4804c30527c2c0cd5191b65828c515ce49105c19217bfa55f991022956ba4118

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fe5ac9f8a1e83f7465ff3438a25c415_JaffaCakes118.html
Size

21KB
MD5

1fe5ac9f8a1e83f7465ff3438a25c415
SHA1

365057e27d831dc47c161fec5b6c69348d84b578
SHA256

4804c30527c2c0cd5191b65828c515ce49105c19217bfa55f991022956ba4118
SHA512

d1dbb6435ba2cbdbeaf8b0d83e896e17353d957023834af09bd452d7bd58e24b85235475a5ceb44878e106243bcc4b2680d20098ac8c1f7b6419cb4a1b54e7d9
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIKBoHmtET9BooqBKBoHmtET9BooqBOBoHmte:SIMd0I5nO9Hnsv0NxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421229117"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31B52031-0C44-11EF-AE27-76C100907C10} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1752	iexplore.exe
1752	iexplore.exe
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2480	1752	iexplore.exe	28
PID 1752 wrote to memory of 2480	1752	iexplore.exe	28
PID 1752 wrote to memory of 2480	1752	iexplore.exe	28
PID 1752 wrote to memory of 2480	1752	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fe5ac9f8a1e83f7465ff3438a25c415_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5fd640153fa33eb19901a7cc1ccdbef

SHA1
8c7f1a99294bb413141d9de36252a603e8672830

SHA256
9fc1efc2876b0f0d9eb009391e6c232ecee7b55da9595f823adc16486713c70c

SHA512
4671a1d0521ca215b10257af981c4d9658e03bad0479ac2b8babfb2ba2ee3708f77b2bc65f95e4810e1293ea2e272f634f08a1dab48cc9341d1750a676e018fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c06137d3207a91daebbe170dcdd2a55

SHA1
deb67879932dc0d71b209cf07c24fdd9e390e4a0

SHA256
90ab3f34c1d152d44bf1cef6d691beb75092a99f9d162f2345de767e078f8144

SHA512
da3a448a4e790a61a5c05617a3b3c40e4349a029259b1cdfa1f44c345651c41ca04921ea7c7087b329c677d2802450b73d79b1487b42523d6c3b1ed2441007e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90589d2593c972a7a1b8d07e8292accf

SHA1
886d0cc465a0e58a0de868574232529a4b10862b

SHA256
7eccec1d2c05d0a7b6ce235678b4b5db420504f016d01d436d43c2fdfa91a531

SHA512
049739887ad70c309e8f4af86a8a77ea8bc600cf93c12a199b5db4ce4de579722daf86c20113e619457fb30c9ed1401bf92baafb130a522f10c81cf2666cc141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb47442f244847da421785ac5a36aa4e

SHA1
97804453acb4d7504f46ce7040b531403cea6559

SHA256
1431c3193081c7402d6344adaf83a6fbf118a6985f0d2de58743806b6350a9f5

SHA512
bddd959f55969d57ba9400be20fe0e6ec5e260b8ab3cfc4a0b326c5bf93f74ccd2b1defa4cbf37c5fddf871b83221eb2ed1c9e2ffd257afe87ad029b142da564

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ead81b67f71cdef39246c44c821c99c2

SHA1
c361306228cf1ac6733ed6a695d0eeed50121066

SHA256
63d489094c0c813adeb97a50a24fa67772689f1e6351fa1b4ab83a67e8a8fe3f

SHA512
b23aec00e5ccace40a322d0e7c8442f50ca48eb1851907f3fb9f542c993a0feb5b94824a3f0e44a621704b77c2e3b6290fceebc9f4379f56c331530733987ef3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6bb77943a79a2b588dfff4e6a9bb862

SHA1
3c25a4cda96948cc036df6a77535e39b3a4b0c05

SHA256
fee23f503739fc71bc4fd60b4a8eb9cfee6cd97924f25653200c5a427a7c5149

SHA512
dcca36ae0e56edd84927329ba1a95efa28fb7dcf59cafd6797629257d6973bbc91b5b2a80a9212d6a9ef6b44d2b3623326c3fa52666226a95a310e5d1e557a49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15d0371af2a038db6eab2c3560150b23

SHA1
70771ddcfa968dec42a83a69e69a1231179552de

SHA256
de3e1613c252480c3ae3de224abcab3575e69a445571dc5872f993f958a119d4

SHA512
300febfd51eb2350de5b0236f784ab182f047249d3a6a1ab08916b97addb99038559682604f56cd273871ef49d9e27f6adadc89fbd93f5ef73d62cf70e579ca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1bef1988ace1e44f00fe71ef03fab72

SHA1
d2f883d6dcf4a3cba5ef1a6b5321cc5068e7cf1e

SHA256
7e7a956ee4ed7dd2273109572524e41f07a29f5c85da3f39d816c514255b5283

SHA512
6243baa4f6031cf700a0d9c34bea3937e7caf8948be78596886352243dc10201c2fa2851fad838db2f7e258b841c18f4a9ec4828743a284ec4095b0828cb2f1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b150bce16b7a0a04d90f65939dee948

SHA1
eececa622f1fe0b900d49189f540b6a88411ba63

SHA256
83f20ba53922e7596e9846067a728b04cefeb7faaf2dde54a0a33876af37a244

SHA512
820c7b592f55e0397520538f4a1efbb3f7a120cbfdccfe1d834e73fbe0f7cb0f72657cf0803e90bfb884786c45c4b064ea8c6333a5c3745ba1a00aba8fc06343

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB0A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit