fb1029368a679396f92a0c22ca2bd1ef4fdfcb0bb874f6a2ede4668adce86b24

Analysis

max time kernel
134s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

28ac007dc52f56e60a3f6b6259720f8b_JaffaCakes118.html
Size

12KB
MD5

28ac007dc52f56e60a3f6b6259720f8b
SHA1

d204516dd8a24cacaebe48aae1f282f71396db0f
SHA256

fb1029368a679396f92a0c22ca2bd1ef4fdfcb0bb874f6a2ede4668adce86b24
SHA512

a4a2afd5b873f1aad553af75a2a054dfe01e5fa356b4488fc014c87308f440642bd5f6ac5f1c688a0b1ef9bf85f668811448739b0cf7c42a85c20c415000c24b
SSDEEP

192:FA4aCG/lORJq2xgP/ttjifrR7YywM+GV5kCJIbw:K4Y9ORJq2xgP/e7nwMRV5k0Ik

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421397304"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8628A31-0DCB-11EF-BB1E-6A387CD8C53E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2280	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2280	iexplore.exe
2280	iexplore.exe
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2584	2280	iexplore.exe	28
PID 2280 wrote to memory of 2584	2280	iexplore.exe	28
PID 2280 wrote to memory of 2584	2280	iexplore.exe	28
PID 2280 wrote to memory of 2584	2280	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28ac007dc52f56e60a3f6b6259720f8b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4848843166c38d8f83f1fd1c6f826d53

SHA1
07b67adcb7a310fe5bd56acabab93acfc441f33c

SHA256
c680a8f1779ff0b79a6f8c35007228fc0a95ea4a4fdd0ed9641f106817339a93

SHA512
14691a94f284b99520e7967183ad895054715a6bda70334e1e8063a46ef5013c12161deea86c76362e89a19a32124d31e16c1b77f89d7f733561d7d15ebe7d86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0fcd4b3fde5b257078b942fac4e7384

SHA1
f83497aa09dd4e9044140ad86d2baad8458219b3

SHA256
2d20c6d9a042bd92e479f30e043161ea9486b2e0b4573dbceed3a1d1e4cf49ee

SHA512
9958bec79f3c0edd416ac30a9f2a035a0e176456db13b6c8aebd3d213a2e88e9509b24b809c8f8a41354a905ee7b4736010213b2ead1a1811d123e11d9904386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
994f749333f4f661ffedb3162d262cc0

SHA1
21d962c738bd63069405c380019cca71d29f81ad

SHA256
27fb18146732fdf0d79eb32bdc9b36935355d60d166eef66ef0c8d5b118f10e6

SHA512
abbd3d68cfe752b53ee65ed6b353daa1ddb04bc6b2a5925ca7d5657e8da57349fb792a32e587fdf25a06d7ddaf46eb1031049657f1433065e1aa16d268798ae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fc7cfe6a246915ead2a720be105f85e

SHA1
1a6c0fee20dd7a7bd62e32cc91342a2bc564d397

SHA256
4eea538fcb8bdd3e738291170f16b5050b34dc1053938cf319e5daec37f3aa4b

SHA512
561961d8a810fdc891e789cd7e3fcd015832e63c1c5e80bd61705cc7025dbd4a37c8307401c0eed18722a60ca8220dcac6ec2aff07940d9985ec705e65fb8efc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57b61708ab5030b4dbb0f3f19f3ee530

SHA1
3d4db2ffe50a410f7b507f3a56f2f161fe4a8e80

SHA256
02b79b56f06645dff4595baac7c9aff594bdec86d2f500f6626c6557cb86c541

SHA512
66d6d85f97b4d15477ef4a6257496c8f1e8a659778c16d273c582484ae92ba6c7b5838a300eed0d2231520521f1c428b6cb32269e1af5ba5f3d83ef9e2bcd22c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbcb20c953e2e9b895328ed7fe51123b

SHA1
55f69cc9b6c858fa0e055cc64302b8c81e7ac5a4

SHA256
25bce9a349eb34d94f918d51e86c762a20f857b007e4e2f3c5dd2d34a1bd073e

SHA512
5a76d85aac1066c08d165e778dd016efd700e22143f7796dfc3df4b389628cb0d850aae05ce22b1b58803a90b06993d392bcd35759cfb37f57da8acd9aa83c63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17a0441048d3819ae5352cddf6a47ee4

SHA1
d033cb3936a25bfba86f4be55a14421f94e7e3ba

SHA256
bb1348e96ad3184bd4e011a2bae43dca377e774d6fce7f095c3ae920c1fc59a5

SHA512
330171c496d3c31759dbf267659108a02d80d119378c1becee42ce0d467b35b1ebd7fab10b64adb5a23140a11873ef167f7088f15ad2bf88355c52ec49f08866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff9b5b6783cadf504d3e733a80738500

SHA1
61de166ab0fe4d9f4a67add11e322c16b3a312a5

SHA256
ce00f49c96ff50385c527a6ebbd70a2d129e5e86bfd4821f3a420a43fc9f3794

SHA512
cd70257ee65d589e3acf572114432b355ea7cfabe5ed180297576a9af790fa8715e354b052f0368eb9e01ac768494447addf54e55723cc87874c7d2163eaaa1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4471e43503db37ad82cea5d2053c0bbc

SHA1
2ce48264da1049bbfbe44a25f47e6fbf1e621746

SHA256
9735b8947e947a87e39fe983cf3652fe18e22aa037a1222bc62fa9e3795d801a

SHA512
f37a948a7a67396062981a73db064489f3cb7dc0de8c596a162c77b6115d5f93a5f25a5c37b79c98584c7c42ca191c78432690568be553b30691b542606a87a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1342.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar13B5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit