hxxps://github[.]com/patrykq9/Metamask-Arbitrage-Trading-Bot/blob/main/setup[.]exe

Analysis

max time kernel
67s
max time network
131s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
10-01-2023 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/patrykq9/Metamask-Arbitrage-Trading-Bot/blob/main/setup.exe

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1268	setup.exe

Loads dropped DLL 2 IoCs

pid	Process
1220	iexplore.exe
1220	iexplore.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 901109262025d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59A783B1-9113-11ED-9F99-D2F8C2B78FDE} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04fa8332025d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "380139756"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb800000000020000000000106600000001000020000000ee51d2846c4931a967a13d4a2b562765930972c06ebd8b139e89268fbf9b0cf8000000000e80000000020000200000003beac117ebc8a7d22cca81e872c079ae161df144f2549e56d38921ee5d3e3f91200000000b301f5c4b57762a927a1fe4f0cc42a44cd0bf6850aa0d125d783df026396d1f40000000152124a4c0ffcd71dbf715f109ad98f893c0b3982bfd820bfdc880eeca5563dc2f0181b249e21439a71d6b0a0149873594ff8181e38bbe5e59fe3ddca57f723b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb800000000020000000000106600000001000020000000d74197217b7c7c386d3de8b3fe53906af47d5a087baac1086b2dfe1e1d5658d4000000000e8000000002000020000000de406f84158d84f8c54da45c0ec119b9a346a709ad3efe7e6ecfa574cb815093900000003733a764a7aec897561d6b6babd13e5ac571bf76745f7a929fd2a53c79ca9ec3441e89e04f5414f9c2337872409bb79fd32cb6560dc9ef5313a9e12b75fe5b6f1acc27ac5782db040c6b63e20f17a09fb7c95e1d89c905bfe676c5582b8ab9602a3fa8836504979c0d16676cff20d15c9446ed22f0990265e1df45c1456e735464c4626e6de958edff827283d6c10e4040000000f6f78f9622aadc834d2b0eee55e7ba0509dae47c908b3938311f1a4343aba04a1f4fd27bbbf4c5151737761b8b4b65ecb3d4c6035bde2ade7058d88a85f16945	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1220	iexplore.exe
1220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1220	iexplore.exe
1220	iexplore.exe
1160	IEXPLORE.EXE
1160	IEXPLORE.EXE
1160	IEXPLORE.EXE
1160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 1160	1220	iexplore.exe	29
PID 1220 wrote to memory of 1160	1220	iexplore.exe	29
PID 1220 wrote to memory of 1160	1220	iexplore.exe	29
PID 1220 wrote to memory of 1160	1220	iexplore.exe	29
PID 1220 wrote to memory of 1268	1220	iexplore.exe	31
PID 1220 wrote to memory of 1268	1220	iexplore.exe	31
PID 1220 wrote to memory of 1268	1220	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/patrykq9/Metamask-Arbitrage-Trading-Bot/blob/main/setup.exe
1⤵
- Loads dropped DLL
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1160
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PFZC0YBM\setup.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PFZC0YBM\setup.exe"
  2⤵
  - Executes dropped EXE
  PID:1268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e4bc9369e3999e5daff5dd965cb8bdc

SHA1
fa7745098993496c184d99c33fc40ae0c31c6a3e

SHA256
67fbb84dc616c71216565aa6142d54a14876144cfff98470d52a8b8209766db2

SHA512
c326217dc72f2e0e439070b8c41e153c60d4e8f16ef7aa1a287f8b2fb2e4aa802d8dbc11d341d701d5d46fefef1fad037bd96de95788fbc4f87d25b5f9e52dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\mlf2v8h\imagestore.dat

Filesize
1KB

MD5
175f71a04f49bee52cad92167e74ac78

SHA1
d95d10ffeb5ff84a16596a73ab2f46398a35c135

SHA256
51c62d5fe759cb777961b8a91c6f27980e06a851c9a2f38ed0c48e3b46a4c3a2

SHA512
418d1f25712323d76b8a6187a40d8a62deea075d9fe075de3afa1e2fe9cdc9e8f07fa15ad7f4cb409c3c160a0d5657bb97211d039f37c78d0899105225771169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PFZC0YBM\setup.exe

Filesize
3.8MB

MD5
cdfe1df11ea71c1b9bc1b865a8b90960

SHA1
d300c5a7d8e3722513707ae5b82201db231334c9

SHA256
a334e628d5daf5fbce24680d8db0f7f86963ca62922657c5d1b271ef414285a2

SHA512
e3eee96b51031b1d133c71a13a2ee4945764f82376ab061d6e85feb6f61a5d52c52c0a82fdb9dea9298279da9e864de9df1a975a380e2583a6c9efb3fcdbc24f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PFZC0YBM\setup.exe.nzxmaxq.partial

Filesize
3.8MB

MD5
cdfe1df11ea71c1b9bc1b865a8b90960

SHA1
d300c5a7d8e3722513707ae5b82201db231334c9

SHA256
a334e628d5daf5fbce24680d8db0f7f86963ca62922657c5d1b271ef414285a2

SHA512
e3eee96b51031b1d133c71a13a2ee4945764f82376ab061d6e85feb6f61a5d52c52c0a82fdb9dea9298279da9e864de9df1a975a380e2583a6c9efb3fcdbc24f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\XCR3P3BY.txt

Filesize
608B

MD5
548addf7d82acc4a8f5ebfd3ca0096f9

SHA1
9568c59c795ee0a812cded7a02efca85236b7ddd

SHA256
7c53398e62908e05ffe7126a994ef0cf5bef260c55244c6d755f0a2750ec97f7

SHA512
372cd96811bba02589cea40501cfe20f32c569de612ec0d4092c6f1874283d56e7206ecfc8a2a0b45f9dd746beea35a83f8dcee7357d3ae5649a9d946aeb8b7c

Download Submit
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PFZC0YBM\setup.exe

Filesize
3.8MB

MD5
cdfe1df11ea71c1b9bc1b865a8b90960

SHA1
d300c5a7d8e3722513707ae5b82201db231334c9

SHA256
a334e628d5daf5fbce24680d8db0f7f86963ca62922657c5d1b271ef414285a2

SHA512
e3eee96b51031b1d133c71a13a2ee4945764f82376ab061d6e85feb6f61a5d52c52c0a82fdb9dea9298279da9e864de9df1a975a380e2583a6c9efb3fcdbc24f

Download Submit
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PFZC0YBM\setup.exe

Filesize
3.8MB

MD5
cdfe1df11ea71c1b9bc1b865a8b90960

SHA1
d300c5a7d8e3722513707ae5b82201db231334c9

SHA256
a334e628d5daf5fbce24680d8db0f7f86963ca62922657c5d1b271ef414285a2

SHA512
e3eee96b51031b1d133c71a13a2ee4945764f82376ab061d6e85feb6f61a5d52c52c0a82fdb9dea9298279da9e864de9df1a975a380e2583a6c9efb3fcdbc24f

Download Submit
memory/1268-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads