e9bdab075c17224a152db99b4e4a773323f4126f888679a04c33bc565502db5f

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f801585b49198b64d2b0d0e99155d342_JaffaCakes118.html
Size

11KB
MD5

f801585b49198b64d2b0d0e99155d342
SHA1

860d30135927dfb0f9777740065b2537c1de2289
SHA256

e9bdab075c17224a152db99b4e4a773323f4126f888679a04c33bc565502db5f
SHA512

4c0d45f25529c57638e7bdc21ded101e0ffe07ae65ce747bd10be33a81b49c8b05aef86337740c9c252a6641af8f7025bc4ec515c82316969be1b8a0a2b05c0d
SSDEEP

192:2ValIsr0r57M9xuT8H/w1wvqa18LOXuBuLbdU8d:salIcIQ9xf/gg8LOXguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46F41AA1-FD80-11EE-8A04-E6AC171B5DA5} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419605656"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	iexplore.exe
2008	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2736	2008	iexplore.exe	28
PID 2008 wrote to memory of 2736	2008	iexplore.exe	28
PID 2008 wrote to memory of 2736	2008	iexplore.exe	28
PID 2008 wrote to memory of 2736	2008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f801585b49198b64d2b0d0e99155d342_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8242751062d8c1e23c3d08e3a78db52

SHA1
246a14530a2d85eeceb37e582c0b4ec74d84f0e7

SHA256
730dd06d26f78560af936bae82aa0025ee925c99c3f52780c0f423951c3d6a61

SHA512
1b61cdaef774733efac02275d47046d86535fe67b8f80948403dc24766c25b1a25cce052d064f0157f2fc8af1d5f25306e4ba7f34188613be909431158987f90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79ccad70606cd83ab44e20c1c2697f7b

SHA1
6d38b24fc33f129c4f3c4a7c00a96bc759ffbb43

SHA256
7c756e14d230f3f0ec92f5f332745dc2a853853905f989c17a031668e7206f88

SHA512
26c5c6aed916dce980ac8d0ceba6c251655ed153e6d8169788e49498e5e695c5ced06bca83308d289a74947fda587e9dee4c651b3b568a88c540b447c8da2d85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6db0affdbc21759b852a1cb1cb4abd9a

SHA1
e1281fd2afa951a3c1b9d5ef7bab65d09df5f5cd

SHA256
ac976f5c7a6343829d085924170fa3dfee38a779f1c80a03a85eb028e2987fff

SHA512
1f0be4f57d5b7207d113d4e0c5faccf5303f6ee4b0dace426686c08e92dea255243b9a4d8925c7b2d8881cead6310fe1e72f3cc51a289124a628ec552b708974

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f6edd16da231538e283185cbb249a14

SHA1
09a6aa88f2d91a3ad8de8ea86225d13d981b44d3

SHA256
b96c5a4630d305406787213387dcb8cb92241388401d3c758acaeabd716b2631

SHA512
abdca3307947732ef8ed203ab54c2d070f249cd9ceb8948e4f9b894ddfacafc09d48a16475ebf322756607b749ec4cd28a0f003c5b7913010a8069a84a54bbb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c99bf1c6088d64f19497f27345a215e

SHA1
09f288f5390aac40fd506954297c979ffc6cf5a3

SHA256
099306ff4cf1cb6edeb8a00fe4b3eca9586eee6fbe316cfbfd6d089a637f16ba

SHA512
1e89dca4dee8bea4951bde0d82bc37c416a32b36926e133750fe255c8cf7e6c5763abb7d0a761071177e9e33d9f8d15e5626680ef9186fddaaa208d2b8478774

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9992d65d06036701f66ccce8c682551d

SHA1
d87973ff005dabbad8c3c33ef9ec548ec985d529

SHA256
64edce18866aff226323f1a47ac327a6e38ae9ca0b290b81c16a25c4403b6828

SHA512
86c1a3ebf8dc4614bd22906ebb52951bda75d29e418b536edd72a5a0a808933cc492e3f87ca9f80eebee49ffc51d1490af093d7d5cdcd045c461b792cc645997

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e1e652671a0c49264cce44ee6b62cff

SHA1
00d89582243b44ec3afe5a0d2640e39f7ca76026

SHA256
33a96498e81bdbe2ec7fb5f8180d3dda39d7f5ee84e7cbfed89656038bbbdce8

SHA512
5c2de818ff7b5a68c57a5618ac16cd32c4dd8f679811a77e3c75f39afb10d98977521058fc7f7ffc93dd851d5c6a9dfc2bb7aa8bf864508cd426ec2676ec713a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a3725e340c29b27f344237a41e97f63

SHA1
beef1e84ea9b9e7ca1b334db71b2d1d64d04c165

SHA256
cc93c160040c894d796c500d16cded4f9aec4f8d7490eb175b6909138010a3ed

SHA512
2f205d4fbf280d03edc4e4b887f72350bb66b69871d95620840542e1e3800613e5bd001b1d8ffb40f911fac89dea307417ec28c66c64c1c56d9f02716d8c8b8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9C3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAB4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit