Overview
overview
7Static
static
7LinhYM - P...al.apk
android-9-x86
7Suppressio...tor.js
windows7-x64
1Suppressio...tor.js
windows10-2004-x64
1consentform.html
windows7-x64
1consentform.html
windows10-2004-x64
1dt-mraid-v...ler.js
windows7-x64
1dt-mraid-v...ler.js
windows10-2004-x64
1dt-omsdk-m...ker.js
windows7-x64
1dt-omsdk-m...ker.js
windows10-2004-x64
1fyb_iframe...l.html
windows7-x64
1fyb_iframe...l.html
windows10-2004-x64
1fyb_static...l.html
windows7-x64
1fyb_static...l.html
windows10-2004-x64
1omid-sessi...-v1.js
windows7-x64
1omid-sessi...-v1.js
windows10-2004-x64
1vpaid_html...e.html
windows7-x64
1vpaid_html...e.html
windows10-2004-x64
1Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
30/08/2023, 14:29
Static task
static1
Behavioral task
behavioral1
Sample
LinhYM - PvZ 2 10.8.1 Oficial.apk
Resource
android-x86-arm-20230824-en
Behavioral task
behavioral2
Sample
SuppressionRulesEvaluator.js
Resource
win7-20230712-en
Behavioral task
behavioral3
Sample
SuppressionRulesEvaluator.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral4
Sample
consentform.html
Resource
win7-20230712-en
Behavioral task
behavioral5
Sample
consentform.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
dt-mraid-video-controller.js
Resource
win7-20230712-en
Behavioral task
behavioral7
Sample
dt-mraid-video-controller.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
dt-omsdk-mraid-video-tracker.js
Resource
win7-20230712-en
Behavioral task
behavioral9
Sample
dt-omsdk-mraid-video-tracker.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
fyb_iframe_endcard_tmpl.html
Resource
win7-20230712-en
Behavioral task
behavioral11
Sample
fyb_iframe_endcard_tmpl.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
fyb_static_endcard_tmpl.html
Resource
win7-20230712-en
Behavioral task
behavioral13
Sample
fyb_static_endcard_tmpl.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral14
Sample
omid-session-client-v1.js
Resource
win7-20230824-en
Behavioral task
behavioral15
Sample
omid-session-client-v1.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral16
Sample
vpaid_html_template.html
Resource
win7-20230712-en
Behavioral task
behavioral17
Sample
vpaid_html_template.html
Resource
win10v2004-20230703-en
General
-
Target
fyb_iframe_endcard_tmpl.html
-
Size
520B
-
MD5
7844cba73b7b4b439b587dd501e92d82
-
SHA1
25a452bc6886d0e05d4a73da785021fd4c477a04
-
SHA256
e042e304cecd19bb6816de0150d3895e2717e66dda91f7e189610687c049dae6
-
SHA512
f54c2d7c0b265aa7c6feb18b8fb6740e01c9e3aeb19bf420d39832737fa59eed8fb959c8aa8a99c0efc87ca3399a244a918f0b4e90b0ee831a87e8afefdf2711
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0a8ed964edbd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31054670" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c04afe964edbd901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C0E141EC-4741-11EE-84C0-FA0B5353CFBD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31054670" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2520910289" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31054670" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4885326af1dd94bb4dd17ee586870300000000002000000000010660000000100002000000088d72bb46998e5e35e617407dcd9e1b7d1186e7b1a8cf4f3747161420a7c1a79000000000e8000000002000020000000e27b8dc4c65012bf3d86db20690f4e0429f2a83162439d92a8f91781817e910a200000009e2f8eb53bd06fe3330120572b5cb6851bf6f72a07e9eb1c7e15e31f058d38ec40000000d805f4b43ce6406663bf475935e68cce604b47143fdd68559ecd5d32953ec110361024d09b2a10f767238cfa13e31f32369cbde5d9808b3e50a84053c089cef7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4885326af1dd94bb4dd17ee5868703000000000020000000000106600000001000020000000e7ed78587ab16ca25ced47c813adc546b03e825792b76ec14ee8255c8ad24ebf000000000e800000000200002000000028a38d1e02a3d20b89024933efc57f8f37c2f6c5c5f738c493626d29dbff12122000000072a5bb83b1b8e9bba13d76e53baa8c4759cddcb4067601da570eec3712e13bc14000000058db8e73bb248148141ecb820d0064051f9bb016d67e133ee176f3718c70f4378ecd9767d03c8e3c9813f91550c65399a6ee1cb25e81663428f382c793632274 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "400170798" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2507628753" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2507628753" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4888 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4888 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4888 iexplore.exe 4888 iexplore.exe 3440 IEXPLORE.EXE 3440 IEXPLORE.EXE 3440 IEXPLORE.EXE 3440 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4888 wrote to memory of 3440 4888 iexplore.exe 81 PID 4888 wrote to memory of 3440 4888 iexplore.exe 81 PID 4888 wrote to memory of 3440 4888 iexplore.exe 81
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fyb_iframe_endcard_tmpl.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4888 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3440
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5412e3a3e491a893c604bbbd446635441
SHA14ba32da0107e6d7a10579c6fdae9e8454ca5f629
SHA256132c1966cdf1c6a2d87c6f90d328a1ab24856853b157e819d13a135091735a3e
SHA512cce37c293e794b1c1e6580f0567b4c22d1ef8722041952a88da80b7e3a8f5781a6510a222f7d5ef7133f1e18d1c46d1687e107019d0a44a40b255d68b298b731
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD597f49e299d76542eaab6d8f430c2d39e
SHA16bfe9f7942e992ca6d96cc8712b5ebc5b84548ca
SHA256391b921bd804ef18a6b5d1a2be12d218850da1d0df54b1c29c4116f311bd4c66
SHA512635c1e7049d4baac7d1a72dc5839a256563c029a283812ceb25e26763e9393f104dfee4c5a98441c2586a389c4d1d30e0b29e13f2fabd55b165cea20b344f057
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee