2907b419a3c3a7f4151f610b4e1b6d6febdf8cf8adc23037d6a20b06683b44a3

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

146843b679d11be5cfa4394b4cf2348d_JaffaCakes118.html
Size

17KB
MD5

146843b679d11be5cfa4394b4cf2348d
SHA1

ecce170f123a8b5e68e68c386967608b9bd6bef6
SHA256

2907b419a3c3a7f4151f610b4e1b6d6febdf8cf8adc23037d6a20b06683b44a3
SHA512

01c8d1e63e4406b4b9c12e692a1f17981dac1321b1a4ba4b9e056a167fd023aef23edf6488eb2e37828599634b0b16e2653f13a4cf4ccfe9ba31cbf4f1852551
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAk4NBRDr4t6KqiQXEd8zUnjBhlkdm82qDB8:SIMd0I5nvHTsv6fxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421017211"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD82C7A1-0A56-11EF-9988-CEEE273A2359} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
996	iexplore.exe
996	iexplore.exe
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 2532	996	iexplore.exe	28
PID 996 wrote to memory of 2532	996	iexplore.exe	28
PID 996 wrote to memory of 2532	996	iexplore.exe	28
PID 996 wrote to memory of 2532	996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\146843b679d11be5cfa4394b4cf2348d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ec447d34aa8a1caea6736529c2cc1df

SHA1
4175c818bdab8593414e479c3bb49b9625e178fc

SHA256
f9996ccf303a671e0556231683f1c5ba1e022b0d09e934863ae39d528804a1e0

SHA512
f871bb941f5bfd6e312b62ecbd9f75dbacebb2c07e423503c3e8ee9443907831c2d8c441a4c5203824402d90d9c11e237d4f3dd9f3b0cc7aa169bbb8bfd01356

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
993665e49f3ec632a46031028e01d569

SHA1
293cf6881b1a687714a4201cdafa021388d84765

SHA256
74dfd5d662d2903c5bbc9c70b662cb98247e76de67be64b9c8d77e1e3df42e04

SHA512
2e59b6a37bacdf6e30bf904c7aebd27445198c8af9b2c520b111f7d0c026b076657e3de54ab9ec72ddaafa4d4b9d629f3c77bef259f3fbd47900618a0fa4ef2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
899198ecfd3c6e4c302c749621f77882

SHA1
149e0d5bac8441d79d294ffc9b2cd2bb7abd35ae

SHA256
dfcd8b1f793391d185a1fc740ee7f8269b880db5ea746d511cc70585288744ce

SHA512
6ab1c6298505aa3240b3da8f8b64d01c6cfdbf20c2183b6c06a9ef7e05bb8fec19d7c410a18a8ccc197e1da95f9ee02aceefd4860dc93b8dc2692f4427448c1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5830e43aaddfd26f5fff028cb7aac097

SHA1
9eb107d0db982b3c2ca24c7143389463d69fdf16

SHA256
fea47de67b20f5ccbd0b780116bd04a0860fa928210e705aa1d2c0e661d4daf5

SHA512
24a420fa6e7af09f838db6da271b081fe8ed2a869ad4e210fe3abd84caae7e735b82740da49fc1067d9ca87600933117a11d3dfe209dec2343b596658b7c2f52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e31cf30ffe20e5a10fbe1af77046208d

SHA1
db41fe58b7a58afd022ebfcd439899f08eaa8808

SHA256
775e1d0796d19f83b87a2058db8152dd9347380ced989a6db572f9aac52f696f

SHA512
10fcac326012619a63a8d3e3701710c75d1a6c7dabd571d458c65478f95772c4390bf5c4b9b684c5f75a99657d6fd1501f8f90a514dc8c4749db0cf5f0f578b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47de6d48a3ad3c59e67c1a17baf6ba98

SHA1
74226d427dc6508f2da144be8e081e403fac8557

SHA256
72f81eeef243674d87bcf9721e3cbdff732bcff883645581983661f47b2a6b6f

SHA512
49e4529787001825b815c5b809c8bc5e4741fcebd74d1337878083d22232773f8392a8f1ff9dc5f5ca957cb9c7bd22c1422e05221aa76808dd0396303b69fdd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
989443a2796528126aa450eb5d7c404c

SHA1
6f585999276fd3b35bb70877b96e4819be48a4e8

SHA256
d26b8f3ed778123aff51c90092bef9f444af61c2090dc1b1b5a53be67dc51bbe

SHA512
41151feff7fd2e5e54ab598570ef507955bb887f034f0524b7377fa687da46b5ba4faa43e512e343266d6241d45a3ffce87d426bab725089157543545b796b1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f10780129c5829737252590e851f74f4

SHA1
eef65e31a70af1ca7521f6bc6d4f2a87d9bce031

SHA256
42191fff945ed6f836379502fd977c21ce14be5a5eaac5f3e90955eb069b9bfd

SHA512
fae9a9821ade4205357a54c1bc26dcef80ad97cf7566406962a2f81aceca14c96c663da3681bff9ab40677363bd1da3dfffe02c68ebfdfed00ec0b9e36184cc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4605d84fb0dea50dd5588c98d6ea8c3

SHA1
09d8df4399edf474ccb58c152c5bf0517b710e56

SHA256
cec9b1e58f0bd994038ff320fa3dcb0c6ab4ddfe1f558634fca36b614ac8a9fa

SHA512
8083be801447cb7e5b51aec05b3a4f96dc0752c87f42cd55ec7bde438adacc51d43ee26796e5fdfc180c916f54b5feb628a016907b4abb0a4cd9bed6315a14c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27FC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar34A1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit