846a04a5a04dad7129abe56d82b0578d4e2af6d6f73cfdf9de364c001d00c24d

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
submitted
25-09-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fyb_static_endcard_tmpl.html

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5FE0CC1-5BEE-11EE-BB58-5EF5C936A496} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c300000000020000000000106600000001000020000000c8dd3473039503d49e67881eb67669c6b090a44537d81ca43172a8cdcd8ce1ce000000000e800000000200002000000008db69c9c4701753362f28dfc0a6670480a4a2c8d24ed771c230d8a8cb1fa7ee20000000c0b43ec24f28d2da4a4dcf11ff409cee3d9c39952e1e62b9c33cd7b6c256094d40000000eb2a49398b7865d55ccdb4ea961e89627a0aaa0013fcaf13869215bed0d1664d79a4dbac4bafd8779a64a2ec19c24dde60866d30a8b0695c4deff4ab096ec1aa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "401841084"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c02e48bbfbefd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c300000000020000000000106600000001000020000000527ea681d55585ae2c2a9ee6c75de7e24a0ef4836279e7c941a7d518320abc22000000000e800000000200002000000073b1d943741845a3bb83e1b30f51613286fb6f3f069e7de4acc4b7d5f77b263a900000004b4ec56716b9c89ba70eef4c8b4a2ee80aa632eedcca45f131252a4d4d79a6320541f5debfad8694eeb292afaed33dfcb5f7436e2357ff47a8c69a511be20d7bdc38054cd364f3923d983c5398d81611c4b8285e9635f5335bcf3fa16f50e1f847cafd8d53e355657c1a84480571650b26a7a44b34dc2150b3f1633d03482361c3f20fb6d5a3da0c12e1fb719724c6f64000000070397e74e6004bab6da7afa6f2570cc89bb3f6aec006cc4044fb6d521e2fff4a92d16a66c791863eaa96134f955c1eff38c53a233a50751119e8d297bf07847f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2432 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2432 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2432 iexplore.exe
2432 iexplore.exe
3036 IEXPLORE.EXE
3036 IEXPLORE.EXE
3036 IEXPLORE.EXE
3036 IEXPLORE.EXE

pid	process
2432	iexplore.exe

pid	process
2432	iexplore.exe

pid	process
2432	iexplore.exe
2432	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2432 wrote to memory of 3036	2432	iexplore.exe	IEXPLORE.EXE
PID 2432 wrote to memory of 3036	2432	iexplore.exe	IEXPLORE.EXE
PID 2432 wrote to memory of 3036	2432	iexplore.exe	IEXPLORE.EXE
PID 2432 wrote to memory of 3036	2432	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fyb_static_endcard_tmpl.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35946e380c662835ea75610bf09688ac

SHA1
b8d2b602979347af4e559b0e7f9ae9da30369001

SHA256
cbd6a59c2763f417a7ed322efee9113f2a88acad533c8e1f91cceaff36368438

SHA512
864f80767ccc0451f9786fbf05a3b726f442da54dcae02bb07bd685da320d58b57178be1f401f4e40080f768f5864d8915ea5dd4cf80e4460319851b16fcc923

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01b5578d6831cc9521196b89712b9fd3

SHA1
8113b2bb4f35deae0bd58a9b14224ece3ede5853

SHA256
726dc58393e486f0ba271a7bd4d0b7a931c9c8dd0d159fde78a53c76659bc0ae

SHA512
6d5b1f734794e8dc28f1a6bb7141a029b9534cc3f4ed7364591e41d54a4bc7162437ec7d25a0c0566467baa7783d6c14f2c087063cbf5c6fcff62ebc4e507291

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bc7ca9d09ef64299d15052634da502c

SHA1
812d4c4b5fe40483dab5a40bfd7bf45bfe08913c

SHA256
99d28aab5b276b9a469a522c957015f37b4e0c2c8876a6e8d2fb400325f49542

SHA512
6e9d300b0c688c29a980e19e739ec8697082c8d42ded0a77064296d1e3ffe7228aa6923546ee4a3f91c2dde5001c2a8e251726f635e63638926bd973d8ac0eb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e8eccc38e32453d66d7b1df65e27d7b

SHA1
ac19f32deed5bf6895e024cfcd31242c5aa435b4

SHA256
a0e33547e9044d964bb2f9b475b234d537168cbc0c941cc3472758c1a5ba40f7

SHA512
62d03f33a49ded2cae48bbd50917ad76c2f6ff4ec67ba1f57eef64881f5d0dbad36bf44bc2d2c4ec64a5e2f9228ea944b1f37c71c0233798ef9bd67ed5837f8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd1a1a5e098900b1d7f5083510948641

SHA1
3e682c635ff2ad60069853efa670900db4cb86cd

SHA256
7ee04acfaf746126fdaaef3380f9fdde1bcfe8917b0d0eb44a0e2f5bd1046b15

SHA512
fc918265a978cae03561d36e0f25548a9f09fe308ff965b9afbf63cb371f418daf0d3100c17b0a196cbecf53a7481c2b1b7c4fa89a1d6e2b04b20b807f467d80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3884ef764cdeeb39fb3e481de62e5dce

SHA1
5e996e3c705aea29e602bdc059753b2fd4a06b0b

SHA256
a0bbf07fc5e166c0366da60ea3080c2709ef2edd010a0939b4f768d92799e81a

SHA512
269c70aa38500b69b53e8915d71c719727936f59331364dbfdad398f3ddd5b0ac39401909959c326e74fb868ddedfdd394a5d6a41e95f10bd569eb13f1afda56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
250d248ddb9bd2f4d5e34e498b911a0c

SHA1
965d8c7df89c328035eb37a93b74f7fcb42fb939

SHA256
59eded0fdb2e7cf5088b52384795a7a35aeb15f37754e8798fe1536dfac0a618

SHA512
3444951f7de571527d4ceca530fbd1040a9ff31badbd433be0a6ba06168e93d7df1c81ddbbcefb13d0f35a46214deb40b7d9ab955307eccfeaea2920f76a11cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c4a0787e7968f7553cf9cee6c9f9848

SHA1
7d51167cabf111117392716e5af414798581853c

SHA256
895bf14d9412c1ca71d1b6aa4671238da6e62d1d78a26d352141200e9c86bde1

SHA512
58d81812f5db2c496941e05e36a00d918cfae3e65627cf9f1aba56842eb83558ec7b2acdd80c7db7c8fda7c11baa6163520d01cdec51d711228748f29e8b61f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24f226b6e5c746cead8361ec4e0f8362

SHA1
472696fac2699416af781d2aaa0f96817612fd99

SHA256
c062e14e10bb86fb669a5b621922bb140c5a91aa03ea88cdd4cdac1a03eb541c

SHA512
6be35330bac60b8c471b200010dd40af357ce100af1cf6921f0c2f62e451d5f79c87275f4b72878d59ce127219ad3cf89764e255d06b0bb5c0736c0e1a706827

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bded94acf12b71d48dd0acc5afbc0d18

SHA1
2efd6ecd472bbbdaa48b9aa53e550ffef919bce6

SHA256
584189d1f0e14a1b2805010f22c11df323478796a87e3ba24855443a0cc7597d

SHA512
f85b9b4b9b719d9874dd01c8a4b6711207554b5986a67892f8d1727d0a0120abbfd7183f6709b32d9cab55fd31c72abb58bb9789fbb6e59aefb7f4d8772255c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ecab3d3f9ac5c00f38804742201de5b

SHA1
1a4405381c3339e417288079f5aff1b643663300

SHA256
7c9c602c6999e8ba4a4f23072c7a44518cb8b697d8e454bf56b379fd64b630c8

SHA512
90fe34fc9f2b81e706465e867ef77a1f3b459ea3769f69c1e099c6dc8f7f73ad6536dd856b0aecf625b6751899f785ab64af4023422271401d0935be2ff0d76b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e825a0c6f530673d1c0c0b005dd80435

SHA1
3464d79b003b8935080055477c521667f0b12253

SHA256
50592d3d05bdc51f66056756612677ede3bbe053d67641c513d9cd64e7ad53d0

SHA512
5752e4adda545e15800ffca044345d15a128950e53df9df42499633100a65348567a9c7f223a1f58186fe6e42fe66fe80eda95c2fcf5d7838ed1a5aa548ae3f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3da5cddffd362d568589fc4e0658fe57

SHA1
acce305c157b675b54c34396493ad6a2a955e471

SHA256
b5649c3643441d7c791b54ad2a2a8c310caacf922827efe1cb2ae4a53e095fe9

SHA512
71348f49f4d8451556e4bc3373650e2b831a837d174fdc6ba3529bf16a0594e2bca5a5372995ca02990286359a74be09ffced16f3b7bfaae6519c8edc9e9238b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab546A.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar54AB.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit