4331245918b49928bf4ade317d67d2d4bb266f8317cf0d4cd79830fc0fd3e422

Analysis

max time kernel
172s
max time network
169s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11-11-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fyb_static_endcard_tmpl.html
Size

3KB
MD5

d18fb1787ce0e84567496b8564e452aa
SHA1

007033d0824685600611af6992060577e127dd23
SHA256

2ae5e0576febb1a1cd63b10bf71644f99fcfd0fe7fb1f2d19525594165294e51
SHA512

ba5225a80941e3ee4ff18401b910968a6cab47634914ecb68213599b96fd4b39c8722e82bf2883faf355d9416a6f2acaa36151a5d8969079cfcd4c6795f6003b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd500000000020000000000106600000001000020000000805f4d847e1a2139db69cd8dde1ef94f27b4b84f4b60fb096177d2a0d37e8f5b000000000e800000000200002000000070d7826fdada907b4153a421de0518b2aba2899a3f74fe8aa46e20bf0330a4c4200000001487abefc362a8a911341aa26fa2b2cf072a87fa8437c32b6102c6fb687c93c14000000063379e0a975ca9de5d6860632ec5a227d66aef185ffd1b08aba4f11f7acc446a9d904d4ea253128feeb4910299e88ff4745b79ddf864b9ba95b819b27279da90	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9167F11-80DD-11EE-B336-565D0F0BCB21} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405901949"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a06566aeea14da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd50000000002000000000010660000000100002000000016ebd3448e115bd1be480166333393a5e036a3a6d3c3b0e710f4d9331ee03ce6000000000e8000000002000020000000fd9b4bdadf70d68b32435d891ce5881876869c0cf98831459fc4f1aa7f7e844090000000c3fbe6d4ab2cf2a6dbf70a6fc82aaf34d15afdf22358c8de9eac948fdc24d45ca8fa1162113b0add61d50c32c804dfe4c49e1f7db950afe3bf003e5b5628ce161491efdd2a1d310019cbb699a15c87d84bb5873ff87c1dcdbeaccd1ccec9138f1e867cae5800433106e4d3524137fc4d56d39e374ed38f84313323c6dcc9aaf42ba10a195d25a2cb229e0ea26949d9e1400000009a55ea87af19228fda87692e090ce8a2d8497617c536432f19f03a8d632a22cb417f2f8563253af4cf8bf99bf59b7050dcdaf6e31af4bf2e643179578613065e	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2704	2232	iexplore.exe	29
PID 2232 wrote to memory of 2704	2232	iexplore.exe	29
PID 2232 wrote to memory of 2704	2232	iexplore.exe	29
PID 2232 wrote to memory of 2704	2232	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fyb_static_endcard_tmpl.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dafbbb4a73b7226bdc6545a10108adad

SHA1
476c9096b6c4ead3af048826faf26922c043c2a6

SHA256
f2b23ea06c2a181ef2559998169bbcad07347ba00aab09e9a311c13011ecfbc8

SHA512
50cfa4728f94ca81fdacafc00ea1d4df6d0ad5020b3c1128ce81432f16ca1fd59f7bd7fdfb3471062628c0ff36985a40b077084294dc56c153a796e6100344eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
196fb6b4f949f6744f7dc190e69a0f09

SHA1
603f00f7369f46ccd763e8fac0d5394b3e653be4

SHA256
04180647f0b213ec868a2952deb83104580ca19779d6ae058cff5944ec7f9eb6

SHA512
69b733a3f4bb35e2497220998c52fcec2ba353ab79ce6a5ef57d6fb5ea66bafd3ae2dcc93a10c6fc991be4c59c7e05c67cd879f87d6e7050b7bd2573f0f4476e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3eccd0985edfa7dfe4863adae7fd43d

SHA1
d4066719425409b7014ca2de4e9b9a30221ac197

SHA256
f691fec43d187cd700e5ff68a04cb67a1b7afb18c7d44c989f3326a4a3d201fc

SHA512
c138683dae658ac15b0309d2cf4d92a9ec1e213162c9833094600c10729edada80f101e98824ef972b3a472e3c43cafd63b4300af26f243254b5f863b0e9d78b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e036ce2088aff757947751cc040ccf8

SHA1
3d473846f63a231998e42a13b749da730bf48bcc

SHA256
62a437af5eba9a8647462565ea4e6127f901f87b9bc7b132cd01acd298c44911

SHA512
a208ce69a4c754e82aa5797219852aefe3f3a30f71fca311e48d4be239e4f8e9678982919de3c7f3a1d2faf0f16fb39f34f36385f3398937accd1dbc1467b0fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
654f1abdc9a4dc7fb0e5cbbbad7de24a

SHA1
31d0cdaf6491750bf8761d12e162ff053c95e457

SHA256
f02828808cfc6f2aa18a046e277798bd5b1ea6ccea2bdd4dcf51dfeba572d769

SHA512
8399442018097d4e7c03f683b711ce24e18bc50d51d333302099b5bfdf8d66f09ba105e802d4840eadee90bc4c335baea9b02471bb4b599c70f03c5f11fcb037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bacd5b7cfd3d120946d28d43432afabe

SHA1
752f02d23158888769fb75885c6eb64892c3f536

SHA256
bf191ed62daa845de85d9a9d70a86ca33deb4c0391112e8c87b7adf5b62f4d1a

SHA512
037f295447044baced6da2bc13c8a949a9edbe74db83be7fb999ae3cc70f8727125ad7c15d3460bed31c52faee07d82a40af4e434f2a4fc023b96c005b67b91c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f0bfc6c790b40607fd381cc537d616a

SHA1
db0f0a1ddf6185c2f23b809eef98803ae732c0be

SHA256
e399eb4001910970001acfb65ea081e3714756799684f9b98337c8085c94fc76

SHA512
2689683240f41b8218598c3aa1e30796e00c669e262fce0cba30a08d4a9376652131c030d1bb727c350f625988022b0e1aed27afdd43f9d17524f58855afa9ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab6d04d2ea5c2a874219ec046cf8b121

SHA1
315685bc7dee7042fddfd7d18839200c29ef0533

SHA256
11d38793f6c1f9177f3ca709bd37691ecd0f9df6eee16bf5139c9e7b2815739f

SHA512
10457af063136cb3a65ac7a4884aca20c5391751af82d46078a79d4e04ba5a55262b4618ffbfb3ecfa0aabd2f3ad41a52610fb4f126f8e83220610a906053351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df3085ed9b8429d6772921fe1e2edee6

SHA1
878042a9aa2ad67a5cb447dadc6051a248561988

SHA256
d3cecd04612ea1b2f47deaebd23b991721cee2865f97d55a414baa31fec8959c

SHA512
458021b9e727585541bd1c34c793f87c20207ed291a003f97f4eb821ec7a22ff5797f48168f9117f1ceba55d875d62c5b628d2908aefab725f0c3f4cb3dcf0e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ef371ad108f2da92b38a0567693c49b

SHA1
2d650cc50cbda259c7bdd0cbe436dca0e8778b02

SHA256
1ea605a4eed6843125b0a7c01ead6d095fabb339844a55d3ec9a5847a8e62a8a

SHA512
086a2a78b55fdd95dd5025ef38f27c228f7f8dae7ab76d68b6d886a02d9f7d7c2525046914fb8c79aa91490c76251c722313b3ca022cc67cbc7d016dcb3dc078

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8bfee1324b2b1677d3b5dc7873f3ed6

SHA1
6cffe662c076f8b3974913a519976c36964c1d6b

SHA256
c868c74717a190fb7c99c02a888001298553860511b03fcf23b0bb54a83be695

SHA512
595f99d056cba440b515e28aa6bfddf8f6b884c18e92345f0f1c7e8ee3182bef03e8b94b95bfe2a14ceacfe185de10660cf898833197c3ff07de32b3aeeebc14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1527.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar15A9.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit