eda43a74e9ca4e9fb640b6515cb5564327a6e6580f1797d7129d8605e62ad191

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

028d8e3719027aa37c409560db671114_JaffaCakes118.html
Size

119KB
MD5

028d8e3719027aa37c409560db671114
SHA1

5312a65762e1a4d0fcf6fdbb9d2114a4f4f3a62a
SHA256

eda43a74e9ca4e9fb640b6515cb5564327a6e6580f1797d7129d8605e62ad191
SHA512

977bba22a81aca4c0e9115da246d41fd30cbeddd1bce447b916c35c6d5be5fefe8e34949ac5b209291db4c24b63cc47f898a6e7187f26558fb8fafc4a3c00dfe
SSDEEP

1536:SOULyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCY:SnLyfkMY+BES09JXAnyrZalI+Yu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420358448"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01F182A1-0459-11EF-B7D6-72515687562C} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2340	iexplore.exe
2340	iexplore.exe
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2836	2340	iexplore.exe	28
PID 2340 wrote to memory of 2836	2340	iexplore.exe	28
PID 2340 wrote to memory of 2836	2340	iexplore.exe	28
PID 2340 wrote to memory of 2836	2340	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\028d8e3719027aa37c409560db671114_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
8848f0842719c06f3f5e3d6efe23acc4

SHA1
c451109d7ad92be420289a1aa196acc0b668cae6

SHA256
e3977eb4868cfb5aada6bb6f6a4c449d414e856f9b2700c18a2ed3c5cc7060c8

SHA512
e532c5bb4aeb8e4b795a61253cca2a05155b78c303dbd21990e7c503e755538cbc4da7fc1a724bb0f18fe53ab49fa462e9b37585fea13b1bebfa45128651f13c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea02181bb54e60f2caa1c0a96415c3e4

SHA1
2551f33a04eef46d0bc8d9b80f6325dcef4dc10d

SHA256
807644afa2ae95753cd19fc787527212516c73bcf09175cb1422073b94d0947f

SHA512
47f4b72dfad404c2f121ad2506687f2f4428acc744d01990da9de9875e9e45e850d242fcf4eda3bf5a0b50d27ed2d3b6a828e6357679dcad2853e8124fab203b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cd857894415cb205f71127f2e407498

SHA1
3d7c127167197eb9b7831ba0148ba1af5d172853

SHA256
832d194c795159c47c59632fe948f8ff51137adb354471c219fbc7ef85f19855

SHA512
5d2d8d9183975a7a2fed61c4639a2c00fc78fa520efff7e14fa4e26d23922048e77c1dd9b017f5f9f89fad148b0ce744042ef336387bf65ddec757b7111bb278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fcc006063304b1b2fe47211672179d6

SHA1
7e2d1f56647ae25871b73918eda2c7b01da7b7a4

SHA256
7417c23a72adff26689948a70510c7186cbde0bfddf19b86262bfdb25c28026a

SHA512
3e760988ac1f45635569d4f4faad5e50a1079bb7f11af68da41513e4894cae3f50c4172f1796ac6847a0e0026a769671c17034c09035f288de6b7d51948b443e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4737d3a6cd5d2f2f701c203dd2ffe07

SHA1
b33f960af9f9360d08048ede699604315de181d0

SHA256
d875782525dcc8da2a8b9c3231748c9ab6f53dda0b09d988b811a1ec9787f660

SHA512
71a1198cd0c62531e0b07e36b07f670a610581ecd72b7c144f065b9547f06c57c0f16a80bb84d93b42d831fa3dbece40d84d5307b64bd5fc4b09d44f6873a3ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c2b75d333fdead2005da52da7185895

SHA1
9635197b12a16bf3b381ec7a1b597ee537ba4fe3

SHA256
17d08ca008e0243b0b709080261bf37087ab39cee471c4e92a45fe0b7d45bced

SHA512
e814551fce30c255c53462d58f649e40b105f01a3e78ab5cdb56515fe7abe820032aa1ada8691cfd29e8abe260c51c93307838f4a587cf4446dfa31cc7469420

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8de480343e739b3434fe4d8017cf22d6

SHA1
a17bdaa6ff7117323c7388224b7445b286771074

SHA256
196729896bba3c3a40e8f0817d4a72828ae8bbc55f78d553737812c0b0c46233

SHA512
37ef3afa97b6baaedf30fb1a6c4611657bedb17a51b5a78e938ef8a3277798aa6804de2def6161f5786425e6e1af27017e2d7ff662e3423d91fb8835fe9ddb0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
273a96c1a0841b5946e40e2b15569342

SHA1
06e557673f8e68554e8807134d885b80a11191e1

SHA256
6392df637cdd4763ca9464a26bcc45a578de9bfbf18e9aa2195a376fdc5a26cf

SHA512
b22b68d82d1b2ca9a9800054a92d4c6fb0c965584c01dc1051055d3d1a828e6d3773afae957ebaabb0dda149474d44e9cbc7d77a57cfccbd8afe2b235e348143

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f573d8bca4feae284c7a9556b76b489a

SHA1
6654355dcf6a38b66ff28f98f4c3156947933979

SHA256
482c11dd5d18091858104e2369b91ae5b5beea18abbf3fb528f4c13f45784c02

SHA512
8e02b29f592e3dd51fd8043412117e08f58e787ef200d15b5f2151a5908fd104d374e6b10adc53603bd21b4d5e2da00ec683e933b868237d7b0cfca234d8b4a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c47aea6971e55632e1bec4621650bda

SHA1
3fe3cbcc79a28e22a92fb0e9de471bce9b1f9f97

SHA256
b524d8dacd034e02d1558acb6fb47134c2102bcae73dc4aecfdce9f8837009b3

SHA512
14cba3097049c4e28ca184b9b4ef39ae9b34ced088bf742ebeba0612f7e3f5b93edd79ee5d9df5afb64f48027b11578e27f634cc25dfcb73c9459c62302c67f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
04cef267b47499ab28164a8983c4eaa0

SHA1
9704f9614dbd6a3bfe5b5a71a3967456a8ac478e

SHA256
872405a59e02aaab3962980c402f4ba2118915f6d1a1f460995d3156c2f4f27c

SHA512
498d6df3fc404968fa1f6ddfbf5a3fdd179c92916438fee6ca3d6359123ffe938a001d8ca0f3c967b4c2e434b240d5a5d366d9348ca79c39e6c9cda1fb4ac305

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBD8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit