7e46852afb47813

SHA512
14652f76629dec43001372dfb036d7fef18e549b5e8c6745feb766508ae03b4db7f9acf5e8000b3de819b68e08eac68011123f24b4a05179a76f725292013ca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cea48b9b612a57435afd2ed62a6199cb

SHA1
745750baeab398d96c38a24124ff3a0e9b60db82

SHA256
01d09a7698ea2bab6b4fa831537dd446c87325bb52a029aadb792e3b4286ee70

SHA512
fb63f2150d90741e3593752c9d1761bd0a09ca984284f086119fb02490956fda954becd159c92a5d8ace5f316aa7296854e8a8c5fb5ccab7b18814a0a07a04e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d23ac7a7c929635abc3c461665c8e6f0

SHA1
99ad6f8ed93fd11cc0a2d66fd9a84f950ac6be78

SHA256
875ddf09c08191292c60c9f65ae912046b424c93ceda5a386e8926f346cacfc5

SHA512
0ce1ff4dd39068088fa28766e5cbdc04d13b20235938a4de528ef079c030ec04d682e360e29008ec8f4036f364ceb5dd6237d91649d89099c9e4871cc7da9d4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a02c922502ffcb9ce33ee68da502e9bd

SHA1
6d16725343d61e69f9943338ae7656ad05b2178c

SHA256
31cfa68631ef191b0ad0969caba77fcdb57c68085510745031b4976e97ba8115

SHA512
017bc1deecec773562199c279d09278de310a0651de4a470b6044f408ae97e2a5be76390f3f75f88c6271fe6462dbbb14ee14e446154800c2d86b9e87f4b9ce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccc0a5e6bcefb426a301f3a71f7305b0

SHA1
b6456727347290057b9a0ce7fd8019a100f18e10

SHA256
2ddec256d372795192f7b8411b28d525211ea4044f5e4fca21c5ba5718482d02

SHA512
0f9acd60eaf782e342b396a64720dd6f1cde512542ad688d6c7c446f18337e088e04a7c28da8cb93f83a6470588770fbd35653dae6d9ad4bbb7cf48ac9ad1f85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cab5a66bd4b774acb91df73b7a847b6

SHA1
11c8c3bec2861a5987166fe069d6b7edf47517c2

SHA256
42b77916feeadc09d8e278f343f6d24eae4001568c5dfbe9aa8ee0cea4ab17c1

SHA512
48323f26a5d306a8d04195f8d24e79b98c54c90715ac666f5690c658264670c85877e935613d482e3d6bd4237892c41088735d8a3fee2acc3e691741ea5a676d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a2c3ae68f8b97e0841620289898d89f

SHA1
367d955dee67e7e20e06e58223fd0b31a7f129e3

SHA256
9639cdb239d89e5682d93b61062f1728ed5391b2f66a95637d7d9d36e752eaae

SHA512
68755beae8b75772af81c44bb7c886730276ce3ab8032e1ea779f006da9dd00843495d8edfd243e4f8ccc637d8fb60151f8ce57c7f13dfd8294846356e4d69e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7191d5aa8b8cedc0d47dad6f7332f30

SHA1
09663b1886be685d833b9d38e2554ccb03beca6e

SHA256
73ac2c631243d6910375508a27024196659de3eb8528b424842ce7c06dbce6d8

SHA512
bdf2920621ed3551560d02b37bcb8103e7cb5f9a601720ec68d04333b7e4ea0d798385f452b0fed6f8823e81d77b650bf7db0684b8a5c574a30d57a2e15fe851

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c0fcf2eb29734e57b0658ecd6b19275

SHA1
1a4bdc39cb7a37aab0f0a121c6c566ff15bcc8c8

SHA256
1b745e4b8da485fc4a9254eb2c24864b995e9fb337cbe713a5d4645fd1f68b24

SHA512
ff31350d874380384b5b4df422e1437a116a8e7d4a3433836b449b483b0d5c67756e03da39323b606ad102aaffbe9a8ca51e0b936e02e92f095e325eb49063a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c9e27000a525d459b0f62bafadedc9e

SHA1
77a6e3dca26ee113a6fd2682159cc60147bd606d

SHA256
dc3a2b0f7ce9b081863be5a470d5a0f8dd04e5a09cb5d334aeed8bc5c00233b9

SHA512
3171239490114e62075692c2bcfef3832505c584f1c0317deecfbb7c27b2edf93e69ed7392de1bf0e5eb383c3c811e2c692ec6ae7f4b8ea4f262bc8e8e115d89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0959623414ce7684e3eecb6f77f5e1a7

SHA1
ff112c48c4ced8ee79521a913127d67ee2807df7

SHA256
ae2b2949752f6c2002442fd5f5cde4520bba086c67a9c31c1da7466083fdb5c8

SHA512
f5d4b37d20a3219b8da932e7c7595b68106d12f15e86194ce2093dc13f3733e72fa67a28c826a32aa6264b9b2e79c5c751b6808ec34f12df3eafb8b83718e43a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29488be43483a615fc21f87c76d7c625

SHA1
99af97c64f65f1f2373c4951f87f6967b9c5bf83

SHA256
faa2c6dcb5bd69036cb1cf209628dd4a243714f6247aacf746302c76e25efaa5

SHA512
5325caa4c9985f598035ea43a34197e7fc47bf91cb388d9c4168c5d13fbd1be49669490c5ffff851ac7bf032a7d48112f451317938058453dd44a0a850e8b4f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f6bd8c1fc08bf68fd1e84671e0a2da1

SHA1
10db8465b296c52c9ae09f7457814ad15142362a

SHA256
bee8766a47935ba9567a4b568c4e664335efef6fa9c21485a0922070afa6b1db

SHA512
2487ee1f6517dd6bc0005be469ddaa87199f6bab15c711ce4ab70181d75b25907ec82552ffdc4400623b2a5fad204d06a0d9f5e419106a53f65119985246ba01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da32abe6877372d2b7b61a0efeac9d26

SHA1
6dd503d519f0e826abbb20361e9d84e73ac07c69

SHA256
ad203385a19908e34812ff072d547621fc6565dc4af61c48f778304ffa084496

SHA512
4a904e4571e1a74c851f051c83e6959b38cab7b8e2e32ec71fbf60c991c0667399868255df4809d29e36db0a32eadef1a34e19eaad9692eeb4ed31d5fb2cbd9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
906d5fb787b92cb8ccf4be932b2f3e12

SHA1
01471454bc200aff8ba42161148a54a7c49d7694

SHA256
fe0f0edd1579f33f1875daddf46d27a3509bd622b6daae73487b49735c517dda

SHA512
ba6efea0c1ca18994029de14737e92e3670da3665d62d5b130394d3b3bc31963abb362218ed8d028b6947193aeebe0439e58d4cc1370211c6a0cdc452d8e6505

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9A8D.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9BC9.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit