e3b2b07ecbc1cd7687a32156572169aa787e4737ca4e982cef69f0a7d18b38d0

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1bed12d733201df4be5df3133444595_JaffaCakes118.html
Size

21KB
MD5

f1bed12d733201df4be5df3133444595
SHA1

22f187ca9928b1912d1fe27374e66f6a4ea88be3
SHA256

e3b2b07ecbc1cd7687a32156572169aa787e4737ca4e982cef69f0a7d18b38d0
SHA512

31c3341cc5ea918be92f9460a83b0ab4022780652190edf0ef59db2700b7cadf3b42c1bc5ad2f941b31ba9d7bf9e92f5782ef5f6a6c3beea76fe651b67b0bb2f
SSDEEP

384:SLlIcqt2423THN61+7M7e861sPN6Z8q/gRz6guLZ:cZ61L61x8ogF6xLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419371107"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2CD358D1-FB5E-11EE-831B-46E11F8BECEB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2988	3032	iexplore.exe	28
PID 3032 wrote to memory of 2988	3032	iexplore.exe	28
PID 3032 wrote to memory of 2988	3032	iexplore.exe	28
PID 3032 wrote to memory of 2988	3032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f1bed12d733201df4be5df3133444595_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c9d98cb71fed4407cc1e49089d1f3ec

SHA1
69f550ef648112959c4a6ef6f490ec2312c9407a

SHA256
7fdd3d9f1dea717b8ac232ad3dba39dec8434f71209aae9b9fcc3fa160273416

SHA512
2f963319aecc6f6d74a6f75e7b940aeb1e3c1cb3838812c5f4d05d141d3ef2e985a55c271b31b26f03799df75be9d1c89bc1c490ef67f7e743d328181d84b636

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1839ff1faeebe972682cd1008b7d242

SHA1
08b36440ff058b19d786f9c4a96c3a34da285c08

SHA256
2b21ce09b66cb130d6960c5e2eeec839bbf72869b6efe60cf3bca5c16c1b440d

SHA512
35072490c6be66b272b4893bb2500449135810569e966f08d46070b26f106d28e18a849c67f1294213754e506868cbe6c593f1e4d9059339b5a2adedd5a7cad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07642df61568b8c961e961753567c480

SHA1
baab52d52bd46bb35f7d2f998270fe4329f3af94

SHA256
b89aaf65da8ece95acd053d16bf51d42762e997bc6c4c3690011ac571a91ebde

SHA512
d89ebbbc655a3ee2567cb62c3a83c08c3823b86f8030d4e569e6804cac41a38648d69bbd67c3580f9e6d23ab6fbedf348126761804328b38d589923e1d08ffa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2be69e40ee3b4e70aa98e24f6f5245e

SHA1
3f9a64369d49174b3ee61089c5a3389aa1f7e683

SHA256
05c024b2f02706cd52ad99d4fde933d3cbb298a3f7141d3adfde9bba221fe084

SHA512
f093ee963046a60a6900484efa434bc6575bae04695e6943b9a4cb8bfa6bc27bacaa95d3e49526f8cdf033862a9ce8984db9c19aed5e4f3627a6322d92ca2029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cebdbed6bd18c2cd5f8a3eab8bd45130

SHA1
290a28c3c2f74212a8862815ac16c59fdf3c2470

SHA256
7f269a48102630dfbc10e95247a2a42a3e1f59fb33ab4dc1044b90a2694baeec

SHA512
291d7cca356abf4e510352312044450b42f5ed8be0399f6eaae360848c6e2660f0aeaccc07530af7209fa954d7b5ac3cc4fc2e632f84a319d9a48a742f846667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
565eff4176e200d87668d32805e0d03e

SHA1
bc1b6417ba8eb94b3f3d5d018a946ef986cda332

SHA256
bc0c060483d6f4fa459377e42f9b4a642836918d5c98d54605c0fd3d5a8218cb

SHA512
ff957fc07b44b6b1c4246b26d4754635107afcf8c5ed23eccf88808d388a0e65d395b9232dcd6d6d272169f1b5c3a3af96d85fe7d022fb52e31cfcd274606679

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b6c6cce1653b126c3d497da82263722

SHA1
14e06efdf470b994dff85d1d6f3310ab69304a98

SHA256
4447efa255ee2925814098eb2c05b74de12739dc839090dfb3e5bd020396c027

SHA512
43281a64a8f4baa261638a304d1eb630a1cf65feb80ec118cade9814fac3aea4e4aacc0acdb78daad8a9562a4484364ff0f91cf4d855071cc0be83eb611bf079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecafe5aa18b67a7216778af80cd1d3ec

SHA1
6c50cd93636cd97270371e47fde8a2f91d717696

SHA256
5bd2f1a811aa3609b47cb821f997628b35739a8777b70237be250735de547a28

SHA512
aa90165ca7cc23f148d0ef460b33c2a69464c61b75c5043d58a6fd96101f1a13f25f365b547575edda32453a943d64cb8fd5d1a93da28b287a8c431accb14a67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da2971702ce685dfd0558cc430cd8ca2

SHA1
c75131b3feac282ace4b373616bc07affc9e6bd5

SHA256
6c9c4d84ffff140bb5c69fec31b71d4d2b056f3202113b31b901eab38ca3b5f6

SHA512
1e8e73908b3cec6a2cc447285d8e6aa048449a75f3d88285c29b8c2f73df094708140a172b33b412c8999df1b3096e363932f87bdc3edb2b8299ab121d678687

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EAA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1FE9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit