aebbbb919d076cb90e5653274359f8cd2c735ed57e137604dd533d96f40af475

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

490fe3bc954ca3e9bcea5f5e5b514795_JaffaCakes118.html
Size

67KB
MD5

490fe3bc954ca3e9bcea5f5e5b514795
SHA1

025b7eb2443aa9497fe35434f8566d84e340361c
SHA256

aebbbb919d076cb90e5653274359f8cd2c735ed57e137604dd533d96f40af475
SHA512

5d58cba12411a2f73de9d553d7f3fc68b2d11ac5670212fb7a191d9b0766d38ed31ed5b52c070604cdacf95c69d2ba43440f26cf28b2505bd055d94abecbd436
SSDEEP

768:azfoMRQa5MMb7BTj+HR5kBNC2EvPpHVTGHPQvotxotry9X:azfoMRQa5MMb7BTj+HRmBW1FGU7Zyh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421987076"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3E0EAF1-1328-11EF-AB95-422D877631E1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 3020	2072	iexplore.exe	28
PID 2072 wrote to memory of 3020	2072	iexplore.exe	28
PID 2072 wrote to memory of 3020	2072	iexplore.exe	28
PID 2072 wrote to memory of 3020	2072	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\490fe3bc954ca3e9bcea5f5e5b514795_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf27123389c3910f584d3319a2c45507

SHA1
9bf3f51e25cbf15bf5b34ae35583e6b116e8addf

SHA256
efef3a29fadfc7f16d5d436b46c0364cf0a0189f27fd87b108176d83d6336f2f

SHA512
80b3ac4d0803986f86f0aecf821bceb702897d98648691ca8a7c3a42c6df6c077c36aac95791029bc253bb81527983a41de9eda28665e9516064b856569f0176

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
590c97eeb6e55ea1f9de90ff6b3a9dd9

SHA1
dde1ff2a65bd24b0692f9ada4244f3f8d72d146f

SHA256
e6415999b24ad8c40718d70e70338341bccb49b2010cf492d65bc3ed12ab4dff

SHA512
47999232dc121a997d3d8d9b60491bc7d4415f3170347c8339b1d79b0349bc8324da11b6c3b76908fec55a6ad27930efb9c85df1b6ee4a5e4f4aec0332c4b685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0abf5318e3f678f3dabc0f7a0f7a5e40

SHA1
6f1e24a165af376ebd4c3bb14c79785c981bffa7

SHA256
0fea09e8e0379cb5a1279456817d3571a96e93bae578471f8e4447e99ca42e85

SHA512
b8079acdb495e88a2a624872a249aa9e562927db986f724240d82dd6b3de12aa4778668e9382d607c8ba9c50096cab45e7f68407df7b9234eb317e87f2cb30ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8dfe589a9ca2dc364ea7c883e3b611e

SHA1
55fae9aca741ecdea2fc1fa9451950a268392749

SHA256
3b3f5eecbec0d4ed421a33f290795f529ef123cc3dadb7237de18d9f043880ba

SHA512
260156728252c85ca288feeec5f1c5fbc6c21fb2b9b328cd3dc6e7a8c821ea7a03b381ecc43dc91692f35eee237d5d83355d781577405584b95b77b5ab8061b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d61b0feff570417dd82d23a927084dc

SHA1
74730592fcdc852b52fbc124e891de4ba033d30b

SHA256
df72b8a12a136b000bbf139759e82a846e613ca6ba60b1456ddae69fdf3fc623

SHA512
f4f9afa3e415bd7a1a05fd965cbf2ba99ec4f7e9c2e6754dcd4878cb274b6b0f6b9d7b029f8499bebe12019a7c826b91ad43bfcb66905d6a41b22c07d6f68077

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
210b5e485f8430f1d1bd0a1aea48e158

SHA1
b85931325db195802aa8c5d35027f46f242d2b7e

SHA256
2d07975e0823aeb197319712e1f54d2ddaca82d74f780e179e51cf7e7a93d3e6

SHA512
05e06593ed6c5c6cdd4f6e85c4db8c1cc5270ecd75ce1f8422ae1c8f385819a94830656566f6ec756286c02dce9b7980d004f7ff40664b89a7086dffdaa89156

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83570cb3031e985f08ce03e0909487d5

SHA1
e904c7dd305410d35f5f88b326e04eb0ec339b31

SHA256
f7c0ac7f72d53555b4098f7cefa24858e5a8c8e553dc8206801d3d7e910090f2

SHA512
46835878c956318262b28c15d7432b8469135d1ff153b66958c3abc72f009fae042923d820825e76b6d52d86ed441e2c64b99e89c51066414251db719ca9da65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5FC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar64D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit