3dcfbe87961cde87e5bf30ae173471f0724b401dcd71edb80c4f6b1b241c3615

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

033488a082ae1f9b9d7d68def22595b0_JaffaCakes118.html
Size

19KB
MD5

033488a082ae1f9b9d7d68def22595b0
SHA1

5f4c5017de212c133adf7ab6e68cbc1cd78aa368
SHA256

3dcfbe87961cde87e5bf30ae173471f0724b401dcd71edb80c4f6b1b241c3615
SHA512

74c8dd6f896f452fc00d92ca24901d67e4e1e2b95bbe1b4942dbd8e40ec0b8f5dff49fb0e94bd6da412ba8ac68d520589440a15cb27b3f80d70a334ea2d97edd
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAILN59ht4Cb7zrJKZoGzUnjBhKKSk82qDB8:SIMd0I5nO9HxsvRQxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420381276"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28818A21-048E-11EF-B804-569FD5A164C1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1728	2844	iexplore.exe	28
PID 2844 wrote to memory of 1728	2844	iexplore.exe	28
PID 2844 wrote to memory of 1728	2844	iexplore.exe	28
PID 2844 wrote to memory of 1728	2844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\033488a082ae1f9b9d7d68def22595b0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51b31d58f621bae3da2a7f5dfe573cc1

SHA1
99988226e3857c90e856a1fbbb200c91ca089ef6

SHA256
b8e9daae45896c38d80a9774d41d3cb6cc7a823a1a1e2106a5dcfe519b174277

SHA512
8911ac0a8c1d32fe018e02701d0ae19cbd0fb741ad2be5da7e749997ba3f13ef67de73c710a2f3e8f5a704e13d59b7c3302798a6528ff5275a1d4c176bbe18d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92e52b93a3a30b352b3b71be85d7791e

SHA1
d64217dc2f9d4a1d4ec8a7a4a987748e8abbe3f5

SHA256
8acf5c710b94f48c0927dba8ff248228b6f4d3cbb68447ebd22f00c3326d09c0

SHA512
d3d7f88b23eac1e612720ba8a1f33e071ac3a10228978615df64f377693e805b24083556209e7703f125052f011687e126a633eba34250bea651aa0c4555ee30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84e12a4cda4566f7ceb12126e3257c82

SHA1
18fbe86fa3ec8e0a4c6c75123d80aa40e8eb461f

SHA256
48a79bb43a0761e4a3567465e9ea6f5beaf6d7e37f6bd0c1c9006349fddd4793

SHA512
03ad96449bc8a7e6653a2fc82bfe68e3e5f682e52d5b19646070773a2f57b90c994d2365e1598f41c4150a7a3e0b472f7ae31e9a1d4c962cf95421f489532e4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20c7975f34fe4cc44590c09b9df38c57

SHA1
caf314535a2c15815d22de11cd78d167973c7780

SHA256
f7a27bad38a1769d9c4030fb8a1ad34402a53364a5ee5bc06b6bd7d17d7fad40

SHA512
0336ea33bf79b369a2b0733e5212a33ea19250cc7efcd6530d26d9f431ebeb920aa959759d1f381d17f08319d11209f050749d3b94febe6746fafdf5428ec1a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e9b961579178f38b2045a085af46f39

SHA1
04e0ec2916d887309db9ffa2544697ac0d246f19

SHA256
2b326f98a52e752b6fce1a4d662e697f28cb27a3b1428f3a4f79c46cae9bb239

SHA512
0b928f0d0ebfe9d2404821f6422495e96388524f38ea7b4be7f5350d17e417c82234ab68f96c411ae0bf42ae8185c7ad15d8ae14c6af7b797202f690b6176777

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f19a7e15d8c70e4840de492d25e2ee2b

SHA1
aec1e681523d5ef8bdc0402e81363a2d2249cd3a

SHA256
2058c2d2205509cf9504df6134790b7e824cbc32199f6d41aab5fe78cf3a6f3f

SHA512
5b743611e5ab71e3f0e09789db5f14d992339cbf179ec4f1f465b5cc0d3beac7d0916a6cff3da3d044c99aa19067919719ca0274201c739e120b8550dcf97700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b14327c633075fb076502669511c0f2

SHA1
bcc7cddbce60545732006b4657405fe80ce313bd

SHA256
aca759024ff58ae03b2edd62af2e5c193091d689d64afc14775e5dcd0982760e

SHA512
ac5bd857acb89695e93ad1833d6e180d9dff0e14df89cc6e0b2814f25a6fd9b434df03dd1bd8ebf1fc8a69b5ef02a4000dbe0070710510f91b76b01fc05830a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a851f873088109a644f5385c1bfa4747

SHA1
d0d291a8cbc4f00b438db7b296f48d4c8fc4f736

SHA256
6d38594c2cb327b6fcb2da49a212b325eb32b065edf4a45758baca466ec0f421

SHA512
8352cceeb919a6e742da0872c2019aad048de879fc171d9abda5c23313b2d723338a242a9888f0170d7e7273887c708dfa24b2f13b9ff0c8b6e246dde775ee14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c38a012cdd0b0222383227676814568

SHA1
26118504905a51d550d279ba78e3fffaa5569d68

SHA256
3cef59e00240c037b6115ded767865fe8333bd0acb708b7d309bc020d5e365fa

SHA512
90308fa08c30a982e927da1280a726cb18892c1dafbf05f2d8da4acd5a446e15479c7b1ff44c98074fc0459cb257042aed992f5ef31dc175397330a36cedbb4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CE5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DB7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit