hxxps://guidesy[.]net/cs/stahnete-si-aktualizace-z-cervence-2022-patch-tuesday-pro-windows-10-kb5015807

Analysis

max time kernel
151s
max time network
174s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/02/2023, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://guidesy.net/cs/stahnete-si-aktualizace-z-cervence-2022-patch-tuesday-pro-windows-10-kb5015807

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C33AC8D1-AA3D-11ED-AA01-6AB3F8C7EA51} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002316401862008547b3b1d5672682390e000000000200000000001066000000010000200000000fc7a2c02a1d594aa385aa48acd96af583493c88a37c1135cbd5712e7217f47e000000000e800000000200002000000010393f10f8a1f5b94232759a133ce3f9b40b52d817e0dc93bea7bee2098ad26a9000000006e4bfba650562c632a6898fa00877258cc4e88c5cb878c2fa60f329b81cd3a2f6f8a372af8f46127b2c8c6b28a75cded7cdddacc81ff5587c7fde5b511284a8b4da7dbd5eed0f31ae948f17461f13429d7794a901599fd8c6d277a126317bf2b72a5c91e060a0d06b9caa96b560820fb3208e2a33cce436b6e62ba9fdeaebb607a85f8a49cef4c8be6e0b1abb97040c40000000a3cd3df3ae65aef9ec5677ec5ed537c4fc177497dac0ba5bd60ad2039685a62faec39c1a868f3dc5a003876c2f30e4e90b5d7f64b0ced87dc475a7908f772dfd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002316401862008547b3b1d5672682390e00000000020000000000106600000001000020000000a6aaea4f4a865d3c2a6f3afe32bfc86f04deeb8c0912d4cb57192c22dcde7320000000000e8000000002000020000000377104651efe2083a6e48c8c4a78529df21828f60a63882be7ed53179ae8b23320000000887fa3dcc0fe2b0f92cd1aab561d63bbd16e7990d507db83d8cc4046556306024000000008274b0cca6a0d8ad752574f4b166186e8b0c50a1dacc4712d4c2187a44910576c0ab75d3a6ced9ccb2e0195a21fdff144ba07cbf00fc3f45b6eb1d80e77f213	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\hp.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\hp.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100aa8a74a3ed901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "382906777"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1204	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1204	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1204	iexplore.exe
1204	iexplore.exe
616	IEXPLORE.EXE
616	IEXPLORE.EXE
616	IEXPLORE.EXE
616	IEXPLORE.EXE
616	IEXPLORE.EXE
616	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 616	1204	iexplore.exe	29
PID 1204 wrote to memory of 616	1204	iexplore.exe	29
PID 1204 wrote to memory of 616	1204	iexplore.exe	29
PID 1204 wrote to memory of 616	1204	iexplore.exe	29
PID 1204 wrote to memory of 1692	1204	iexplore.exe	31
PID 1204 wrote to memory of 1692	1204	iexplore.exe	31
PID 1204 wrote to memory of 1692	1204	iexplore.exe	31
PID 1204 wrote to memory of 1692	1204	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://guidesy.net/cs/stahnete-si-aktualizace-z-cervence-2022-patch-tuesday-pro-windows-10-kb5015807
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1204 CREDAT:472092 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
f4517a40ba8df40896a94ee5761e9dd7

SHA1
98818f19a1ba79062c4b040c6de3b4c07821226b

SHA256
b35fc87e9249c7d1f1dd4686257648031b89acb678d14ee8dfbf782b79b1fe2a

SHA512
adb8a4e6f5d6ec3cfecc100f47b2f2dab9e887f2ffced2d8c0d233750e3d1d8d6c94812b4165ee35c361fa13e5f270459976167c82608a737cc9c3f89acacfd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F

Filesize
7KB

MD5
60b9eee18f0318ba56e33c41a80e4620

SHA1
94f75712bf7ea18e42d6eb3edd188bd5107bffa5

SHA256
b3897abdc308eb2f09af2f1146576875f8592116abe59b487eca11be14a147a3

SHA512
be4786c122ea9fb34cc641ac46150a3e2474a2110a94d3eda46efd4a3948350a10bf60faf5f9395c880efda418a399bc892d07289e2d0013155738225095aa35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
5c7b55357738c5549ae271c1c4f21b76

SHA1
d674f156d032eec368a9737fcb9aacd7425fae92

SHA256
3aa8562305faf974e8a8d21e7f9d5e68abcf7e884307dc19fe8add89fc906694

SHA512
a9cdd6521fb97887db36cf0e96a044b6e632f53997113f00e6dd32ad2ef032783b56ebe4357d5229e11226e1f8a85b3fef50b76afa8d166e9d660474f03bb5a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F

Filesize
232B

MD5
638f61a98233d678db20c1a5cbe46a21

SHA1
32239286afd8478f9dec551b5080949c2e5d3de7

SHA256
d768e92c695b7d2a944cf5abb52fb0c202de894a99842c4fb76bf7d20cd59509

SHA512
1ffaa937d5ab0a64c263b7e40b958468a2be6e5cf982ccc852fec456e173a99a5d40aa9773c019d58a4b8f578a50fc67de7a690369f2a7665fedb26fc521f3a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db0a16f30492f7c5da0b75f485a0e48b

SHA1
3c784e45e4f44aa25c328fb37ab119eef3d9694f

SHA256
333bf7d87f010a4a5fdee69584a124924d8bba2395a5f0fb833f6efa569bcbd6

SHA512
6ed1d2dbd3ec5b17876f42e184a2fd90ecc8f3ae98c34b4dd1d208655d255808cad270619b45fb1e5d73387761dd9a6fff0998b9943554e700a2436d13dfa9c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ad2018eb1538e91c661ec8e48f66e1e

SHA1
f9967e95a4a9c56029a4af2ff7c39bfd284af365

SHA256
aafbb3900e19701825f6b5ba0f86d47197cb8767a38e93a744c4e1741b7544ce

SHA512
8cd6c627f683ab6b75d036d71d55ae4ebff63207c875452fc1a926467aae2e8a19c9e0e2b6c12f3937012724edb7d50f79534be16c27bd03bb8728b9e92f6d56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e5aeeee48a3e4b8b2c06abccc08054b

SHA1
f39360849a1ff043647bf7d2027542c73f07ae09

SHA256
a4db95ee73e579cd9bab4639322236cf12ad775d3699e67bbd235adb633fe93b

SHA512
3f8072b3395608966c46c876bee1ffc9c7ecd13d31d1da6bc57106253da624b86131e0d95c336590dabbed1c3d8b587b79b9b4336d0223fbeac761d37ab0ca56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
0445b9a5e2045350f8714d196e014bde

SHA1
4d3bbed6bc794eca1dd55e200d5b36474d9859b8

SHA256
82170e5b9b98a469016b81952409519eeb06ba787c9663f7d262f25dcad0f4ca

SHA512
ec140474675d0694fbfe61540fe3dcf6f9ce82d30bc2eff177cfe91604fdd5e6de5ae13057477a1885ebd81760834b92ee69438109f256833a32a3c6d008accb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
efabd0f49283ee888e2c4693237d30eb

SHA1
8015e7a236fc5c0999713d7213aee2bbb0170809

SHA256
f6f416d117fa9808df7b8ef9da6989efc6418cc5547f25e4c36e4e9b26a937c5

SHA512
b67fa61a76e0f605243201d0527817d020293cbb07d6cb4bce175670c4b7903b447bc6fd616fe109cc3ae398a0e9a142abcafe42898a069797583b43b0957bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\tcz8fqz\imagestore.dat

Filesize
8KB

MD5
84c9dc4f93480ce4ce0d7e29b11bdb4c

SHA1
13b3d423750f4c32aa1f412be117869a28d5d63a

SHA256
902a28c58bb8a84aa2327422a3d577b9cc60ecf6e874f472af8e9048985e82b4

SHA512
3282f0591148ff62c2d5693dee76a8abfa47aed1f584aeed847d20df032195094fc00e2dfc4971ecfca4b882231f2c419b8bda4cde2e97113b43966ef1dc3db8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6IU0IXQS.txt

Filesize
245B

MD5
3f569f1a1c56dba45297398735a5903e

SHA1
0fa370e12f1e1feb37c7936c74c2f0e831b4c9d9

SHA256
4f6cda942698934744bbe409e2d1c9a9e13cc68545abfaafbe874f1611d698be

SHA512
6d8aa75a2a14d5fddbaeb78f6adf4238c4156ef2e7871a03ac91d11cf8c414bd00f9ffeab4250e58369b79d19e5e4efac8d638b4135dae4b3308c5ed24aed30e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QHN2KP87.txt

Filesize
608B

MD5
2d6c79834ba44550df359604b144614c

SHA1
20de5e5d1fe6f88721e602964e2f9f76e091a13b

SHA256
d6905fa861c76a771605234553f1240d05838864c6dffd913dc820d6adb66ccc

SHA512
8362b2db7ec9078c5b6df29aa47d0df51d00d855a3d46de77607a89775d25fcaa662bee4abe31cdbe6076c5a49d0c70764a3ebc8e750a4f31720d954cc985e2f

Download Submit