cec76f0a4696bd7646c13fcb1164478a386397e24eb237ac61b04c9031b95e1f

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a26b50e4d7fb99d7434975bdb80c5e7_JaffaCakes118.html
Size

18KB
MD5

0a26b50e4d7fb99d7434975bdb80c5e7
SHA1

8e406db0eaa20ef6f964765ce3c7a830d833bdf1
SHA256

cec76f0a4696bd7646c13fcb1164478a386397e24eb237ac61b04c9031b95e1f
SHA512

df295d832a240b5cae82a134bbcc29c3629f8bd15127d59e520e7a14dc18583d6f35ea6937a02c9189320c138daaf368aa538b553abdb5ef608110b99059fc7f
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIk49zUnjBhHJ82qDB8:SIMd0I5nvHKsvHixDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420656457"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DDC4F5C1-070E-11EF-BDA8-6EB0E89E4FD1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2936	iexplore.exe
2936	iexplore.exe
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2968	2936	iexplore.exe	28
PID 2936 wrote to memory of 2968	2936	iexplore.exe	28
PID 2936 wrote to memory of 2968	2936	iexplore.exe	28
PID 2936 wrote to memory of 2968	2936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a26b50e4d7fb99d7434975bdb80c5e7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80ee4498fd3eb8f2a0e3c575247d2353

SHA1
4ad6ae0f24c290bb33c853aee8d4448e2e039fea

SHA256
b0232d44c6654d160e91618b45e8e7b8bbd15d9c65741b20b0d722354a88a275

SHA512
3b6267cf05803d3af06e961f3a5ce89f2a9b8aa0d394c3b64953e299207c209e28cdb3277df9f90438e5b0a95ecfe6144dd7553c23ef636dff8eaf8cb9d1c51c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
650a9ba1f84d2d96e908b289e5c8b882

SHA1
5c59f5ec6b60101249169dba84e1dae88518522d

SHA256
fee761e8b9754d18b4e11117a9a8d486005ff41125edb9eb778d18f14445e1c2

SHA512
11ecdef5b68f904620a7ba4f573897118645aec13262ed31f8ba0776ef6982d50422c76530867082b7f4531261a1e8426517a1df18174d014678c33a18b95e7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f87f3f67df5d94d11edcb2587adbd60

SHA1
5e1f61b42560fda145745d905f09263bb91466d0

SHA256
175ba5f5d842f9686f692d9b9160f5ee36a4878e728de49836c239258fd2a1d0

SHA512
b4fbf6ad8746ca2948a6b9d71960943dd344f91d744b2ff92779455cca97344161dabbb0b6b9cbcc84102aa6402429ffaf7de005cca098c406866fab3630f434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d5902119faf5985ec21dc765c24997a

SHA1
37d3410aa32be3b72aef87eab2acd70b2722dde3

SHA256
289c1b735050ec447d55fffd033bf0558064a06f1f6e0a561b4147b79cb6f8c3

SHA512
d54dbbe43117143a672e92691451a79acabe27cce998f0a776de795a8f95c9173a27e07e5692a74206a318f2dbdece261ea8abbdcd0ce0afaa0370368862cbbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d088f9c871103d5ae204e35b319ddda

SHA1
01d847172f3cef6d886036fe4b522ff46af51996

SHA256
a5e6928f932f4937293bc28aa497fdd74a00dd169f7330c2446925c74c9363d4

SHA512
f504127d1fc31786b54c75b0f43be1de6403ec4a214840b3bf90e8c82609072e7c7526ef572a4e254297c3e57562e714f21344eeaf5bed5cd7d32f4e66c0851c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6b61b6b5b3818613e3b8b0a48cf5709

SHA1
e102870be734827513a484c95cd5efb0777d28f3

SHA256
2677e7c78f492d51cd5df24c51f33f4b1fd726f2c244437833e85b93c576f002

SHA512
4f76715665963ddec7834d7ffbd4a51454b8484637cae6ec967c7ec6b80fc7f895ac463535c346109aac3fe14a10fd4b5c43d6d59699891f8f8eb52336482c03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e6a7918754da707134f0e15932fef63

SHA1
7586f8d7e56f2d95252ec7a15d67575484a2d57f

SHA256
18e7fab9d688a98bf7496b7e4c1440f82b37592026521c2001527b78c16f29b2

SHA512
b6bbea6b30e388aa0622c000a29e9e5ee5a5f4fb39ac95fa01fce6cb6913487d687928176538b86f6c3202f962113e0b54e9a857e4caea0ebad218d42c687d90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25223920d55c92f29ce0aef9131c60d2

SHA1
ddce3040254a8f25edc053f53389ae85de773b7f

SHA256
be90c4531f8303c0b4ef44ec50300f892a918ca13633352b5eec7b94f0a1a1d8

SHA512
a4cba449c3ebb8721e59e3a4d37645832e63c3567138f051e4d88f39f81fec6ccfbef4dda7ee02c36bfbd64a7f60c949436d6b6e977800b4b5b3be6f0b239b56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6118fc88f9da9dcff023387e1648104d

SHA1
3e97ee8215f2addb5131c6d61262876c222b8597

SHA256
a0762268e278c8894eee95b9c522f8391cdb2d369db715e72ecdd0b403aea509

SHA512
caf24122aaff4b0f637db602a228faf2d8d632c4787c363c5198dd73b1b94382756cfcc6cf323b1d76121d09264e1f36e175fc9335c0814c0831feb19068ddec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab190E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar195F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit