636f6e438f0747a117995a9c6bf15c95fd2f4ba367f5cf5430c6524e615eed53

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09-10-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dpr_report.html
Size

1KB
MD5

054e373de9f9a37790eaa1769b2ab108
SHA1

6305078cad8cfb75a4c79066c03a742601be7f45
SHA256

f9689be3f17411447ea7ac066654cc65271d5552edc55b186b33797af5e6813a
SHA512

3f7c13292d3ccb5cdfec2892c6e3c2f1746614ffeb71a1b1b07564082bc6377dd655ed315fcd4ab5c67161e242c5ae2a4bff669b7e029a66eae99039c156353e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403050723"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a71400000000002000000000010660000000100002000000007d393854bff1ccd95ac4cd778fb7ccd9e4bfb705bb8bf819d48128fff4fc889000000000e80000000020000200000004e5cfb643069e79f6b509c0f803b7bc1b5208bdd7d8f18dcf68e173f2a18efb0200000007d3bf544c3504a2a17ff983e449ec3907e15d211e513097c182c9175c9008ce140000000f04e5fa16b7cce7da01ed574d276d8a7057f551f176b23c568da1d26f5f785e1cb6b3b7eca3dabf284d53e4e932be4b79f58a7e7be45705b61fbf298593ac0f0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a7140000000000200000000001066000000010000200000009b59bff4f68d19a75713d174775e11caadb08f60cfea53e885fad7d1d0fa4b5d000000000e8000000002000020000000fdbaaf4696538147fb429d35a5631cb284864e99eb4c69bd2925c9579f49f63f900000008f8661c0e4765cea7d4a624ac4ec3801f785788d2a2adeee7f9d1e210a8401dcb56a79fa44272f7185fa1c50309bf8f42c103c94846e024d47e25711e4ce7135bea621bbd0ae029c53f29620fa7899b4bf92e823e50b01be431ab7410be6dc67c3b6dd1570c25b0f3ca1b7472f98b173978f733cd82d7c532e2cfa635d8a3c6099f79fe5419687c0db37e8b51be2ccf2400000001590b169b50a54411437692e435fdc5df7923e3dfd08ad0ec08f36862f18913af135360bd08452586103b075cfa965f83f30b65cf1d4212dfcdcb987dcad7ffe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51AA9A01-66EF-11EE-855F-5AE3C8A3AD14} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60425f26fcfad901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2144	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2144	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2144	iexplore.exe
2144	iexplore.exe
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 1200	2144	iexplore.exe	28
PID 2144 wrote to memory of 1200	2144	iexplore.exe	28
PID 2144 wrote to memory of 1200	2144	iexplore.exe	28
PID 2144 wrote to memory of 1200	2144	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dpr_report.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b89e14c87417e9237d4a0115434528b

SHA1
2f047e8107eef97eb8775cae5ede7592e61281de

SHA256
c80b390a19b345346c14c36f2ca93430c17085675173b14047959ccbf4afdfe6

SHA512
bb51ea96821ade9e81b7ee3066040f0e8d702500336a0c619a7ece9dedeab5fc76f2f2580ef714ad353aa57b777242bb49055fd6eea2a0c2bbd36cd1866dabea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cdaf7a9ba45ea3f102fa164ee60601f

SHA1
923f8f7c44c69cd24ceb46029de855244111a015

SHA256
45455f0cd303521b45023b1c638ab088ba16928f2fdc5b4860f2abce218bb592

SHA512
f2e181b9c11619ab57119821726b8e29fca1dfb48e4a068f6136e02397c1c519a5bf248e8fcd3f5798cafe6ed180bc26136d548ddfb630eee60074e3d91ca91a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0956d01a41da1b7331a9101db17262f

SHA1
00a5df479dd4b323eec7d7b59091ecafe8a42e82

SHA256
dd7dd11fb2aee3583e742716751f740332e4574f9c6a6d79f924d543dbaf0ac8

SHA512
0855134b3202c0acd290fe886451667ddf714e8538425c40e74a63d5c3375227ea5beeb606801ee8d36f1fdc39ff436eafa4430d988378b08943a9729cb6c9df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b57ad24521a93ecead97861b490ac662

SHA1
18d75bb4c183ef4335c8ff4be60df55c7ae12581

SHA256
3c24653380f7b473f7017573744ec1cf5efffb6c70d0d0fb37e93f899aa1cbdf

SHA512
96db769d060ffb4aa0d1660002b35cf7457d90c38039cdb00a35ff1b015137c61f1f3147280b7ed3fa14aa3b07fe4e906e8a00c0059ec30245ea68cced89cf4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d411b8cf101946236991013b9473cc3d

SHA1
a12049007cd89f9317fee4362f5fdf0cf0632c1a

SHA256
e6a28f058eabb9f8088aae779a5299a68fb65d39d54295352483ca02016ce2cf

SHA512
9c832e08b540ca0735c11db11a1a65fd0ec075fda0c0ee04408f82dc2fcde70f40210d2297cba180fea06039be33a6353877f8540a3345483f5d00f27935ef7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f8edb534bc870014242093d58f5283a

SHA1
c92bb66954b4ff20baf57a8355257ba4a64ad8bc

SHA256
11ad04181be204e22a8f83499a857a3635dff962d2a854eb6791e2ef0c8cb877

SHA512
48ccc52cd69f126dc8e3935fdf6f91eab6e4e8b938f37621189e4cd2b926445a296e852fabff83bfe563778be519c95c84a59b9e23fae83b531a6904941df6d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46917cab98c7471ba6e246e2c30e28fe

SHA1
29274fedbbdd1ed9c4d8a427d2659d73944abde4

SHA256
2b34177729918f8b0c9f550e3caa6ed0ad2cbadf24ac2f5737e42843e74716d3

SHA512
199cd75831fbb88f8f2db989bba8880663344c5c3dfbcb26a719970d8c6cfc675494e607e42e3a6ffabbe46053d37e7d009c4072265b49608283a1588c3b1069

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
940654fbd3e80e0d72e09186c6cf8d63

SHA1
05c0d1a6f2a25af93daeb92dfd517fb9e16b91c0

SHA256
c2962771037079de0c787aecab751ac48079881c35d0fd4ab5be82fad09ae36a

SHA512
2c66e36f36efd1d38c6d241993c649fd0c4db92a6f5e02302f4c8a70a8fda7f1fc0a816c8aa5f55b21770f558baf19fc8064ce0627dcc5fc00e9a396f33591d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0682c139e083076b3b02c5e869e1e75c

SHA1
7f85747d1f3ae9c1d3b4bd57f48f254725d4eb91

SHA256
d958c36cfc3fa98f52467166e49988c546c700a8040542b28e20bc4921487730

SHA512
69821c0df1f588cc58a54be0f25cb64d8fcd8cc5816e016619a6b216a32b1dee1eea33888ae615089aca0c74b443938650b2b91e782a9526bb9bdd3f5f9d113c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6107.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar61B6.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit