dda1516fc11ce2d9cb8e3f5148c5fe4e1d1d9a3b6a7434bbab61b5ce66d1d184

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15fa7b8778de18ba1e5146829cb2acf1_JaffaCakes118.html
Size

147KB
MD5

15fa7b8778de18ba1e5146829cb2acf1
SHA1

663735ba9f7620e2504869d9cd11d40814272fbb
SHA256

dda1516fc11ce2d9cb8e3f5148c5fe4e1d1d9a3b6a7434bbab61b5ce66d1d184
SHA512

92d89cc34bf13f5c586645d0aeb26acca0e2c4c86ee2cc564c3d4317aaeca779505f17f891fbaf97bbfc5c94261a173b9dcf32701a1b1f807abc133e39d98cc3
SSDEEP

1536:STg2xyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGL:ShxyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA96EDD1-0A97-11EF-B1CF-5A791E92BC44} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421045174"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2128	2156	iexplore.exe	28
PID 2156 wrote to memory of 2128	2156	iexplore.exe	28
PID 2156 wrote to memory of 2128	2156	iexplore.exe	28
PID 2156 wrote to memory of 2128	2156	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15fa7b8778de18ba1e5146829cb2acf1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d7ea8ead5a75c9cdced80683b296a24

SHA1
3e18744b8bb3573f48d474b13570b5bbfc60ffc3

SHA256
d4ad9419e4e63c3a1cd0e41d2cef363aa7a38156f01b4bda9559a66543cd3a42

SHA512
f4cce386abf1592f61ac884d15baa094d2f50a6a9e454cb473331ec7fe5313c0a0a642df8e0f4505c5f5640223b60ae563844099ddb168ed80624bdcd0848abd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc137c946357dadd4f2ea4359208ed07

SHA1
e368d6cb7134098de0f1c8905a007bc32aec2607

SHA256
1061f902847ea6552af3cd2b73a83668ea2cc53ccc58f18323b5e298fbae8ef7

SHA512
dc59299ec274ab06ee4f95924948572727dbebb0cccf24c6f398b9f2a308939137e65ff1d0c21781e00923cdd826aaa5418438d85b76cf6ce20979e28823f1dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50e7ab94ebd28bede50f4c5fc4db911d

SHA1
1e7ead102205873fbde2b5bf2b18fd5be1ea69d5

SHA256
90d1924648580abfff2d882ad6a35622d22e1aff34ad36bc2d00e424ad3b2c0b

SHA512
5ed2b3efde1c6bf6b95d278bb056644dd6d28874f6b5f3d0bb26def53a3ece60753fb75937c8e009a8bb4ec83186e0489bde5ebae2ec5c2ad6c80ffac629f33b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cc7b7b23d4ce72bfd449ca38649c93f

SHA1
ea5112ca23e1b03a43467c3e3ea26946909f53b8

SHA256
a18c34432066012b8c7692e54e098dbaa8844faea3fc2c69d402f1b18fce8726

SHA512
04915685141d0f847b76c823ae8e8b53c71759320459bcd45426cf76341eb5d0578fe6335e7e17b2990e95d7a79a08502cb4b4dac49391c08a514efce3954dfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e3d88f5795cebf8881f679d6c2e37c4

SHA1
e38d419f039dc011019dd098ff5356283926b30b

SHA256
1af512ad0ecdd31614ff7f1015c0e134ad88f791365e129c79564257b971ed8a

SHA512
ea4fddea45a5f50d12441a6710ad069c10bfcf12c831435719fd819a1d94f2ec4855d9f8140ca60f0c368b74e6c3b313ce8ca2d9b12ead3a823880b98aa47b76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a72c653c519cdec9dafa8144dac939af

SHA1
4b0279d9091e01e6e5293c4365a416fe51cd0bce

SHA256
a73f314fca06f22aa83777d4cca0c865cb63ab0c25c6906956b65ff8ddc73de4

SHA512
710855e0985cab06675d3d0d57c9b5924d04f7af8da3f6d46897a39752daac9e07fd743ea6c8bd9412cd5aabe423c5e11780937600a6cf6abec40030bed88400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51c089129713c1c5d3a63c700d5866f0

SHA1
e92384dd447a5d596b3a2d3ea9556779cf1fc5bb

SHA256
38900a711e75420be2e330456b8fe325cb60981467bc8dc3adfebe87ef8ebb75

SHA512
c3878c445a27b178bbfa285b38b4f4392ee155ac8ae8793624e57dcc4e0f0c5fd3aef269bf3ea8145827211360335727f9a9ccbc5b3aa85486822a28e9a0ec8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3885f4b498c665f8d1959011ec862bf1

SHA1
a74396d75616889a21f2e95fd7fcb714b630c26b

SHA256
647501ec63730b07ef36233f7d570fb6eaa6ae3dda77c8638003a29d55f60769

SHA512
1de834b23ab743a84737949ce5581a00928074719b052b68b7db502fcf5b73eb5853485daebb83680c1006fe3b4a620365fc6814940204e48a0e1b515766fe75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0317e1694c0ae990fac350735b587fe3

SHA1
722b9bbcd6956b79669dd7d43efd80f56c44928b

SHA256
85093ad399cd60b13930592801fd8749bea924d2d8d2d0100366d7c6a18a86f6

SHA512
bf49849a616c2adc48ed8d847f3ea3f86d7e658a9d0a509b8d1079339f8a21f40db0cf87850abc3a7cc3e609d3b0599445942a2da38f9ee0d2751da9a43a1bf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CA6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D83.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DC7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit