0bf73ff0ac2e81d23a005b08f8670249528170bfbb249e38a5af809c6a56c7f5

Analysis

max time kernel
195s
max time network
274s
platform
windows7_x64
resource
win7-20230712-en
submitted
26/08/2023, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fyb_iframe_endcard_tmpl.html

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399249460"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b14723a8e389564aa88fef2378dcfc63000000000200000000001066000000010000200000005f69d93e2893671a748f9958a357f6dbc7a4c22c13be501d8caa20d79530ca08000000000e8000000002000020000000504479cda37e02c1783671334d5be844741944cefdf7795b6f4d550bad571b10200000003bd37842083b188239765ab07948323f9cc0846de175da02e1d6dbe4c04b70be40000000ef0166bda291a467e2192cc90696f467201d68a00f6f3f1f73c7b6b5a7bdc809202e3b0b304fd4f58da0096a8732b966be3900b8bc28fd33fe6336800e7961f8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b14723a8e389564aa88fef2378dcfc630000000002000000000010660000000100002000000094851b85bfb9a86c3299ff4505a91fac5e3c4777bc0927e18986effb355944ad000000000e800000000200002000000082faa9b227ba6e39f100e2ff666523dc56029ae225f6a1a8451722667222953f9000000011cc21ee98139f6c5d05dfc6c8a2fadb346671bf6df653464fa949cc6e403abf98b19abae1a64ea58fc0e94d9c03cf26c527a7638b62510f6babe2ded3000a2772fe667fcbb96582b8fcd572563001f3ed19341237fa5693bb93dbb8f0aa50202c8435cfe45efc9537c2711385f1d7634a2d4390b11ea11b6e5d1cec341517490431f8ec190dc12ad5055965e6469a3840000000215a62744807cd8d1609cda75117c8c94ae4deeea09ed022e931c6ff69d5fa8e5df52916aa80962a06a2421799c034a7d0b58bb840a1d958d03945200616c498	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c03ac8a169d8d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC866D90-445C-11EE-92AA-D2B7D0620653} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2836	iexplore.exe
2836	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2716	2836	iexplore.exe	28
PID 2836 wrote to memory of 2716	2836	iexplore.exe	28
PID 2836 wrote to memory of 2716	2836	iexplore.exe	28
PID 2836 wrote to memory of 2716	2836	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fyb_iframe_endcard_tmpl.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67f95994870cfb9670727467fdee2a2c

SHA1
1e603cc38cf99f7f135cc80e099b8bbaedaf5913

SHA256
eb1b145fa977cf33701ea43cbad9965b2d05a58c4814320bfeeb5b3dc3a9bb11

SHA512
784d045ee94e21b38334032a1e2748471c978255e752e21d7bb7d192f7334edc4b9e72503eef2ec8b66b9d4ef732a722b14fd1b594e8b92529bec6baaf965e4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff01700e543a4548ec0f37c386be26c7

SHA1
b16310c0d9c5dd08556a0d5d0c7f78ab96300e18

SHA256
0996f2e812b2171210d44e013676e43733bede4e6d67987b90350281898ad696

SHA512
fa21aa704dfe93a81264c4b38c5a890ede4caf22a420dc8b3424818dcded9bee8bdfe463b9527cc10aa8a4e5815e41f1ba7f384b897df526ffc77c5116024e43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1751974c91eaebebffed4f43cfa8522

SHA1
e90fcff86c5cf39d86ef88cc05027e69a2158273

SHA256
336c405edcd8862cece089e898aba933508f55944a875f330cafdb564607094b

SHA512
de8bb2b9d513021d2fe83ec23aba679db6713c1b441a7ea5921dc169f15b6cc5eaccbb9196a1e5cc4158d4fb7fadcb0fecf2a0077d9c44d20b083e0f8cf7e495

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c48c0f283ca2bd86f1e7adefb9ab52e0

SHA1
f9032c3282272f1972fa7b48f512f9a90c93ff84

SHA256
26379686395c9cd886eed5c9efb6e1664f1d3b8aebba7cdbf20b21bd79823e47

SHA512
6a3f2cd0c8ae9212220f237006334ee3d741ab0cb7d7c962017c32d045cbef0c86f83a4b68f52ce23b6fe0907a05b32e360df7b10158d3d0574f3c4c1dbb7f63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27bd0f2a6f0b1d09023bad98961676fa

SHA1
c9a54768d8dc462d2166f80f6f947f8f0a67b5c6

SHA256
c4b2d599b7164813805fd820ec9e907faf5585b530cf1ea2a74b6dca0961c370

SHA512
c1a197906c8bac1616c6c323b9fd0b823775e1e431bf0076ce2b6a199996a2dfbaae479004f05993ce3b70a33d06536231bea281d8893015c4fcfb42fe67faf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ff91f8d475c53cb1728f8e61fae4d53

SHA1
870fce851da0febe59368b1c1cc45245d9c968c0

SHA256
775dd73399e4b4e0c2ae07357e0fd1bb43ce697f1b07b5f57507cb22a4e5f6f1

SHA512
946dc4b27108d6ea32da040200248513eb0de7c969721088d676b5b14032918cf53c552e2216b1a8d65e8d3edbfa57a4176efa7b9221d4a3752648b2b84714a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a3267b90317d0ea0b5bc73782c5922f

SHA1
9e920776332e5bec676ba783b0f4eb2dc551c0ea

SHA256
c55dcff3d8760697ae26342b111a0fa15118fbdc8991f01934a51f4587939405

SHA512
b32169ff886693f857ba1af533de2f4cc378fe2f2f38d61a8387553cd6df72ac4b88c5836809f20a795a6621c7e28f766ae82655d5a4b12112895b47bfaae1a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae08afd9e353e6da559c0fcd842fa91f

SHA1
c24ac3951a8c1ed113b1a6f612145dd8111becf3

SHA256
05029699d2f92f37e9829bd32a8f174a8a05f9a45cdcca3f0595ef32101ccaa9

SHA512
87e5a1301560e241b0f7384a3ee8cc449ff9bbd0d1b8ba3e99875087d8d6a487ef6b45662a9ecc4881e175d048776f2706265e3812f8737ca2b77f0e3cded68d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12fa068df9e4f4e3b5583b98896642c1

SHA1
323bd1a8ac440cd0c243a17ea27cb7b53b9fbfa4

SHA256
58d8f80becd5448eda5577ab83336b6433207689e0a157be7d8d1e405dd8259a

SHA512
12f9dd68b271679efc9d44a27a9a388b519ad71fda76ea637dad964eba8df83a46da3127bf9911e3d317e30b2acb89253d68b11351d3fa1d5f302be22cf96141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2441bc2db1d9cef406b5188055a00dc4

SHA1
c56d046bc1f412029e178863aeca67ee538ea27d

SHA256
9621e9e4f3ac5150e3abc1aae02cf11c3c318eb45cacc98ad036631412c14208

SHA512
50c6497da6f93e788dcc5fa8fed7e6e44aa8086fb5755de87b083e16658e67c1e82b7438c9bd4f175e70ff660308305ed55710e29801ffb04d705e5b08328a66

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC22F.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit