7142344ff1efa338898a69da6c5081007223717b01b3f4d6207cecb9f646aab0

Analysis

max time kernel
135s
max time network
131s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
06-11-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fyb_static_endcard_tmpl.html
Size

2KB
MD5

185ce640c188cc750a44a523286daf11
SHA1

3c9be61b29d31de7dc5c337f26657d9721bf0104
SHA256

1484d0b59ea6bc28884c792908a9bdbb4670b82e8cf3feced3c5da14e03bfb32
SHA512

083116103c35f28bf7151b72abc0ab102b313edf641f1a34a30fe9d41b2cb73a29601a6da468173ee1a890f9f905cb0bb6e053966580e911f0b1ef232f93007c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70dd2fdffc10da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405469958"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac00000000020000000000106600000001000020000000fa29ceb7a4c64b781490bec6c8ab596351bd633fdfc926220f6df0b5eee87158000000000e8000000002000020000000a39937a4ee447b83631b30575b375599cfeeb3e0d74d51fe1ac3a169d32c4f109000000030e852eb0d84c99d05c929e7a3a5d784e4d68ce9c87723e48e48820d348803e9f788e6aa061d21ed5d2307502530024e27f0d58590b2c1f5797807b5309aaae79450b20f8ea0488f9ac60c2aa35472b563771b0da52e41bab8a4d2095c2ab20250604273dc2e92c21eb85efa38d29e8adb07eda96e62eba0f601c0f1ec9ab0874bb95fae7a1bd6abd07825052f31e7674000000072390a78db84e2353b4a1d35515e15724ad396ce62f90a23ed208492fb2eb230a2188a41fea6abd7d5711b2de2bae0791ce7dfd90387a640b5c97017d9828f04	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A60CF41-7CF0-11EE-A7A1-C63A139B68A6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac00000000020000000000106600000001000020000000a70b17a027d0debe2f8100b71d2d06fe192ca659fff911b88d5e87c4b4f9ec35000000000e800000000200002000000074107ada380da13225033d45bdb4197b1fa551f8f0aac64829350b16bb42b28120000000ad00be6abc051ce5b41b19610289c2c76140556477c5ec3fd76d48fbf03afbdc40000000eecb69087bb3c4730424be65be3e764f001a1b12d8597b24d5ee97945f341ec905ea355dd4ebc2f213e3698354ec8ab2dd831ffce9dc01ec0bf72ba5512a1a6a	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2316	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2316	iexplore.exe
2316	iexplore.exe
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2188	2316	iexplore.exe	28
PID 2316 wrote to memory of 2188	2316	iexplore.exe	28
PID 2316 wrote to memory of 2188	2316	iexplore.exe	28
PID 2316 wrote to memory of 2188	2316	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fyb_static_endcard_tmpl.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74c95f63885cc07143f6fc007d5335b3

SHA1
bfb7e671ef9894cd8844e87ff23bf793712c7766

SHA256
e4966b20047c20e44efe9e7e79d282a0916e0be60bef04610271b0a3b11e66fc

SHA512
30f8ce600366d22fb1e10e00691912604abbad3ec48204d85c0b20830d4fc9c160a538ebbc90a8bbfaa1800047abdc774fbbf7fac6602c7f978841658182672c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d756f0665e6e1a4c64ee957a37c7abae

SHA1
71d71f042ae8be28659d80f3d41bdb0e401a6aa5

SHA256
4dd3d46303332a6764df5978c5d665e8d68a3e76d5ae7a1464023c62bb1a8d90

SHA512
d2cacc7ddc5f8dce6895763195181a10a904bf040b5e84e455bded621c488430e68740f626a32dd6640c95e0043e74a0ec80b74da5f8702b38669fbcf2f40353

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72ef25b525313bdf4d8bb5762a5ffe29

SHA1
f89e8a1f2660d1dd90ad88a80e3efc6cfbe9b9a4

SHA256
b974a8b02190fe27fbbcf00fe30c4eb620a7f191e97eb58bd0ff8dffb8f89725

SHA512
73f9e40fecb0fac3995ae152d8eaa7d94cbe69069314f206523261bee34f16cd2183aafe9d81a5370a59e1509ab6771d70f577abec939baed12a8a4fb4884e7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c33832da9969134f26db23948da6483

SHA1
53ede5b8e268b1476d53c316fa2b1b5a27745c17

SHA256
325e4a8faaa01c4e70c4011b6048135c3802910ca4b6a54c9c010b0f7ed14c94

SHA512
e3b93c59990434a58d7a0438420bb88e89ad08d8bb2f41c9169e0e89bf017cf22ef37caee9c76c23328f1d8bfdc34f97179fed7b18cf8ed2e781a1d63dc3669f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bb7358810111428726573fa66a8caa8

SHA1
113c28ddf68fe9ea29b4110d28af4072b3ec73a8

SHA256
ecb12543ea09fd407a26fda9829b904825262b23477f4206539cedb1379dfb40

SHA512
239d2bf0d0a890fb6b2d98dee139b55a77a5d811719cf5e8d6461983847f56bec00e56106dd0497bcd4d6102d53cd10966a64be6e1c22744362679444013cef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef50ed44e84c7b2aa53fa7bb798e5eea

SHA1
ca9e094012adaee9e1e747a9000d891fbfe8bc6c

SHA256
a00f2e5f430f5d56b519d626e4fd2764e5802a4b0af9fae2260dfe4a545ed1ac

SHA512
aaece616368eaa4116e7f0cffab78c6ec25b042d9a15f5c6c825cf5ac7f9e8032a1f785410eac917080678bec4bed6074da0a55f3c3c6603d196b0c42f725b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73f810b00e9dc49db242f13032783aab

SHA1
438551a2962b78676c3b6715984208e830471a27

SHA256
30ebbc0e2ef7711d9e9b3e8e66c189a6aaa8c130be127e1c750805fc364d313e

SHA512
6ac8e1daead88383edbc65e9496629edb638f548a9c9b09809bf9185a11dee7ffa83542c5ab1aa9bc3afc3db51056b4a6ff5796bcf8bb3a8eb5baea3fadbbca3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6a01259ea08b39c9fd634117f18c3dc

SHA1
0fe89d77f13db13a207a5651cd3eecbf7e925185

SHA256
ac962187772b6daf5b19930ba091ef5c5e2c12668cfc722d76e38180491e8148

SHA512
0b93e9c1211292181e7bc09b3d580eda8aadfcab3cc75f4ab4b4d1389a67dd96fc391383d6520128bc5e6340ab59006b3bcb880e5d8d57f996071e0ddb4c8d1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a785227309dd67a9637e8ce8b71d1797

SHA1
544b049e7262c6efb595887a4ca44fba4750cfa3

SHA256
10be3d5e45f66a3d84660a017fd12bad998b4aca0af183a10252543f3df64a19

SHA512
fbe0fb17137864d3487bd7ad93f08036ce8ad2618ea12168a98726d0ef9e81acffefa6de1f7ec9639bd32568b280d7c4e3fb28282828ea2669dc516aa3432069

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
528db2cab3c8b47ba76aa612c1d697c5

SHA1
8106f3ccc994c1d9597ebb997111c51bd2bba475

SHA256
c007d6626b2b46a4c59bcb06ac337b3beefeff14816ce6bb56ccf8983b2fc436

SHA512
5d80db7911ed75a9588f3c0dd833d3c59568bdf7060a486c4c5171d7ddf22efba1bef522619d2a7dc620bcdc9891fb1d75bce7d59f289690628f0ae6f0e240eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
175a747ea145367a3afaf25fd4af7040

SHA1
ffd37d9022439f23cbe9f8f96aa3617265af0116

SHA256
524c25d679bdecb96e41ffdc6d342f731a5e8708ca88ab49eb59062a313cfb1f

SHA512
eb1cdfc3f18b1a337deb0d019dd3b5a4aad238b97a1f045c32e53e09ce502d6fdb404c40c37e7c64934514e61a456475615c7a80d6a19e7295dca80e7c850e9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff8f90c05c9694e242c5ffd48bb0f315

SHA1
3cf95c4ae91e286b8ea997c5ede8b178336c1966

SHA256
726036b8835c60e149d1aae4005b46d1e4d2d3521fdd441a180d3f29456660d1

SHA512
495c07ffe9c7e289720ffbb33639ff80850117c6ed206fae7ff8c806e4d0a116edad9a6e594a05797ba08aedd34d8e2c41e8c886f9c1e785a5629f917a02e5f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df2cea87431a12350716ad8ba09f34e2

SHA1
6c0207b0d7900f26a9e6a838544452c11343f330

SHA256
2486ddd04586d6c31e11adcc60cca5cab2de1e965cec1abd8b2bf4253028da40

SHA512
278dd7a0bb30010b51cc4357c3e67f7d77f32ee9ad322614de9549eeb102deef463d3b3a817174d82d4b3f7b34386da9903987e100b13df9b2dcb2f2f06d4d06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a64629c9b71b510953ef3dc10273a205

SHA1
6348b121e5206f313fc5969714a61c27b159073d

SHA256
c2b321c66d5df105dd0b58d7c557a4a7bd319394ce1460e6ee2993cb5ee6904f

SHA512
a43125a09280fe518f7dc85fb8d99c54a8f0654ed1953c2e103db68d0ec00d860d896ac0f0e90a2626b562f3bfbe0e01c9aca5c1ebbf8a7a1f91eab24e358dd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c70423255e8dff2a277e8308f3697ef

SHA1
0757c5e1c82643bd0ebd79052a32ae918018e4b7

SHA256
a86c03ea638da3b509e05269941aef4bf2918019fd1500251450dc363c965783

SHA512
7127569172d7e0efed91a88c3ed288f3940c2460e0f3ede50ffb1b9169bf9f1966e2fa713135b2361c8740fab6f2a0755de63004ddd5616c72547444f8f1153b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1639ab8436365cf07f32651921396b95

SHA1
9f3672db6304ee0816ce6b17856a235930ec4bd3

SHA256
7fd26d1b41a3c461f5741c6590cd45918f1da68f07399377cfa8706b1188ee44

SHA512
1a9b80720c89b83da3675df3ea431c67e579d36d9da40ad6936eb8cda60b813e0d73edd4f9aefb5011a5170887b95e747081c74e17f12a49d6e78a81aa628936

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65b9bcaf4443a1e50752d1cc9108a40c

SHA1
c4039fd93cb2cf8c44aaf964604120ad021dcfbd

SHA256
9044265fbf77b52e46e7ae376078356e72cb4afb81fd391e1172e6145a82deb2

SHA512
6f85214cfe7f20b993ed8cf767a9843e040bc6aba6b0098612bf9027f5690c57eb678eacb42ea34176d9c01c78697807018711ba12b22c1a79441607bed9f7be

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC302.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC401.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit