4f410662296b1ab76672ce7de3cd1859c14560834f295655a7f4decda3bf9c86

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

080950d3981564863bcab628790733c5_JaffaCakes118.html
Size

16KB
MD5

080950d3981564863bcab628790733c5
SHA1

6959aff610774f5bd4063b52f448387bb3a82126
SHA256

4f410662296b1ab76672ce7de3cd1859c14560834f295655a7f4decda3bf9c86
SHA512

9825e1c103c910e316a49454ee578f0deaf1315b000e165062894c9d9ef33324ec739926df0ff298abab84c2526d2799bad1aea200286b19440da4dc7574888d
SSDEEP

384:X28H4dG3/i123OJ+HSBUSq9HI0/e2BMKDJ+lP0Du3BCa3bS9Bv:Z4dP639o022CVb353e7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C6A74D1-0640-11EF-A5A1-E299A69EE862} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420567711"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1768	2188	iexplore.exe	28
PID 2188 wrote to memory of 1768	2188	iexplore.exe	28
PID 2188 wrote to memory of 1768	2188	iexplore.exe	28
PID 2188 wrote to memory of 1768	2188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\080950d3981564863bcab628790733c5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d23603548a9f66aba1548b83fd551ca1

SHA1
3f98c1b716ff64e89a516b7e53dc53baf99afcff

SHA256
42bbcbd3480554057e86b7b032eea84ebb38ccf4d757bd925bab6f4856e85295

SHA512
487f3b13362512d36c520293a19e627d801dcbbd9bd9eca9cc7e10ff63492ca33c25343e84e3a3cb6fc13576c3205cd8ac8aa81c716c6fe3893bccaf5d2d1aa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0cfafd97d196abae2dda0ef39f45ab8

SHA1
e4307cb1bd248e35b5b5d1f1b12f6470d29b1d67

SHA256
2d49c779325d5addefcbd6ba8db8fd410d3357147b4d668475865eb7fa7cb80c

SHA512
8b06e986de51a92a74323da551dfb679774b560075b833d4c34f15ba183b0ee7d768584a800186a9254cf3119c1a801a7ce42f8a34d713f869139c8c8ce8ae60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d724964296f64d2b4c8db6e53e3bb01

SHA1
6d346f58ebfdff569f1d26b4d0b01d6b3bf6a64e

SHA256
2f2bb97916a26b2eef1fde49beb49a375317d8468df5f534b4fde100c622dc68

SHA512
5cd0b608b7aa6d4a464f18d182d0089bf7833ade002bb7a776e613a9314a16b233acfe9ba719adc9ca347ac15199c90799054f4ae24eabdeab26231da4f2f25a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52d0675d9550a513929954d026311ca8

SHA1
dad04275e73394e9049cd477b3d2c155efb83ee0

SHA256
70d912952cc49e8bf06607daaaf1e00674aa18d7740ce5eab51620006f35c396

SHA512
668d06144204c0e8c63bb550759ec1969151eea8ddc323cd78fe7940b9ec1001dfca35c174f0473b77e40771517c89874dc3a0976af1d288e37abe528b020de3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
034a944b59542a7d192440e2ff7d8968

SHA1
967c4166a4fba8464d5cfdb2b855814cf0c75f9a

SHA256
e28e2d7d05a75d5abcd20fb78a62a84124561aa750223166f84d0df2312653b3

SHA512
37901ed8588ec54eaf1419fd77fca6599f0e864b12c018bbdf929415737ced5a50bd9462e4d55d5f840958aa7891b50cfc4cabddc56139d0a968ff7bb81044f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4abd6e0cf4fc36d9dedc03e6b52c9eb7

SHA1
3f869bb3ddd8516660202770b80a04bb3085dea2

SHA256
a84f2d2c5fd69f49cff9dadcbfcffcddc083fc7f87527b129a0a7d1c095da659

SHA512
b0ea9a0ef5ec5b25d25128f7923cd3f9055f4bc8f9f10c0371df1cf66b6207bb674c4c6768f96b777d11f3a4f8b80dac1f73a38ee79599ade4fdef807b869c05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c2a261aafb21a58c46c18b08f580b3a

SHA1
1469e6b8e6b916edb1291684a67139a82e2eb8c1

SHA256
dbebd8937c55dbf145c09998b24cf390a1bd50740729468e3e5527351f6816dd

SHA512
315a643524aa713e0b686054cb409738ad91b3d4d263097abe74b4364653740efd11f6b087c235451061a639630e1de1a03f5e04e178a31e0a953db12e8fe4c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bb87eb9903e42eb291a967311e05009

SHA1
48c2facf5f2a0a9983abf5850a9c775ead647fde

SHA256
a34d7a5006f76b516369b5ca78861f5c721117a246abcff7b270ea118df6f61b

SHA512
f698cc48a51c87d13b557a89a52f9ca994a224c515afe466ea268bfd201d86f2da52b2ea14827b732edc10e5ebb2dbb0e59728f4fbd86d78c23c31b2d2ed8853

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE07.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEC9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit