6523a01647a66327852f035f2c3c4c9627d2e4f9014c38848fccb5d275f76b10

Analysis

max time kernel
139s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f1a83572a7ae6af63f8907f7c9883d2_JaffaCakes118.html
Size

2KB
MD5

1f1a83572a7ae6af63f8907f7c9883d2
SHA1

977252a2ed153927b6bb587720d310ac3d42ceb9
SHA256

6523a01647a66327852f035f2c3c4c9627d2e4f9014c38848fccb5d275f76b10
SHA512

780bacbc058f0ed106ec8b3d570f66588f418ee56377f050b6775b7ce5f0cd631e960c1d666ff263fd6a041d3b371d0b0972faf24fc816f207756e126781a41a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421210025"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD59B241-0C17-11EF-8698-5E73522EB9B5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2820	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2820	iexplore.exe
2820	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2816	2820	iexplore.exe	28
PID 2820 wrote to memory of 2816	2820	iexplore.exe	28
PID 2820 wrote to memory of 2816	2820	iexplore.exe	28
PID 2820 wrote to memory of 2816	2820	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f1a83572a7ae6af63f8907f7c9883d2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e172efcd53def3fc5e3455f330126ffc

SHA1
6068109804360acaccf22fef525e8bcd4b6037ca

SHA256
e3c80949ec98cef1553d7086bc57e3d0141d6b339fc5e8ccef0f98dbfecde5e8

SHA512
5b29b1703af615cd82c0a83a6b4f398f1dec6ac6533284990c4af14b4b9159cd57de251eb6944b8738ddcc2cd967fd631b8d872cf45e6233babc80121bda8dae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d8ffb33bc0ef391376c841cb399d2d4

SHA1
ade580274269e978772d86910c21f8546d446df3

SHA256
14a7b568236c90420c48f58370f36d579b6fac93859520034b4f19203086c28b

SHA512
2901175ada0ca1bb6b14c5d4b0a66bf28151e71cb0761017498e8ffcf336d66199b437339f3911b6f76b3f24b349b2ae15f9619a67178d424aaa4406359a3f29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94e4709a56dd28433316c97cf96ea1c1

SHA1
30211ae780ae267d950121958e80c95680f446d4

SHA256
efd10024bdcd10eaf5c235838b5347a648595a0bc5a58c44dd16098205702ce5

SHA512
43cf1059394fdbd84a9365ef439ef3c86bd0ef96750cd8869f27fa80fda96adb3a673ce3c7b69983a529925b4572a7bf37c9fea7d4b875f5675007e75d8ebd2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb8a439a187c8db43751de56dd657e26

SHA1
198f8eba8db3bacce01f0e5be1dd44c722a76b2b

SHA256
6ad2e78100629ea7b774e39ffc6c4024568b3c345eb429312580f55d644b3ba7

SHA512
df4f2c735347115e8e04a469a0eacd661ac258ff3d6d187cb34c518f4ed7df45d026fee3336bc47649689d1ba6a468d5f6b790f26b9eda332280253bf80aa87e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f510da0468c3058a121bac5f91c8c458

SHA1
efa896321478bee9713ac287cd3a79069da34f1a

SHA256
dafab151fe15c7efb205d9fe3d37379291fff96d734391ab59eebce608084d39

SHA512
ce903200395937f9e7e6453d58be11b0d126a79e702a2e3bf76043b7d0a1aeb9501ce0b22f9ca4bd38f2727665ca401546565c56c5157de689c7dd4122ed4d2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
021b39aff1cd555fc3755c84e7b87e27

SHA1
c36bd764f0aea88740dec416603a33e216e72aa9

SHA256
33aa15658ccace482e1617f9f5900a325bb3bf7699530da8a786d402e5221985

SHA512
a031591ff98b7ef8978f22e5d93809f524e4d0f3561d48ea98c6d0e0e2a86eaa3dee24266ff7146ba810f190f49d1922538236cc58fd3cfbb4483411968f349d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc15bd193fce28f462e93c9ee69225e8

SHA1
3004f224ef806101891aea165df49b1252ec53e9

SHA256
f63e7bb81de80928b4ce83d9d81cbefb1dc48514ce07a482cfcb3b2463e6ff14

SHA512
cbde965c7ba9a1670d41437d854ab9bbd5aea5685b637a080477a18d198331d4d0f39a553d44f972454bcac886574be048a51d068688d2787e44be4c4270e808

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe2b5f34c16b5a7577ead00c056cfdfe

SHA1
ffda92f117214cfed93065b385e87d0230c7b136

SHA256
4dd0d15002b25e8b7ed7ca99c31947ca1d53120ef92605b89e9dcd8b7557a5c1

SHA512
bad265ad7706a8e68e0a8d4360020ee5f2c0181f8b816d8dbd1475cc95a9db07d100c4fa11bc8b5692008827ef7bf020583bedeab11fef1e9b5b25a6b5981138

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab780D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab78CC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7920.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit