915edac7250b0005fbfea0c494531ff1ccf4b90aa4801b9d114743281b1ec727

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

183d150d0c0fa29e4ead8b4f64a9d6a4_JaffaCakes118.html
Size

18KB
MD5

183d150d0c0fa29e4ead8b4f64a9d6a4
SHA1

a018f42fa3c9a280f8f38fdcc037f060b961ad90
SHA256

915edac7250b0005fbfea0c494531ff1ccf4b90aa4801b9d114743281b1ec727
SHA512

cf3cfe817110913d92a58d7623252c6233825b2f90fac640a2d1de5e1d50d19567fea966860c09b43c9d5955961c5f10d790d25cb9b99584021dfe6f4397619d
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIW4MzUnjBhAK82qDB8:SIMd0I5nvHPsvAJxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE11C931-0AF0-11EF-9340-6EAD7206CC74} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421083431"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2924	iexplore.exe
2924	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3056	2924	iexplore.exe	28
PID 2924 wrote to memory of 3056	2924	iexplore.exe	28
PID 2924 wrote to memory of 3056	2924	iexplore.exe	28
PID 2924 wrote to memory of 3056	2924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\183d150d0c0fa29e4ead8b4f64a9d6a4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a5a3a86f12854b3f733a2e4b99328f9

SHA1
7e2f7713b65f9139fa97b5d6d2ab1ab8eaec1367

SHA256
ec9b217c9eb03b84076aaa6ce49e32a893d1e643f966cf8a763da82f97408712

SHA512
4a74512d65b8689d07bd64a75909a937381ce7051e8d18e8c4156e563a4d259ce2154b7c3a41e57932af4a0e9d7c95e7ed5069f44b07adf1599886cb624130f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0c2c837a8538e00e79047778fcdc416

SHA1
851283da4b03db8eea1dc514c8d431f7d4ada011

SHA256
15b070fcff40d441113bbe0948d4b0d54a22b190858393ca4bc61eb04c4e0771

SHA512
e887d4728d842299e56cfcb5f7b3035f6efca92165975df976c8e1825abf108a14211587294e51b3729f8f3c58eaf065f85cb0293614af8fbd56f80666c0de97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a31ce11371c3945a0e469d4c2c13891

SHA1
0a6b5b3de1b5fa6a3e4093a5315736d65fe721a6

SHA256
33dd9f1a7b0b2e66ebefd098e45c11a5c57f5ada96272bd4922b446282db62e5

SHA512
09366e7f4db5776bd09bdd0dc9d35925895fce00efe04a5b41a30438eb78964ad33d77813f4fd700a08b9465e74ea3a3f11afacf838071c53f2ada3788aa9bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84ef6d115778a35710174f2dca0e5f1f

SHA1
0dc01701dafbf1bfc7e187299bb08415636f5e76

SHA256
0113051afcfcd6cf300f7ecf92f6a17b135a960325f9c58e5c347b9283c7ab91

SHA512
954176dfe82a2fc1310dc115509ea4ac10ba7a2e2315338c91e0638699f393ca572ce6745fa7df3aed01c871c40b210743d41bda025304224932dbecb511c22f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e24eec56d7f7ca94d7e2cf28d152b6e0

SHA1
9e2f1147e549702a7303dfe41615895fa4b72d67

SHA256
b5227d6df1064562a8f00a849fd072f806350911fd64f47dd9e6b28e265fd7e6

SHA512
654f6793c3c78525c689b0943c14f23345316585691f438a518dd988ce43552dd1a743f71c0c55d147b4bd97bd8f9741438f1f649e312534aa8a9648b2dc8e56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18ea3c8478a3e260b339b4f10f4a5310

SHA1
90f8536bd7b7953cc5da5eeda96d39bd68a58490

SHA256
2ec23692b66df527220db90ac9ad00c6e54e0517f035b9b1c0b104cc1c66d1f3

SHA512
c544d08eee6247847a1e2e541f5768985498fd23ba133afd47a7ef5ab150a35315aea82a6c6b0f6fcb23d044748d74c8a9eee6be38cb0172cc86a97ceb830758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54495b6fec7a293a07481f9b651d0215

SHA1
309ccdda0e62dfbf452a97d3dd6af724a0116efd

SHA256
4ac2e34414625a6d6191ffcf6f147e7f04c3a6a0545d8d34512c47e79135d91c

SHA512
873c7366fb0389f166a2333c54f1e0386c8e5cd3135b0b701a0c1517e23990cce0701a8b6ccbacc0e02e9566e92839ea4421975afdb746be986297b611d40957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50013a116b8469661d8c240546dd51db

SHA1
c37a04fcaf7b482671f6e3b96a9f4ec9fe96d122

SHA256
521a242ab0e07261891c9177674bf2ae430ae597839fc8100600e1793fa368a6

SHA512
5d18fbb0cbfc4596df9bec54aa40f1d2b55fd2d895e53b819382de52509d55601ab59ee5c78ce913038ef241f050057ba83a52a71bda2a9decf5dd6da1f2560f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff0bdbc9d574341278a8d0614d243e0b

SHA1
986c093e11193e0e522648c3e6435916e4cfe223

SHA256
d5aa2fa1f450fb108f6ec33d0369f90e0c02f52f31317270eb274b76fa26befd

SHA512
87202c8ed0ae981d8123b7af7eb50b5ed68de5fbb280ac5211ee892baf1cb334286b0b547922551c24e7b3f5cc0b3a21df6f9531550c010f65e62a83d907d787

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1151.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1213.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit