4a14a79d0983d68b01fc728c4145e360c89e03a688ad524e829e5350f450f6f3

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0836761462cea8abde2bb3d4bc81c2e6_JaffaCakes118.html
Size

19KB
MD5

0836761462cea8abde2bb3d4bc81c2e6
SHA1

03e1d263bd5dd60b9bce1f0aeffa5e96ca10af6d
SHA256

4a14a79d0983d68b01fc728c4145e360c89e03a688ad524e829e5350f450f6f3
SHA512

2cdc509b5cb51db444d125913c82c270da970a9e41ee3055ca951237741a92a60a55f528ffd36d6fbc7b7e32501cc343da92e51b9b402a4163199e8f9e85ba79
SSDEEP

384:SIMd0I5nvH/rPft7FV9Hx4vWFsvpJhwxDB8:SE2rPft7FV9Hx4vWFMjwA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6250A721-064D-11EF-93CC-729E5AF85804} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420573358"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
552	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
552	iexplore.exe
552	iexplore.exe
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1912	552	iexplore.exe	28
PID 552 wrote to memory of 1912	552	iexplore.exe	28
PID 552 wrote to memory of 1912	552	iexplore.exe	28
PID 552 wrote to memory of 1912	552	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0836761462cea8abde2bb3d4bc81c2e6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:552 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35d985b51fdad0c3addff8824237dfa8

SHA1
64846013b5f5013cfcb4575550f98fe2fa9b2880

SHA256
d955a0368aec209b8bc6ede5cb22887044c10eb7853d267051ac1c7b1ea8ec44

SHA512
8d00dc1d33f7c7faccc25d6ec850b38c67c5ff8159d5b44b280292b868fa1230ea3e2a18bcc633f37115b04443f93cfecb5dc67d4ace2a64bc4945363e52b936

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36ca7ef55ab8c505f28bc19fa443066a

SHA1
47c986d276af5181d3bc9037e2c3ec2259b4d6ef

SHA256
8dc47144999657da490f58bad7199a8cc28fed4b866f32aaf62e1fcbb16234ca

SHA512
80c888d942226c12e982cbe863a551afa164e655436767f2ce12df2a5f3018aec264ca96b9b842f2bad56ee1636e77086e324fe94bd5b0ac1b83af2a56fa68fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c20130f519bac65d7d2290ce2f23dcbb

SHA1
1e538b49b3b4e68157b12bdf80eef9e7cacca571

SHA256
eb2266d2cc2950401f9e19b57b700c39da906c8564655b68e76f34e5500e55f4

SHA512
cd174e3e507f4c30ce59b624f1fda43503a5b6e0bb475cb2f5215eaff6b0af186e6a8ded300eca90d17503000128fcd5715af1f232190f8fcc0b3833f2e4c0ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b140ccc482a1428d7207c17b82aab18

SHA1
a2c5a2b8fee1598eeabccce1bb621f4f0ca8855c

SHA256
a480bb08103aa6d7e046595412073a544bcc1a330ea8bf257ee5d1e9fe39b027

SHA512
96331037db50a90d4b7344f8d5a89e85ec9310c50376a9b698a4a186f6631c6889ff8ef36d241e21fc94fc1211902861e0ab4732b1d9c8be2477f3b3a602390f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3de74c68c5756573b9d6537b948eba7

SHA1
9cf58afbd412744ef90367a9850c20e5e291cb25

SHA256
1e28308aca1d3cb6d9361783e1bbaa61ad1eada48e43dd59a2e0a11ee16789ed

SHA512
a89959e5de6f5d0d3a469196502f718e9a0be2bfd4044f98b6a87e8f65c509780449996a45ce31b6ba4b4b4182c2852bf2e3c0e60d4bab826b675c4c502e9e16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b243fb35319eb0ddeae900157c471ba2

SHA1
b006cbe556803f902e23443c8caa5f78dc0a8ea4

SHA256
981ab449460c469fef38b02c1b28b178bb8ab35a40ee3b53e65576c83a64c8be

SHA512
b301e5742ce4efd9e162aeceb06736b0d2495a322f07b8b395a70dbc2393f00be2d052a16a0ca4549ce6b9994b6c951d2f10d28a68a0555b9e5ed5b7a0dbb4cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
821af7c8105bc09ea46dd849f5f92dd3

SHA1
bd291e8077f1859c2ec0f6b1cf435658ec14bdf5

SHA256
9b257a7b9d3b177682058e4dd414bc105c09f99dc2819d2071af7d4dbb463d9c

SHA512
143fdc0f43809bfb3d1940bf9753128a9c335bf711bceec5302f996445b1557a0e8199bd1d8ea1df7c5d93e9c4b81b8c5d17257560a139e3dc05bb8382bdd713

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dc529bb8d39ec80e1eb9a6bd7785018

SHA1
63d7ec4d555bb54db52ac6d81c0692608cf7bc64

SHA256
122e462dbbcc118581b0222f5358195e868f6bb70b0c569559d2a888cac9eb75

SHA512
7cd885894397489d45df9f4dc9784ac4a40043bbf146c2491ba488238d8c0bb612a48126dcc46c0962026c68cd1f969fba05e941cac6336a4321842b8b3386d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34fd30480faa32a7ea99c756fb74e569

SHA1
fd652d6c5df37584d99ee6a5f4d97208a2b75689

SHA256
17caf549051df9db4ccd052ccd14fcbc7277bb2c51a92b28e354e5cf3ddb6af9

SHA512
3403d7a3e79e56ab7230487a9edddd59652b0d6c4f3dabbdfba1588141aae8c85401691264ca01eac65fc5da86e2b281a5a08a8c74e0863220563d618fd97646

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18ED.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab19DD.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19F0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit