15fc8b9d87c84d378d8f73525029d9c8a54ca2acde053481801d219dd8122434

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

068abc8021ce1cb0838137e98697a6df_JaffaCakes118.html
Size

19KB
MD5

068abc8021ce1cb0838137e98697a6df
SHA1

6cc2cc2b04a33b23496b1c27e55ed1fd9a7b56e7
SHA256

15fc8b9d87c84d378d8f73525029d9c8a54ca2acde053481801d219dd8122434
SHA512

784cbf74791d7dbe4ee1a1118977fb3795a8f92a701b050a765acffc1f66737b816e18a50ad10e23670e124039edcc01f61fb4cc5271686a5c7a198bda817076
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIW48zUnjBhQa82qDB8:SIMd0I5nO9HLsvQZxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B01A55C1-05C9-11EF-970D-EE42DE2196AB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420516795"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1720	2004	iexplore.exe	28
PID 2004 wrote to memory of 1720	2004	iexplore.exe	28
PID 2004 wrote to memory of 1720	2004	iexplore.exe	28
PID 2004 wrote to memory of 1720	2004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\068abc8021ce1cb0838137e98697a6df_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f8ccb07c1cf7c9e1a9b373961a9e8469

SHA1
efaf0eed0e33d1713750b51f93a4c9099567918c

SHA256
993f39e0b5827db4aa3ed3e1c79da9f80f8ff9cb1eab8ccae2314a5f2b87f551

SHA512
b36d79e483fdf222cad6bdb33069d164bc526082b6d863d6211c9bca274462c26c66b6f4019dfbeee4354ea042b44df813aa66b97f263b34fba74260dd99c0ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
74ae3bb0b7841a838519f0108a08f2a0

SHA1
bbd549f61668b5c273cf0181ff78aae243584a92

SHA256
9fa7c4b3500dcd00dfb3800f2a8076c8df63069539ac22c85d93b7d45d8100f2

SHA512
37dbe2b2eb99b87ce4fa5221cf5e402bb6a3186af9f633508bb4d363fec02f1b8674597b1e04e85d65d761e68e28c83c524ea35a15f31073adc3f77ffce66c6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f0879d0acb4f825a293ea2c347bf6380

SHA1
6207eeb1cb50dfaab761f11ea089328fd069eb2f

SHA256
2906dad5c440700e2855be55f548965ace45142edcf4619bd4d606e57864e974

SHA512
c13d2e8327ae08a472cdfc034793881a546b0ca6a4e4425cc6c3ad67ddd7cd360819f0ba18dbff66b0b3d94d6dcf6c7048ca524dee19e562ec3d201443a26c72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
aa5888e0ad871cc4b9e66a38b0ad599b

SHA1
e440e9f22c7e8a314941b6f7e63124c1582813ed

SHA256
c9a5528fade3898e408b58f65102c069d4022c3ab4609dfcca3df9594511dd2e

SHA512
9e22864cb510c76ff84127c0763b204d19f4204f5a62a03c80a8f96ed2097c4727b451fe5dbb75b2ec5af137359cb537a5acc7b82e4a050530ae37a182a7ccb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b40dcd783d5062e69c332d1a56e11ef7

SHA1
6a679443498132d1dc9aa54bcc74c63c0bf86b4e

SHA256
f018fe6d9dcf553e430e022f0f748f9a520d72b2338c19595dbdc56f1855ffb2

SHA512
51ea579cb244fedfb67beb7bb0fb84628cd53d60eecf394329e6654062139bfe05e54a30739c981d0c87198ee272c1092f4dad2d78140fac6b0d8285edbfdf04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3534603cdde8e2987990e792e37acf80

SHA1
f25d6888fb4d3069071e1da602c4eede7ed3420a

SHA256
31ca1503e09c734405c11f52088390b0b41cc44976fb81d96759b5c60bb485ba

SHA512
5e45827f24b040f754b77eaeae218b834a755738405ed838d6d0e003136a0776ea46415ae004ac4461e16bc25f5e23741c0efb092b45d621aff5ffdf9bcd1d39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fbf31a28a5bd4407735eed2d0fc46771

SHA1
41c36135c21495b55a876746d50a6edde0faa4e1

SHA256
bcbd86533c9c52f7d71389cf7fe35830a18777bfa2e1643451f58fb8989fb600

SHA512
337076924785bdc48b82e3f02ec4ee8d9089ee8d0bef873c581a244c9b8f312c473504e0234fce20f6f78c7191270db440c1d4d97904e6473849dc1ed05c67df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dbbdeaa2794b39a4dc70e6a7d5a6d3bd

SHA1
7e25a8374c13b3a14f793c75d58ed35cd195ba26

SHA256
d0723cf97f98d4207aaf1cc79078d6a801d59f83b3c64607d7933756157b0e74

SHA512
6abd9671f43673b8995b6279cf4291ab9956c71628384b26e8d284a8d585adb010d8be9e05f44b21056d62a9bc379aec2ebdc624055e9041c5030b19123eaf3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d4eed1cf54aab75408c5827409921f4c

SHA1
726535c280fa4883da431614c5faf3e9846b4c69

SHA256
bcca5b6c86fe207ce355279720bdf4a28e18b8fbd396756cf5dd430a121b1371

SHA512
2704ccbf2925abe80f060fd0e36bb9725a55d3583d84447ac77af4e9ce19bee4ba71e1e3ed89cebcc7dae6bc47f33d9f793d1a93672cc9704d99257023326ad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6836b4caac49a4a454a1de87c2742de3

SHA1
3e5ac422c552ce590bb696916178adf9e58ea54c

SHA256
7f678b0bbf426dd34afb78b39d6b0efddc4c26dd20e2829258d68ac68be3fc86

SHA512
422e2104032d0c14e7158e6e58bcd52c43b960b8e81c40773b0bfb7f64f8ac718506cd834226269e537452dc81ba467d2a99d152e3b58b30fd9910cf3403a92c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7DF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8D0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit