hxxps://web[.]archive[.]org/web/20240102154952*/hxxps://limeerror[.]org/PksZxJjJ

Resubmissions

11/01/2024, 08:17

240111-j6qrksdbb4 1

11/01/2024, 08:10

240111-j2ztpaccbk 1

Analysis

max time kernel
138s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://web.archive.org/web/20240102154952*/https://limeerror.org/PksZxJjJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04a3ac86544da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000084c696ac39ebf49109a3dc6103f56241811cdae306c174ec2350a6ce33896666000000000e800000000200002000000019db01c8fbf1cfce2c29665c9e32d7d98ea7576700a60bb5face9906bbd31767900000009e331cc893ccbb7606e29edcbada7edd249196ca6324b42bce52db8d0acd84c837d6a427b9e4300c8a3f9f6cd35926ea5c54eb9368caa5d22939c9aedd138e97a5b653e91e7fdf6308d99838b4f16abd8f752e76c5ee4067b94c6653bf2dbd4f8a18413ee14cc0b10329463d4cceb893074892b8779f240045bc9258decd4d68e028cd3f16c03252c013ca50c4c944e0400000003b0470e2158f052c6873cbe9ad40a21d7e3adb3eb719e0e0f629f75d8d33d739dec0bdf853d21992ecc71048f33c2219beaa43953c66a252eb1f2ba2ffaec343	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000036acc74dc8cda7cdc7157aa405d625f26265c1f5b2b5c2904192858f975f0069000000000e8000000002000020000000cfd8e6542f0613d75a84b6bc8715989d066947e8c316651c3e7845a7967f6bb320000000156e4f70ff5a0d388066a5edade768e1dc59b93c7fa2d458b750f96c7e8db68040000000da5586287de0934fd006d03a530d4f451bc6699bcf380dcb8310e6caab9576264db0237654dc17133e24dfb9dd14e19d8a4507643dc5d57c91016895e4f33c25	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411122517"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBAD5541-B058-11EE-87FB-DED0D00124D2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2216	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2216	iexplore.exe
2216	iexplore.exe
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2052	2216	iexplore.exe	28
PID 2216 wrote to memory of 2052	2216	iexplore.exe	28
PID 2216 wrote to memory of 2052	2216	iexplore.exe	28
PID 2216 wrote to memory of 2052	2216	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://web.archive.org/web/20240102154952*/https://limeerror.org/PksZxJjJ
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8075ca73f52c817df51e5351606885cb

SHA1
14efe0f6886d653312e18dae4d4701af69bfae9b

SHA256
7069e661519af7a397736b03b19bf1b56eae1da5739574191011c58e10be39e6

SHA512
098472cbfe86af2a14285f44ec7f45dc8fcbe0324d0541bcb0ce28e66fafdb5d4a7e25fb9d581d330ad7beea6abd71247891ff48cdead9f3c09f206af627f47d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8034635e40bff1e894563142f8700689

SHA1
980119c36514ccb41f01c4dd8b0e835ee3ac2d7e

SHA256
3922feee8d0d5013f535c664a814be7ff10033e249f082cbc2a8e18583c659fa

SHA512
4893e3c5c6047b35187734aca6ccc18fe4485c930ade705bdefed1da710dd08302502c81234d101f94febf615d2105ed7c2b8f7bbae6a6235316eca0aefa3528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6b61ab0fe84b4e8f8f080c48e5dbd69

SHA1
47c4ff9059e117a5380319b5b99d5494da9f4ebd

SHA256
5b0266984b9152bc614e64775ddca3e1f25096fc743ddf64d303b490dc298b21

SHA512
232f6ad21f750515fdb4f87c937cefc16de15d1c27e5058d585a6ee6142b7253b723364c6d459acaf720d0b816fd02793ad4c06e3da8c0bfc769f12d5692c001

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28f9aabe5dff2a194bded3a1d051e57d

SHA1
b01caf7f599e7abad50ab0798f6d5e292d200da9

SHA256
8eb363fac28b384a9571430fd73d2dd7915530a9dbcd9d737efbe981042d2851

SHA512
2de4e1df85b4c6c9fcc51fb2627a5b93958fdbf1ff3f44601b1784d903fde90895c3c0fc67e6e9c246c9937eb407280187c04f49c6041035e21ddf3b7adfe163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7aef57ea039da57e0a00f1b3a902635

SHA1
92b6c8ed154d33470bfee7756f21c087eda102fb

SHA256
8ef9c3c5ff56dcb6be2ba9664c28486d76b8e22e657a56663847df7e71d803be

SHA512
6006ba0df5a1a2c51433465eb923ff6f7f31d711e98b8e99b0081abb39a2e24ab161e2c5f0ba6670b4ea59459528072bbba6eb48d4553fe45c0f6c6e4a388f3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8452231e7152b765f4d525c871b357f

SHA1
c8f79f46d7da19e67fc37cde5e32d073516d5a30

SHA256
86f9d2a0a0ba1502622e8eabdb1fca20179be2263157f8f99355891a44eac58f

SHA512
46f23feb36bc243936c056d09f680de27cebbf6f16ab83ab61274d2285fe6889ea2e838246155aa72853a90a9b4c0ad9946d7562adb98c9f5a80361b10b4e83b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a83f73d05004ebefba10841170fb7966

SHA1
e3b81384fd1692962c9759eb945c0bfe435bd5ea

SHA256
e4087c7c9d9c906fcb4f0449840002aa3ca49be6f520f6f07e081e4714820862

SHA512
598fb823dc7fc83eed2cdc095105037be88d7d40f426e15bff084c5dc4c0a197b3e52ff0c6516cd66a870d695a70b4abf64be9c2ba43afc5b3783290df2bc225

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8be973ca87d6d02cd162cc24dc556302

SHA1
bced79876f5357531a8eeb723cf4365ca75df818

SHA256
a1c7f45ff0549e00614cee76737a03d24dcb55c9d2435eb14c50894f10572932

SHA512
de26bc236ee5f01273f29e6987754cb0681666c2f907496afe01bb1d08d3ae66fec82ef17c278d1ee6eefef95aa1c0afc23c5e42fe4ce8b329b8dcf907ba4adc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89cbe40f4cdacdcfdcc059be4addd40c

SHA1
29682ef8f72b356e0b74901559b1804ed1ff34d3

SHA256
f55d102a444d0aec2f688d56f4fe216f97755c964fba8a5bb5cd81a7abc5c291

SHA512
643e8063b0170efcbd00cc52c7776a0caad218581416417684864c687963180ece53d2a9cf61f0cc60214d3fdd4d21436f0d06726e88f50dbbac5c572a8c94ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ac29241de9637d1a74a271351d739e0

SHA1
07ade4fe2edc21660c4485ed0c61e9587f754aa1

SHA256
8b104c293d06ef7d3c50533d87aa04ed7c3cdf9b72158e681e834a3f3444acef

SHA512
feed986f2687af7cc08441de42b85556d40bf3f041ab89333e5a5c2084d7f621a31f75f6aca80dbbeb013f4f29c1b9bc064a0e751ea36109d8ca9efa0eb7953d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16c97d03f350fa26e3e3698cbe334fa3

SHA1
597376e828a38bd66a12c56c7169d14f94aa757d

SHA256
fae7ff48ddcfaf7e2f10a8edb8a594ea0cc90123ea3d0d35fb201749fc036f24

SHA512
21e5e60521b8973d50e3a98a8805ce33360aa46a885c74ca040a24ef518fb754aa7beb25feb70c6911b976f6b58d9974237e3d760a0b5e9f833908e0357edfbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
948ab165971b2264dea6d483b7209955

SHA1
88ad8109ffac7bae5393e57b87297929394e61bf

SHA256
8c8644fa41435a43cb5e890e826849c71fba214e3d400c2853b9a099d0a4d448

SHA512
cbd40d529463cfbd3c926cefa336d14ced9ef51f0f5495742199568e82f3eb14c17326261ce9158271861770c33421990734395143aa07618c7193b53f6eced5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4126eee3eb3a2595526be0ba157571be

SHA1
9d60c27ff240d1824b4b36ea560448e92acb953b

SHA256
158a9744a5652f9d94ca23d81e75d4b0e2859ef0589ab18204161ad5e20e722b

SHA512
73d86e1c1222aac8dc33fa27c1f380dec70c2b8ea580f7da614509676a9fe6a8752bb6e44d50c6244b2360298c5bc8f421f81a02d2b19ea83ad074bbe580bafd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2s0hu3f\imagestore.dat

Filesize
4KB

MD5
efd31335567e4963dd2bf750cb44a3b2

SHA1
0330a10235fc79799914e6f1c4767cbb18df2b18

SHA256
92e540e8bf6b54eb16072715cdb791d32235c7d5d099b939cb27dad50bf1c2a9

SHA512
115eac36c56705bda674258054c7dbfa530c9c7fe2a7d2ad47a4d0afa7f40f0c26a158694db3b3ca185da1329f31d319c7467e05d06e01da3491a5230ca9bb2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M61DDFBK\archive.min[1].js

Filesize
732KB

MD5
20bd5c7f93a1f5649e6b3218ed1a63c7

SHA1
f80785e9d2948a52f9eca02d50c1b3744ab2be48

SHA256
39c890ca0cf6ad4b06c3591daf7fae0d5aca8e90ceeeaa2cb4c7fb45c95343c7

SHA512
bb75a92bf8f3b4da254824d23b809493fcf64eff5d6e556c0acd89d1e7be7306c5546e0cc119ca4c97b836a578d7caa52d44de04ed2e618441832b7c8a456b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UOO61SKS\archive[1].ico

Filesize
4KB

MD5
211bed9624ca2dadf3b985f2901ab096

SHA1
b18786d77997511ab0f6e5c9d3c5b9e1bff164be

SHA256
abac83a6e6813515818512cbe6b8714820e43471ac10dd997023dab93cd6aeca

SHA512
5704cd67b72891c4ad45e9d00babb3df9e682af573fc9e264253e3a024292c9e71db7798894546eeb7cae47ef969737f751a5bb0cd0e8571f9223e199ac05304

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab38DD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A47.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit