fa5cfcf86586454283919a2913ce6a993e888debbba87e0b72cb8ef9b3734c4f

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

46ec4bfc0f2518740d2396f67ef455ca_JaffaCakes118.html
Size

39KB
MD5

46ec4bfc0f2518740d2396f67ef455ca
SHA1

e6a2cab761f1362a8918b7daf3aba021963b4e51
SHA256

fa5cfcf86586454283919a2913ce6a993e888debbba87e0b72cb8ef9b3734c4f
SHA512

e56e5a4ea8caab1ea337585851a520cd0241bb80976a901c2b84eb436764dbf4f1e402753236869003387898ade7c94300d8f854477ccacc96e4f6a8ff820e54
SSDEEP

768:PFibS1biHwb2vbtkF0l/09bPo3Ix/4oGe501JF4JWYAX2Vs2TP:PFic2HwSBkF0lC7o3Ix/4rVDZG2OP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421950777"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6FFCFC01-12D4-11EF-AAE3-FED1941498E6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2260	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2260	iexplore.exe
2260	iexplore.exe
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2976	2260	iexplore.exe	28
PID 2260 wrote to memory of 2976	2260	iexplore.exe	28
PID 2260 wrote to memory of 2976	2260	iexplore.exe	28
PID 2260 wrote to memory of 2976	2260	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46ec4bfc0f2518740d2396f67ef455ca_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
404a8af7b9be634b41d7704582ebeaf4

SHA1
783b0a191f73724bcae5bcf782c3711031bf2459

SHA256
bc610908dd78d5c2f157dbb55859a7e5dea3fe75e655f53370f5cd60f9f9a99a

SHA512
37c4e76a0d64c02872b72ddf3058861c795484434b7e0fc4c155906583211d8bef3a7183a57ffd28292fd100f92b2685af716e16a45789f6e3b727ed9bce2871

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca1b88b1ebae3099807a6a533ccd2d4e

SHA1
5bfe1ca0273374e87957efbaaf5547d05a842026

SHA256
b8ab0091855b3aacbc8e04fd7ef5b543da3da97a87f1847413e66c6254c423f8

SHA512
a81f90a33cbcd1e5d0c92a971fcabb14d9d6187f4dfd7033e3386ed3782f54b60a15d994fb6126efc102ac9004bc36f8765220519207ecc66667a44e7dae29da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77e6fc514e67b7b48e034c90488364b5

SHA1
296d4b18dded8542f9b85a99b295a89f9851c213

SHA256
3007765d1920c97d9ae913806df89b5d0ee5d76cf85f0f59db313acdc0440bc5

SHA512
ab32f6c7b46f0c21058362d5db1c8317f881cc7369eca30a28dc17780c36496bc27c8ecf25b36e8e1edd517a944e284bf0417bc7b8348d5944bb8651f08efed8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12e131c025bf2c67de30e21d467f8aaf

SHA1
ef6ee385b8b973695d0c7493ced5564500750f2c

SHA256
a74ac405ed357af07e5070337b0facf3bbc6614f4f1b4accfeaaaee2019f5476

SHA512
d6c757b8ca99322823bbd1c638e3498b1a890076c4f19d367d17ce0c9986a587808f6025c89b595e3fd4c581eaf5936e5618a89d2b64eded89897296da987c95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5283cb5d662ec0ddd75031802c984922

SHA1
d0aa08925f71b9dc6602adce8c9c893576489cc6

SHA256
aaba6201a583e00823a25e5a570524551f5dbf6e673b503450fabf9d83360944

SHA512
05d7bb0669bd94f4814620e24969e81e8e75ce7e04af41c8d6b39992f6a4de55a6754ffb1573a5122106e2c8d9f38510b1bbaa4fcf1570cdad5c52d69459bba9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d40d90316cfa0f1f3fd89544a6f95469

SHA1
a38687b2109625e8677c6a3b8a68158ae27f7d05

SHA256
0a75e7debbaf3139d885e94ebe0806b4091af1176dea9c9ec87883392098f683

SHA512
017b46365a54e3a46d4853a968364bc93bc1670b8d038e502591cdd499fc2661f98083804f5eb2c7bf84d6d09d17e80b106424731799fcbe6078319ea5bf00c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7d65cbcba6df5140e6531706a29262c

SHA1
37d4e78906f3974554ec5358241db6299c9b5b42

SHA256
286b904defe59bb19054d43167fb4c4fd7d280a432b5f254b5fb3c00c5d9ad1b

SHA512
86e8fa413b3e3219e29ec8981093ad5e358a9081625553a7ce2930509089cf23c90c4fb53d27165742d0a6a598393d6529675c19480be76935255e0444ad31c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f0bf392b4fe557ec9e81f73b62045e5

SHA1
c4358d4ebbac85cce8667a3075ff7e974646833d

SHA256
05e579a8f71e9915612f45a249aac44b6b6b9636a3094752b378898deadb8da1

SHA512
a73d8c3f93eba612def00c17918377ac2694c60b074d7090a956ffbd2d0d8ac0b6c001332f1c12c447f9255009d08f714e67cb71535609d336b8a83933bbd3e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bde10e0209f0b95b88692572b0d5f17

SHA1
be60689d56aee62141ebe3d1971b996d2de01c83

SHA256
d9f496ce61ea2455a132ffe12d46aab249ff0da84e0449ac7890ef342849c3d4

SHA512
83584cff44816e4e9d430fe691b0c020279141e57c3f32cc0434655e15ee308721b606f2d514c4699458a00ca3ca27f39fdcaef4274c57c91b6df52698f6fc49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1650.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16F3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit