38658ac74d5516bb56c20c604b95306dab9fc707c5662501225a8a6c18e3d7b8

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
07-08-2023 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dpr_report.html
Size

1KB
MD5

054e373de9f9a37790eaa1769b2ab108
SHA1

6305078cad8cfb75a4c79066c03a742601be7f45
SHA256

f9689be3f17411447ea7ac066654cc65271d5552edc55b186b33797af5e6813a
SHA512

3f7c13292d3ccb5cdfec2892c6e3c2f1746614ffeb71a1b1b07564082bc6377dd655ed315fcd4ab5c67161e242c5ae2a4bff669b7e029a66eae99039c156353e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397602031"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15D5C8C1-3561-11EE-AD0C-6AF15B915EED} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd6900000000020000000000106600000001000020000000912d229930fbbc51cdd818bfd093bb7f3cf17347cc54b23f9e19164205b9c4a1000000000e8000000002000020000000441192904f3b6c10f6f8ff5242c1f349bea06e2295e49b1a6d5e873af118ab81900000000da0ba979e0fe00e63c9f12fc85e6b433c7b02e973d4119572d752270072c6630966fb0ff9b8f46136a511617bba16060f680328b7649e8fed796f1e666a095589504b722d562eab481f1e322dad4cd4c8fd57c263b4e9e2e421a0ab2305b35d290f4faa5417b666c449240c0f15adb96e5111e68b5bfcc872953b2cb610f1eb79bf17844c10189041f127d3e76f4aa740000000d1494dd2604240244e823b0d9f18413f6342fd21f292e3db7f4eb26271e7dc5d0caee4b6826e21617547367c82ae034bf447c73350d6b8b93de02b74c12bae42	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0cbf4ea6dc9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd69000000000200000000001066000000010000200000009013ebef558d2833b6d7b041a51617f60ef14f40a34097b2072dc56741e48448000000000e800000000200002000000041bee3dfe077749cf6e0467fcfbcd42ac37b13aca4567d74362543bc750fde0020000000cdaf94e02fb0b4bf09f51b7851e61da801b42cff217ac917c0e3d45b757f923d4000000047018a14ab2202fc50d888e970413729dae7e1d8b0b96115aa758393c0386ea3e49829f9adff80ecd07d695b72bc8b47b8d863ddaabac8a52de31cd2d35ac732	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2428 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2428 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2428 iexplore.exe
2428 iexplore.exe
2248 IEXPLORE.EXE
2248 IEXPLORE.EXE
2248 IEXPLORE.EXE
2248 IEXPLORE.EXE

pid	process
2428	iexplore.exe

pid	process
2428	iexplore.exe

pid	process
2428	iexplore.exe
2428	iexplore.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2428 wrote to memory of 2248	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 2248	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 2248	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 2248	2428	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dpr_report.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
344a9b3c2dcf5393ac5776212c73de3a

SHA1
3416e0b2753f269e08bab8a4d0e963c48a05fe18

SHA256
0e14d50e91d4714f9497d406a0ef36b45f71077f75e11d56929c0a7b71b7e4ba

SHA512
638e1dccf5a5e888e23d002dbcc08adb122f5603d95254d9c6170983d4d65c7609fca41669841dbbab06d77964e2a38edd7ead6bd1b156e7ae473d7dd527e08a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05e8a12b953ff1cccfca013faa96d0e3

SHA1
23f8d915f305419e1a1e1cf2150501778e39e551

SHA256
e6e15f1f23b14be8289c0d2e9143a124686da081c9e5df85357b1962f22693e6

SHA512
a09ca7b0381b4240d3b10165ce0a01a6be9ed0cf3683a4729024f821b2e32d888721664351bb72b2c121b51bdaac4b91747a57aa17a8a2d298704f72c728da1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f657ca42023d2e47c6ac81b9085a2edc

SHA1
a7750438a63cea014169fb44e9dde4f64973a319

SHA256
29e81bb56a14ef3dfdfd736714b29d342663c15dc340ec7b3051b352371ce1c4

SHA512
fb8b0ca8e0ccc1c8bc8cb3667c72748e925aca6062dc8eba2318e08dd063b058721f4aa3dbf3d0b5c4d56fa0b55f799f2262531e616259713ee7178417b23576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40a1985e9172cba0e4b85ebbb401eeb9

SHA1
ebfe6dc28a6a9724a0a36a6e9cf8d3de53a8867b

SHA256
d776c1e23ae85c001fa5a4f25634630bfaabbeb154c8ed0c9eee8593b40dd9d8

SHA512
24a570654447eb62ed55b5852b3ad06660ab22cf80e6029085ec354bcfc710d32990a03220bb347c8840b9053a17ee5c001932a02b6e0f146bf3173ad6486985

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87405af345e41634d9c07b89147ff7a1

SHA1
c8308df709d5bf819de1c279f8f7ae46de3fc923

SHA256
023f5f4bfa4b7f0a076f8f1d26640cfd005df24c9ccaf2de7a7f222e65a6b62d

SHA512
3edebc6535cdfd688066ef612b3809268bebdf305a5666365f20362e7d5e4eeb91560fba9c213fd3a8aca1ccc02675904d295e7653fea9589b3b80882b7c423e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0912863531bddfc7419a56aa9e11001

SHA1
22b879e20bd12f9436cf47f5ebd41326a8c08f18

SHA256
b0a1cb514f1d2ff2142945108c9967f073f22e5d42529e4769d62d745cd675e3

SHA512
7172fa132290717a573070f7f8c3749d2e730b8daab729cbc1d3ea9e1bd1ad40aa5001d5b82526c0282a749f32d5b0e18ac8f14a7b01a363b9e1b7c91e068592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a5a893f4e9ea1864790dba9d9d61300

SHA1
268a41d8aa601f0259ddf629f63db41dc6548372

SHA256
1830cf20e45e305bd343d1f2e5c9ba5f8ac065b6fcac3f27ecff789d93a8c22d

SHA512
df359424118a918bcf716f3fda6c37feb2d7c157d9966bf47a36e8f8e69b6ee070d4445462cd8faa134076cee041261a468c5b956298db2b885c1280ddcf4165

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
845277f8d655cc8fbbff58162dd60a7e

SHA1
69bae262c454480dae6c9a5d288565ccc170a8ae

SHA256
fbe38c47006803d01b01d65a64adc23e698c4c15f5c1fcd77ca2548d0e7425fe

SHA512
2d88821f92f1de8335ab7a4864ce6c8b8e91a49a96af0a531d15865228a0a5ac6ef4a449e2b882ed353564ca7e91fd813d9359296fa6d325a2c95e0764fd455b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9881be20de70737c8a340927db75a11

SHA1
7235d4f3aa4f0bd9032b62f5948b95c1c380b4de

SHA256
d1fd9622f76bdb343f126bc3dac02456b4095b6bb5c327a80a944234616cf3f0

SHA512
4b5bf2f136570b708f1ac91ef42fb2a25fde760860a4fe5feb4bc4f8f025e28e25d18813899c11cb0b1a9d69f276e114d3687b3f6204a458de194e0b3d9a8488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3386eaacb9ba1376d1655b5bffd02ca7

SHA1
112ef2fef56c3ef04d87d182db4bab7898536d37

SHA256
8b0df459ea40a78a28e27ffbb6256e2468a6a252cbe8f435ce88f04decdac3d8

SHA512
48c2b63ece275c9aee4dd37fe6dac4cfff690644b4ea92a97ba9af586f61da00fc1ec7d39bbfe4c7084abd1103410de38b88b287de1758f684a43bce1da1f85a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d50222a7e5f8feba1711276f3b5f2bd

SHA1
31a820d69d5004102c0eb4b76747aa74811d2976

SHA256
a0f81ec48808ea1f47a5c98aaeb5bd02cdeca8f5aca4722bc1f051761f3880db

SHA512
5e2a0cc62daa9baf524cd5c6e753a872ef360eff495a219c4dfe577c3858acf0cf8e72bc21a71e060f84d002f8a88a9b01a947812e388fbc3af69ba542fecc47

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC60.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBCB1.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit