11dcd47ea09e8c1efe551e1832c7aeea810dce127f78299fce8d72a638fd9f51

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015e49348610e2a42ac63317e6e4271ae000000000200000000001066000000010000200000005c8ba226084729a0a1accae4d7370b107d4c74285a6535ede6ad0e07c70eae01000000000e8000000002000020000000c85625d1a9310ac4770a3fce89be7ec8d3108da8e808cc22f2b325e0ae59f44490000000620b21972e7d4bec44c9a7265f5a441d43ce44d75bc7560fb92646c46920013ea5b9d1781eab9a911ab3796c5a4627e095a930360112b61a384668aa013e1483210b5285d86c5637b6868557a4f040c29671ed23dea5e82731b3386d5301b2e4f04ad246463e4c9dc9f9e58b8f3002d7682b9e8426c714918b277c0bbc7070723f579d949c02aa0194bd791f4b9e7fb8400000006f14c18ec0bf4f936c7d80f7a0138670306c5207d9e80e572f608a48cdac29fe0d1cc74a2aa40f6f040bba195e37123f02f3cba7d7df270d20c1a71a962f1bca	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 500a795857b5d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015e49348610e2a42ac63317e6e4271ae00000000020000000000106600000001000020000000002f7a946f0e3f4b89dd78bd8c8d1c4c85124476cee9d96b00d7c945ded9f5a4000000000e8000000002000020000000fe2943f4ba5397b2213be4f6def7175eddeedf9ba31366273652b5786a1ff75420000000de6045bfa35bef497ca1db72f998e79841f744aeea2302c71f7838ece88c2976400000007bf1cafb551fc5e8ac2b53654a28b0e58025c0224afa06761811425e210b1cf2ac84c38a1b3b00aa5ad2109e934268cda37306f48a6a2f7639123e64423ec0db	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395996416"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83B4C1F1-214A-11EE-B6BC-66AFBA4EB959} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2632	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2632	iexplore.exe
2632	iexplore.exe
1268	IEXPLORE.EXE
1268	IEXPLORE.EXE
1268	IEXPLORE.EXE
1268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1268	2632	iexplore.exe	28
PID 2632 wrote to memory of 1268	2632	iexplore.exe	28
PID 2632 wrote to memory of 1268	2632	iexplore.exe	28
PID 2632 wrote to memory of 1268	2632	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fyb_iframe_endcard_tmpl.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf92bcbbdccc9c58f4311cf9289993f0

SHA1
422183deba595fe9556453de6716c802ebba979b

SHA256
09671b726065a86c6f24677307c83ee2daf03100185a9a304d5f226e634a86ab

SHA512
d3a2efa77d517245293c407c2e9e2730ec5469515fd14026c2902193181968557a6fdbd964417bfd679ffbc778ad57a5f8b79fdca70828f3a60a548fa265b886

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9404e560c23317ca242ab2cf93632ae

SHA1
f7d3d799c6ff4227655c368d5773f96de57c34f3

SHA256
d68ae2af372ae5c72207a4bdc5600a625e35573bd1e9be110830023993e29729

SHA512
efece1e97e8f20cb8ee0a77ab33c866abb7d8bc122a48cccd7db5eabaefc940a6b2f83585efa618f2f7fdf42c68d4fa6176c6da57f7a2c7327485d6acfb47199

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e92d70b2948f1505b52c70c24d0dee7f

SHA1
ace4050593ab5fc2aaae36dde4ad53182a1e7192

SHA256
a9f549c702e2b17d91333eff4c576b10f90cf375849c1d844338afdcdb4ef6f4

SHA512
267b9ffec8a32cf49297b361e0dd2253e11384bc208649a5ef92d2ed80a370e3d1830863c43a95037b75e072b229639f4b8924d6776bfbfeb4a276149cafc8f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
849a8cfb3e5a264b59951f3f63496425

SHA1
6c0f2ffc653014d39fa41471fbd52adbd6722ed5

SHA256
2b63fd4bfae96e12a6d126e57200b21d76964d065081fb46be4d925d1a74e023

SHA512
b7001cc9c8b20937f1b227007df1757d8ba1a9af38e724ee6f0ff413bb946a28f78d726b168c8cbddda32a9dcd81d05436638197f3d97cbf9bbd57b761bf8789

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db1ebce9a551dfe6b403fa28861337e7

SHA1
a59705052787587a5287310e0480a5fc6495d7f7

SHA256
f7893bb56a03c34c3d373ffd58fdb74d4e83487a8074c4b2ccd2c3565e12eb71

SHA512
47188bf9d5466f0546393b97051de19363b6e95b57b0edeb076fdccd5e1f56aee4dd8fcfd83e49e5fd64299bd4b822c0060363f61e70bf24645ce7b109691966

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ad850255b06aa0351b31736c0023e95

SHA1
fcb5e17154fd4058c4cfb1ecb2be3ddc5bcce866

SHA256
49660e707160aa1f0c2729406dd64e9d8ced92e3d23c8933a2cc085e3a543688

SHA512
b0aa2da1b3061d2b42aa317af73d8ae16ddeaf4cc320bf1d6faef6a989747e7a6138ef2b2f084090dbd7adc5ae99f3df79831490083fa20b9a8de577b3c747ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6be1bdfb7e653ec3074f775a42d8d344

SHA1
62e9da6afbad0d8a102252071902471c4e3e737c

SHA256
1eb45adcb807796055357530ce421bfa51fb6be1ed8ffbe10e238b6063d957fa

SHA512
95f1a023d30fe0ea949dac0fc7994acaae12b19641c332864cb4b99e769c178260295a3057e047dc38e23ac909794a4be0cea98934e11c9b62821a370b64794e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3892d9d8780342a53a72362018fc752b

SHA1
55d2cebfb31e196da7a12cb636e3890a13c02e94

SHA256
c616311707e1449bce9e351eed636a812fcf7f627fcbd40b58515141561e7ffb

SHA512
051ce792cd397ea54deab2d14695476a72ccebb4baae3d04ac9760a32772d7f762d4b4e0cc6c6915661ed98da88844734d6ff4e3ceea0bc6bbe80d3df5c7a11e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd33d3b9fe9107d7c7a9e3787704cf6d

SHA1
b4e83a8f816cfd82ced4461a36a06256098760a0

SHA256
75d81e54cc26dc56c9a8348c13989a166a3dc6435705b9df78c27f557aee2c67

SHA512
27160cf6b269860242b1cacfca6db45c9829b822c681c2856d9d5b9e306be3db1c43599710650e1bef11f69e56d0b081ad862f84984f7141095124c7476e2416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O5N1CMJ9\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9408.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar94E6.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4G9SMM0G.txt

Filesize
602B

MD5
d49560070eb8057dbab5d3685de6a160

SHA1
d0bc76cbfa28adaff52db9962b0495d8efc06637

SHA256
16415edaa967b9851bcfc0813fadb7a35e64083d32cb73d4e4015979efcbe462

SHA512
df2a4c27b497ed882071a512cc6b9a569c61de9e95b7d83248ec0b73de396533e4ad2e474f9b12a912511da474da3ec1cdc3014ba0b45f280795291fe479ed9b

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads