22d3110779890613189e5ef4667b56857f7bef634c567fb2947013a6b2df6dc7

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b5fa3dd8d7da925ec74f5394e912e0b_JaffaCakes118.html
Size

27KB
MD5

0b5fa3dd8d7da925ec74f5394e912e0b
SHA1

f4867292c8e6b487b2f6eb96f53b23e3397ad5af
SHA256

22d3110779890613189e5ef4667b56857f7bef634c567fb2947013a6b2df6dc7
SHA512

b12afb8238c9ea59317fd78581b0cc796023dff1fa94e3fa2e9ff9fc4bec0440637c7a3596db102eaae8bf871e7205d9803097b23f1419a033bff3b5a1313078
SSDEEP

384:SwlbHtUE/aNQnKBwGqByVkD5As55gfp5814QhOj08SMFPCbbKsc45FJZoDl:SwlnniLqBwI55gfpzj08HkKh45+R

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A5575A61-078C-11EF-8356-E61A8C993A67} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420710480"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2552	2972	iexplore.exe	28
PID 2972 wrote to memory of 2552	2972	iexplore.exe	28
PID 2972 wrote to memory of 2552	2972	iexplore.exe	28
PID 2972 wrote to memory of 2552	2972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0b5fa3dd8d7da925ec74f5394e912e0b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0af214a3556f978b5b7673aef48d0838

SHA1
3d2cdce72652effb1e23b57b293fbef477b5b4d0

SHA256
604e53c546f919253a30a3436af72e02597f1106785bcd617f6379c4969a1c03

SHA512
f1eb85aa064f1ad2135813d8b637821c22182c815a7a7b7a2ac9af706ae16726fa137a827efac49852483d57f07ae7d325156a6878af2063b9d335768b8b2d7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
201144bccba573e1b4b6612b21c036f6

SHA1
519fce3514cc8c1af4f91ba6e83f714f6f9b9517

SHA256
75a35fb4462dc105a507b9b9b2f6f9ee38ce309d23a23ee9ef32c299a7bfe67a

SHA512
d04965d644343d2afcc6b0992b9b473d0324f257f58b4909d51ec18a4913340864b0aa459e56ae1645231030b11d8457e068e0d1c190ef638a0a7d7f830a347b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a06d0133fc28e39b42a3a54d1b15660

SHA1
2526de4ab166ce8944707712524bed60d3200209

SHA256
29cdf1db1476440a935f38bdb3bcb61b7e9d9292aab80960f359acf978b16888

SHA512
150e83220776ff14e56ab704532e0e3a4acb1ed895201096a29272954ac67a23dc9fdec81c024a92ed4cace5a50b0d89ead84636d2c5b98b44583f76b37fec3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d5073e43408035d46bbdf709783fb94

SHA1
7e047851c78ba264eb0e9a505f9161a188b05315

SHA256
c0fc56d7e6981ae5896917c87e6b2921372c6a38deeca36eae6d42f9174a4a5e

SHA512
1a576706ff98ab990e2862c50b94d620313dced1cc17d5b62f3c17174df9e44d854cb886206fead898a20d7c62ef06a8846d9fe7594c5f86afb628ba03fc207f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1485f9ce6a1c504d739016e48c5c2b06

SHA1
e8fd332b111914e19539d4ec9493dbac0a4316a1

SHA256
084fc3f73511ac2945e16f06b0a5aada7730e409b221bc9cee5a790cf3249564

SHA512
728d44c29ea3cca82e829431c9c38beb8c12baccc33c9f0dfee7897f3e94fe6c847df945c8a0d51205aafb37102d91ae70ca39adcbfff46901280bde255bffe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d956e8b8140cf755a313f1311476284f

SHA1
6925c657b2b24fbd17ba62437ac0ea57e63d1d42

SHA256
2b481024c2bca9a176e92b0ff32769a4349aa435f9c8a9b777abc31ea5f70f4c

SHA512
925e25003df5871bb2611b4ad2058fe84fb38b29619dc46669071fee15743d84aefe23d88597c66059bf926f473e4c335ed46364dd079933451c6c4debdabf5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64b61b61b03b03259408c09639bca874

SHA1
020f9ed69206462f8306b9e6530601fbbf1515d4

SHA256
be8b9981cae9dae82d95c64b4de18a8cb09ae520e4d4fee47ec6064341bd5634

SHA512
1f12a68d437d8604b1db08926d1bbb759ade374839085f9cba84ff6096f1fef00530cd2f46e4ebd26b50769b7d926493e102e4b8327b8d572cf4aebdb6f41ee8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed01534690b312f3a35ef983393c68b6

SHA1
0e8cf860864474575bdd94c593b4cdbfae690b4b

SHA256
f33c22bc039ba1d9628d9073e74dd125e620eee9680c924ae5f51b5554fba415

SHA512
22c6e4db4f73cb058b25078a3e8de5ada4466a0ffe67bd01a4d70ad2036337b84167480d5283a95b81b101875a7ef6f370fb691f8f7ffc0f3aac8d62bb326af1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDF7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEB9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit