hxxps://rb[.]gy/43wuw/#token@pcnet[.]ro

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2023, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://rb.gy/43wuw/#[email protected]

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3335425034"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31037308"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31037308"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d171290601af624a8835767cfe57eb9400000000020000000000106600000001000020000000b4c5e05f5cc54fa438084492747972758b879b6f5cd65077200b327019450579000000000e800000000200002000000094a711db6f3b27592c36d52da170b9ce2ef90a8a3bfbac148ff803f459d4dc162000000018b2121d53915c64fe6f797786467a6d2bdd47f686e783ba57cc488647fe4b45400000003374a675f073b222f5ede865fcbd7dc40e8891ee5b473ea8fde6f002913ebccc759b87f3435f91e368148e02968fadb0acb64b5457e36b39ba73a2da4778a221	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3335425034"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F1F93A18-036F-11EE-9156-DE61172DF127} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "392713958"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31037308"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3345581317"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e029f6bf7c97d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4124	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4124	iexplore.exe
4124	iexplore.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 2456	4124	iexplore.exe	83
PID 4124 wrote to memory of 2456	4124	iexplore.exe	83
PID 4124 wrote to memory of 2456	4124	iexplore.exe	83

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://rb.gy/43wuw/#[email protected]
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4124 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
2c2f0d2018f0255ea3c9e2f4d7a4ce31

SHA1
1ead0237611fa29406d52967e76eda04853c30af

SHA256
53b6b36a8a8196d9e59a40e110ada8a8017a478ce4b5cc98f42f40d25dd496be

SHA512
e62b6eb0dc24d77a90fdb5ab7d4fa920e2f0874042802430caa80ddf00011e7fa56cb6aa1d26ec4bbfbaa29b04e8ad7256959c36ae4ef8eb4a31a4d2eb034939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
6babd3f46249c5fd91a4b2654fba1f42

SHA1
0a1ed7f2bfff9acae301a845fbf07004c859b786

SHA256
e504e83f7f4b1e26b80781e59fccb5d6116a1db6bf335435c2755e442552aedd

SHA512
2eb696551dfd34efdca591c3d02f308ee26aa328187ffabad085532267f41fdf1a117f02389f497a7da30359773c4df41aee946b97fdf8f7c63d70b06f68b411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\95fmw5u\imagestore.dat

Filesize
34KB

MD5
cada68795fe6c0b84cbf7bbe30a93c5e

SHA1
6350d3c1a1bc4c929a48323492702ed4a626ec01

SHA256
9b0ad35623eac89f39934f55012dd2c6e7a0b8899288c46dabc0069a3a4ab021

SHA512
1ac5c37ae97c856f104da22c22d38265f234951b8d9275d46187f90f32ad29f7844554f75bd9397b820ff2d26d3765a12d15c3ac9195fde06a5abb22d8c910dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1B83N948\desktop[1].css

Filesize
68KB

MD5
19847a7ed04c0e35277a9fbeb4293779

SHA1
784d7a6bd820534bf70e9af2c5eb8b822bb0bf4d

SHA256
537699d2cd572f76baf175a598041168f284b016f26a9e94cd715c7bf95dd7c5

SHA512
d4c94df19df84aac95c7821a88d819e0e0a76417486153d5f6fa628049197a396d7ee1dcc63dc5e854607bbca00fb11e3888c914052a78a996bddddbb9ae65ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1B83N948\jquery-ui[1].css

Filesize
40KB

MD5
283a8860d287f25535e0d42266f62691

SHA1
d4621ff863cf3b23a02923a9a9414a83a3f85323

SHA256
9e6a2f457e5c0c9619a2226bda332cdf8cae20bd9db822347506e044861a67ee

SHA512
6294baf5db3e89286ae7fb05a44fd52daecf9cd76cd20e9f007860092ae67fa4d77d5a72941c6bc1910db3cf4784c7c4624d3d415192fea5eff398053dee04b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1B83N948\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7H82VOZS\favicon[1].ico

Filesize
33KB

MD5
ef9c0362bf20a086bb7c2e8ea346b9f0

SHA1
fc3ef03acb552dfe09279dccadd99ba8eea5217c

SHA256
20c30fd4340308d6a4ab222acae353fc2460793ac76645bb1ef1d9d61f4f0a9e

SHA512
f2393626825e041755d9bd7c74f73be658d6e7febff0e39a97b807f30798123d0e75db1d5c3550ddf885fe8ceac375c2aa900f8741ae25b15e18304fa2295779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7H82VOZS\framework[1].css

Filesize
136KB

MD5
ffc234e210c2e924f00ada4401d6938a

SHA1
3e41f5d097f2b1d734beabe657203850b915f942

SHA256
fae44f1c34d84b05c87be946f754356f1d8659b0f295add5a7fea26dbf145ab4

SHA512
0a016b37cd9a0659e152e126f5139ecd33fa9429f54da1b167c8ebfcd4f63a55d05b9bc6c7519bf918adeff980cd0acb856f30d31c1473814c6d0d26fae01fd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7H82VOZS\jquery-3.2.1.slim.min[1].js

Filesize
67KB

MD5
5f48fc77cac90c4778fa24ec9c57f37d

SHA1
9e89d1515bc4c371b86f4cb1002fd8e377c1829f

SHA256
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

SHA512
cab8c4afa1d8e3a8b7856ee29ae92566d44ceead70c8d533f2c98a976d77d0e1d314719b5c6a473789d8c6b21ebb4b89a6b0ec2e1c9c618fb1437ebc77d3a269

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JXO1ZP0L\bootstrap.min[1].js

Filesize
47KB

MD5
14d449eb8876fa55e1ef3c2cc52b0c17

SHA1
a9545831803b1359cfeed47e3b4d6bae68e40e99

SHA256
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

SHA512
00d9069b9bd29ad0daa0503f341d67549cce28e888e1affd1a2a45b64a4c1bc460d81cfc4751857f991f2f4fb3d2572fd97fca651ba0c2b0255530209b182f22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JXO1ZP0L\popper.min[1].js

Filesize
18KB

MD5
70d3fda195602fe8b75e0097eed74dde

SHA1
c3b977aa4b8dfb69d651e07015031d385ded964b

SHA256
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

SHA512
51affb5a8cfd2f93b473007f6987b19a0a1a0fb970ddd59ef45bd77a355d82abbbd60468837a09823496411e797f05b1f962ae93c725ed4c00d514ba40269d14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P8NMKCW2\styles.min[1].css

Filesize
44KB

MD5
893ea1a1dd9f794982bd188ec5b5eb24

SHA1
e70489a26c98482f925232fd02fc1da24f9818d2

SHA256
fbe745f1fee57716424f9c2849290eee654999388594d8b1b13e75a0a3e8cbd7

SHA512
052ba9f8c3857157dd48ff2744c30e699bd7649ab08894735e780fdf7cc24f8325e9a7f68e4ea96fa5eaab14bc87a0f571f20793381e82cdb184f2064bc80af5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P8NMKCW2\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P8NMKCW2\xdesktop[1].css

Filesize
28KB

MD5
6597a7cb410aaae59666563cf3a3420d

SHA1
4b5861bf0a82f478b72cbe93fd8facb59b42fb02

SHA256
da78c7fdec13d5db31d388f7695ddf218c9af00a505899d2d416f2e31e3c48f7

SHA512
b07fe4f3a1bd55cac12c7eec26afefc61b7e7ee73618d0f108d606c8ded7739158cb0f4b4274c6441dcb6ce13ee0968e346193a6c7089431c4c60d638f084822

Download Submit