56d9a64fc81bf1ea08712c3606ccc225ee5bf023715fde1d7b74ead9ffdbff5d

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15067ad48b14ea97001aaef299eb0529_JaffaCakes118.html
Size

17KB
MD5

15067ad48b14ea97001aaef299eb0529
SHA1

3287900e0f6de867187277960e60258bcc5c30c5
SHA256

56d9a64fc81bf1ea08712c3606ccc225ee5bf023715fde1d7b74ead9ffdbff5d
SHA512

1258f0095cacdf30e6b22dc48acf17505af612c130e3dd6c5e7b887b6deb3628ab3a20f6d702aed57cb5c04c14243c866adc4d6f3dabaf0966878f10346a7781
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI84qzUnjBhmI82qDB8:SIMd0I5nvHbsvmbxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C5392C01-0A70-11EF-8554-DE288D05BF47} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421028361"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1684	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1684	iexplore.exe
1684	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2260	1684	iexplore.exe	28
PID 1684 wrote to memory of 2260	1684	iexplore.exe	28
PID 1684 wrote to memory of 2260	1684	iexplore.exe	28
PID 1684 wrote to memory of 2260	1684	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15067ad48b14ea97001aaef299eb0529_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
754e4e2151e99d7ece14897ccb77ca5e

SHA1
13c3fed5b0444b15a898ae427b3b9545ac0a6142

SHA256
db77e735c44bd8906d1e702f2c5f223e08b3e8c2ef30190034f84af46eb7fbe4

SHA512
951238b0687578b9076f2797bd4babb2c80fbc6c363d2e8a62bfe3ef78ca1be107da06f4bb805c4f3444a9cfb9aba2b673dc70e045e98a29dc12cd995630cf76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64f48e1a99a510debd0b359eab1d59dc

SHA1
8f3db693bbcbe3c81a2a1f423b7cd729181cf4c3

SHA256
07ce86d92b7c6d331475c3f49093d9bd1d23e3207ba752d72f5d26214718e585

SHA512
d132543e14f9a8824afa1accd81b68d3969248bf82569fe34e7f929238ef2bd507f571ca79d59bc819386349460766bad0400507ec9fabe642868d6dfdedccb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
046ac40ac741ec11149de44ed21f4636

SHA1
11cdd758d949b71a14cb2ba25292a1d567cd90a3

SHA256
9239521541f1e40fd0074a0ef973d5f88b47125122942164a6abf02c57a306c8

SHA512
8b34195ea26dda090bf5cf75e4a9388dd239de74d95602afafca6705a17d310919cf201ff42f8c885d3cbf0eda5624ea9f6fcbf1bb69f95ea7fd8294c5b4824c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0271e458749398d52ae1e59764dfd8e

SHA1
32d43eab2503bdc616e25fbd97f971ad4cd69cd2

SHA256
0dab0322388d7c5ba509d997e599497672ddc13a9b156b70b7c30533d78da6ab

SHA512
55433d598c556c1544647348750b17762f54e20c9822a33af61b4c7facbc8d613440f7c287a6585e4c754ccc8deaad2f9677c965f7bdb7db2f1a4e994ce97bec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49b15ed3358f0133c70baf8ce987ddc0

SHA1
1eb6722223f5bcf52c9a6d9bbea07a117b0183a6

SHA256
8323c647f185133a8f0ab9ca61549a7d323934b25aa19c578e2ba3ea4d6cf4e9

SHA512
409d54bd01ddc6d67d78b56ec417a77c4cebf90a68eb9bf055347df09ba91dff69d521ad9ed2b9614963e5416d259aeb7ede2875377deb71cd82dd06ab2a1b8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd75a5bcb83f13d0e488c1d8f028ab07

SHA1
fddb4f7281c54b6e693db3f5bf6d68b3d87be3ad

SHA256
725ba7e0930fa91e5310f4c41948d5a70fedee87573612d4c746b02e78b1da22

SHA512
529a335cfc1bb32eb21a13b8f3e9c6aae4e846ff35f6f2a5d98d5df0a9b675919028dfd3fa0b84d76f4c76b3d5601de1f63626e42f25b9bfd328761d8c47c7cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3160722b493bea5eeaadd0be6b2db71

SHA1
ab4fd18244fed799adb4599876e1bf09bc81ef75

SHA256
4c1b6dafacd6e4831f6938c97322811e97cba0664e6b3a4d78be9478f8203350

SHA512
92b0bd481fa25b9242dfaa7b017f5e3a75ff69f9a71e874940df10daf4f00f87825e2b10a3370cb5cbbe03ee82aedc50e0878998a8b1074a77adc3052121e122

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
528b594e24b3579d9bfbe7cb30594c9d

SHA1
69515813e53a19df3ffac924229b509b140c514e

SHA256
39031149bce57bd6f78414891dbedcf937337ec02dd1ccb35771bf7ac30e1cca

SHA512
67a8412a3e8febd0c62c657f5de1aa8ec4894de6eee2e4fbcf84cbae4664eead508f16fb3b845cc60cf85705fc9fb60168688775c8f6b01d5270dcbb296169ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab984.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA42.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA56.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit