4331245918b49928bf4ade317d67d2d4bb266f8317cf0d4cd79830fc0fd3e422

Analysis

max time kernel
118s
max time network
173s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fyb_iframe_endcard_tmpl.html
Size

521B
MD5

331ab67d131439c4c50e02a3d7445008
SHA1

675ac8d91e0a2fe211d49a8e42f20f018c4bd50c
SHA256

efdac80cdb4576d2e0d93512348e9dbdb06e69e23a1db81838dc5e40a16715d9
SHA512

eba60283d7d5562d3e27a9d5f9f382de621474796e68c4c7b8bf06fd20b081f5aa657ab58d988f40e76883eb8459e3b44f8f31f10424f6d181bffc3c28041e04

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70de27a4ea14da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac00000000020000000000106600000001000020000000efa74e69d0c7c26745e69b0d40732542ac84d4d3f8ed79108fe85c2779c9697d000000000e800000000200002000000005917dc559c08fa70de6870828b32f8733fa4881d7b839b502f791b40d067da3200000004fb4971abee914175cadc93eadb260fcacd46af163cf9e62d9e361e9cf92be64400000002ed5d71e832c7c02220125da584e01e98bf29f0e39ff7020ea1c3f2a7afe3b7e583066474c2ffdd6d0a9d3f4ac8e857db85dd8a83357fd54f8cb92d8396a6418	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CEE58C71-80DD-11EE-997B-EA36CF52C02B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac000000000200000000001066000000010000200000003d26b2504f51cae4b68e9c702b0a93d903d4d2ac81b2c0a6d37097aa90d581a8000000000e8000000002000020000000591668b0d18e1ae5e7f42b264492b3656a646e986ba047295f6e25c795ccf39f900000008be2f5c29019041c20cbb9d1f5b22ee740aa438e32b3821db2fe0a57279e0b087835d2768978253a4fad66e84bce298f795ccf61e8b912c75288f02daf07c658fdb40cbc9081401e5b0339194d4d9134737a2394f475404a5f342063ebf01d77a7526930c1b48f67077721c7837e3f6da242724041f54c98519e7a60f7146777776b0c8131f7d9c88470b29b37fa7ea940000000602f1940f19a926b3aa956eaf71e5dd8b92f6db1c1808768424833481922c501c133b711cf128472c6479495c423bc8a919846035e524923c006e6657d24f9f8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405901953"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1084	iexplore.exe
1084	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2696	1084	iexplore.exe	28
PID 1084 wrote to memory of 2696	1084	iexplore.exe	28
PID 1084 wrote to memory of 2696	1084	iexplore.exe	28
PID 1084 wrote to memory of 2696	1084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fyb_iframe_endcard_tmpl.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcb18c556467560025d44f1a9807c6bb

SHA1
ffa1ba6b6b636b44365b986975114dca9583a9c1

SHA256
53330c9a6891bcfbb0b7566fe031d1e25f2d51e8abab587cd0f9fd45585b4b9b

SHA512
ebcfef8e09e7996b0be627d53e225055ad7ded39a35eb4e91fbae9abad132bc34ac69eab32adf2a011374397a6592a18dd8f3df76d6f3821d2eae68eeaa1dfe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64ab4e4a58560bc13401c5087afe0615

SHA1
cf4d13a2c6ba151e2217b6077e68d50d53649286

SHA256
06cbebe69479fa7023483ef2bbd95d01a3e2c759c9765b4d27ef33dab53c01e0

SHA512
806fd6f128da574e46c1e3edb97a1792f90388306be00997ca4ccea866a80ce0a2cf76dadccd2915b3a61ef37f8f7b3fe203925808268ffe44d175813fcb224c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
892ba665d99c14cc78849c7d62569995

SHA1
1750e3ae144115358dfe8e6c8f41ea667d44bb0c

SHA256
c62c448455a6368608d2801abeef7c4076d86a8cdc9b58c81942d807e43b0a76

SHA512
94577fad93b909371eb6738bf93006a92a8d43848c4328fabd5d6670293b90c27988fc3d57225c19ab944ed1dbad292879603ac2460fcf6d61768937fc22d489

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6b7f8e439f31ff611deb5463195befe

SHA1
fc12e8364e9a6bbfb627f2ddc5310448254d202c

SHA256
e5a21f378c9e8fe1cf810dcde049cd8623615d99f907b8b28538a128781a3293

SHA512
09d066d0d0a2511068175f39357980e84fc165926560562939b6a20c0c1bda06f3b28963fb90f7f309a43af4d7fcdc5240c5c76f725c0cb7a7a206e463c62ee0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c17f8071e819ba401233a955d57b502a

SHA1
2c24cfac7017befd67a58ff250c444e6e28c2a30

SHA256
fe5ec74c93f1b20ed8b66ba012ecc02c64caaaa1c5c1e7175abc47a6fc270981

SHA512
eda25c7f6e8462ab508b92a09f8e8c74282091dca2b2d875f96d4e3dcad074b5b96df754648bb2de1a24825031bf3143ec14d52edc2e1cfaaa26ab832063675e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5891bb970179b4850b65afdf746f7d0

SHA1
f33ce172626419c79ed027075de05a2487b4ab9e

SHA256
86b7af5d5d9dd0eebb2a813df30ede99ceef63966cd032ce40d2c710d49a4244

SHA512
209e9a63c757207232fcbd05eeb14923c2ff989f2a06e45ed5e391f66ae158a1e700176d080afb1f1b5d10e7f8dbb6088fcd32be081fca16f9b54c17b3ed16fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfe03acfa90484c4bcdb842e9eb682d0

SHA1
b665711eb712b9fb30cbb8f9bfa496cf134e01b5

SHA256
d79b790948ef1b16f04697cc171f34c1cd0679439857b20fee0a13b71c9a73e0

SHA512
04ac565e90e615727f744262dfce554a86a1bde78bb98522e04f14ec9f8fe5bdcabd6a3dd83e81fc14053744e0028a4ad33925b49f3e6ab1f8f34532259b0a7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
deedf64c91e253e2de0961f4aff8b1ce

SHA1
b9cdc47f3355e7117da520892e98691dc961e4c8

SHA256
8c8ed01310ba08d0de42010d5fc9acaa37b9923fcd2db95340f07d505a8f241b

SHA512
ba0e19d16d541549bcc7505699d1c02e10c7093e54dc3b9f0ed96c6a2b8acf98fa78a401e4604e48936a32e133139018f82121bf8aecbf54df2d7ad886d18c5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
839eea88dcb8328ef8bf762b25863495

SHA1
9c84fb2dd44eb50869d2228b9e605ef8714d2201

SHA256
641c1dd63408f96f6131e83b7c01d7f68886fb396bb2fa1fc153c51bf0b424c1

SHA512
82f86478d6aad1ae7dbc6acf1ca2cdb27d88e5431dfb6d58078f8d2cb5e7caa7e67735a7f49d6f502b664099f1019970598685ac84dcef2aecc93c48f1922386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
289f8db22f124aae6dfecb70cfa495f8

SHA1
9e4befd8bc49911e8785d4750f3ee7be13753616

SHA256
d1fbce09e5ae5145c77ca727723a33aa1c90ed4da9686ff84d3a7c59c468be3f

SHA512
34251fac9bc46af7a8215624bc9473b34c32628613193b93157482e4a2ba44f35bbee2c37492d4b2c05ac050d7d80deaa79854c14bedf69fcb447bf45fda31d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b2538d2745f19f8739ad6c5d9f62849

SHA1
6c61a7e830ca098dba787b87d57f8f87a3e33ccd

SHA256
bbbaa85f80805724e45f7d383d60fd8a7aa1738c54d20070cb1429f04b51762e

SHA512
e1ade9733415cf03ab3c411d56281eb2d233afdad8b6c5f6c9cf94ebda3f26f0c0b5908ebd3dbffa82a28fb7884b9c780754d9a614152534dee8b892c13023ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB1C5.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB1D8.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit