612122f55d5859458323f874ac961cb46291de4359284feec5bd6181d8b163cd

Analysis

max time kernel
134s
max time network
133s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26/08/2023, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dpr_report.html
Size

1KB
MD5

054e373de9f9a37790eaa1769b2ab108
SHA1

6305078cad8cfb75a4c79066c03a742601be7f45
SHA256

f9689be3f17411447ea7ac066654cc65271d5552edc55b186b33797af5e6813a
SHA512

3f7c13292d3ccb5cdfec2892c6e3c2f1746614ffeb71a1b1b07564082bc6377dd655ed315fcd4ab5c67161e242c5ae2a4bff669b7e029a66eae99039c156353e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D807FC11-445C-11EE-BD9E-CEC9BBFEAAA3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 500cf2ac69d8d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015e49348610e2a42ac63317e6e4271ae00000000020000000000106600000001000020000000099cdda9c7dc31971ad5412053819379baed28c768ddc74dd0033490dc012336000000000e8000000002000020000000eae1f729bc3f71d2453eb4621af20ab3dec16d023f1de47b322cb4c1f65aec8f20000000a44e1cd1f39e8744993161b690c83ecec31ff75cd7a04a68a1af326737216814400000006989ec027d324cddabd9e157d4390a266fca46e1f590e4a2e53bb2da0957a84fb17bf29a6a124674ce1ff4469dcc18940b4d5c3179efa6a5207db24fe1ac841f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399249474"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015e49348610e2a42ac63317e6e4271ae00000000020000000000106600000001000020000000e264ed92620ea7e524ab4b9a4d3adfc42affb53df39d6855b0ea4d9ae23215b1000000000e80000000020000200000009e939da3e0b6f1c069f272481ae2afca473e7dacfb4b828ee35fc159be03de5490000000337e52eca69d694ff4e533c7414efedc681dfdac6505b60e2d9a733a89c12c830f71375447937823f86a1d4e37a02d6f08da6b8599a510d84da163b9aaa3c15627f10a1d5c62a16e2f67ce3e189f3fca59b9fd8e753ea876aef7365e94e2d93e6bff24c0571544ae2e7c0995e1a8927a4e642cc237ea1ce80d4159b9a344760a9534197d0e025ec806778943ca9645af40000000601abdcdd34433b1c379ef67fe58217a5ce1765caca654d93cffe4e712615995c61608dd0ff2afb296b7e8c06f4f6662a4458a2e37b8609667112e2a2e4adc4a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
2076	IEXPLORE.EXE
2076	IEXPLORE.EXE
2076	IEXPLORE.EXE
2076	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2076	3016	iexplore.exe	28
PID 3016 wrote to memory of 2076	3016	iexplore.exe	28
PID 3016 wrote to memory of 2076	3016	iexplore.exe	28
PID 3016 wrote to memory of 2076	3016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dpr_report.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61f17da6d01e22bc93112796efd15274

SHA1
7f6d14a8214e288bf161533fd247ac9cb746d95d

SHA256
3b3a9a10f7b4743c44fe7fbd009dd0a5a9ca63c3561e846f632c720003b53bfe

SHA512
fed7ae306b7df17e9690fc1efba4e331b2d3751046b90fb45c3f6ebe6d247db1611ea8f1ed10c2afd756f4a4838f040c911867e65f9119e40bca4d736c5b7c2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0778c42903ed70fc4ff6af47bdf656a9

SHA1
4fb0a1a5a3791da23f38e3abdf07d1737dfec4fd

SHA256
5a5a7adbc154e771fdefda9ed1e738fe6b0f4195a88133348968e05545f0f9f0

SHA512
392d144c6ed181d634983fdac0928a89522a281f6d2601fba782027066ba501acc079a550b087673c44caa674a1850295cc66219abc29699fe8aa8e22688fb97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed9019423a63bee215c49eea0517d326

SHA1
d85584eda1a80cc349146a9952f675da3b956b6e

SHA256
c3e81071fab51f5278a55108cfc55c38926eee8b035a4c8e7d3c7c449aeeedad

SHA512
8209f8e10c19625c46f7244617e286bd5ff06e9d5326595fa1bf73086abc578661da785b96493b9c066ad0364cd7caf4346dffa1ee205f837041148c13a4d122

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9f217ee278a0a99e0f66af9d7e22ba2

SHA1
1fdf083b240142aa4de0a34cb8ebbaf4abd385a1

SHA256
d9f98a9556d8de5151856d0da4cbae78adbd799b75e52a72ab7cdaeb14d76411

SHA512
d851b7f97d3ec36e8c625bdcd5418d5d2f04d8bee46bd61c0d160f9573f5b21856a12df3e47b0ff86c3d354d3499e4d5a0d2314241269241b9c171707212a02c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59f2feec1d33a5bd670898d79d634908

SHA1
93d1e28d5fb0fc889cde02141e041c43b07f88ab

SHA256
81c591cb53f0b4c4ec50d15e87c11d518d5b50c276b6636148103df66f40327e

SHA512
18b3c90a0c881848d399820e938fda101edb6a2e6e896f72fe40b30e8e5c3a95091efbe3f7d1f0ba7b47f50f4d020572ad47fb53f8b4ba3430ae61d80e2e50ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe2bd77d30d5da571913b4532375bbce

SHA1
ae0a8320391aba25daaf1f218870511b882663dd

SHA256
8e29adee4cbee833cddc24324a59ce53b675caa4dbb3e22f3c2169107b9b35c3

SHA512
725d0a93b4e34d7d6630b3391336270c04a39eaca3658419debf4b9dd21b4b5c972edd6c1fb30df583395e2e118b6f484b24036d945dd2f9e758b16185762be3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b675990e5d0aa2768c7e272f8111baea

SHA1
55a571a43b120d7826d28ca08f3677a69ffb6fc5

SHA256
dbfe627e0de908efbee266cb7024fcbc5f7b1aeb647871277d09b1418c07e50d

SHA512
48af2b57f0476fbe63051f181d3e63fb6164bac9ce710e6a7f9e5fe085da37bf23b8062a04112a40674a4e3ab035ce90d33566de4e021176231390ed34cd738d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98f020bbcb998e066149397b1cac1bfe

SHA1
981a58103842282e32e7d0e551d62ea4ba2bac98

SHA256
4e9aa94464523ed6366262511b21ceb1fac32270ad326fb54362bd9f1c3fc394

SHA512
6ff8a5b8f4a444eb5eea1851c67c1f3da90651270d0e809155a56d3c180caaaf6b0e4d15a104261eb0f784185cc5babf92c2d941eecb6263e3c33d367be02669

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5aff4765fa7da920055062efa8ea9f4c

SHA1
ac17f6fc975594b97b1a2139f42db3086f1aaec5

SHA256
107626bd6481ec11a6a250bd37ceba3e8321cee78bd81e489aa8dbb6714a463e

SHA512
093ea11cd162f89583660d77e6f27bbf42c7171e3e3dbe8583394e47b2b49b7493276c8ba04e511a0a6092a0d84ab28e758c5197834b820158c374fac3d5d3fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA5D9.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit