ddf60dbf7e639d1d7786f97f374b8e2d455f65717901d2949953e4c4d70f411c

Analysis

max time kernel
148s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28a4d9ba0591c926508074254c264ad9_JaffaCakes118.html
Size

18KB
MD5

28a4d9ba0591c926508074254c264ad9
SHA1

aa29764a2650d836503cbd21134d3bf62671588f
SHA256

ddf60dbf7e639d1d7786f97f374b8e2d455f65717901d2949953e4c4d70f411c
SHA512

8a7a99c739d5b91b0ac6c8acc8de5d952cc569dcf644d850b0d70450bc9245e527ac65a569ae6ac6bd507b73874266e2c0a39c5bc86aa1652c674a72ebe717c0
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIi4KzUnjBha882qDB8:SIMd0I5nvH1svaPxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C8BC801-0DCA-11EF-A5A1-E299A69EE862} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421396801"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2412	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2412	iexplore.exe
2412	iexplore.exe
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2644	2412	iexplore.exe	28
PID 2412 wrote to memory of 2644	2412	iexplore.exe	28
PID 2412 wrote to memory of 2644	2412	iexplore.exe	28
PID 2412 wrote to memory of 2644	2412	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28a4d9ba0591c926508074254c264ad9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2412 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15dee61cb4b271f75e11286587e57db9

SHA1
9f27908100e4f9efe460e5b4ccf7128f31294ffb

SHA256
b34e66c73abde2f6eefd8f288bdc265cc9428c0d3e29d8f707b666e7d5ea2356

SHA512
57b6289b12d3849b0ea64956af9a3858ca78e9dcfe0a8ebea5cd761a9d58a65725600f064750f7f00146d716e35272a6b0008e87a96f83c3bdfd0f072264aac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b02ed51ac69cc108b0d3931a0cd9d93

SHA1
f2fc5d32503d6d1cd9cde0c362240b7a3b5c22f4

SHA256
1ef4eac5c405333a6dce5644da48dc3152e9b7618fdb46dd5dd0aee0e0a70065

SHA512
b63d98cd950fb86856b1f804db27fc6621a014817a18034f5c1e4816fbc375393802b500909dbb46852ad8456671c93ad9bf123bdb3119b6c196fd7395cd3ac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
324832a76d4598deaa834d63652eec7d

SHA1
f4ff0d07e69b03d966db1bb9c0aa7061ebb8dd41

SHA256
9e1c4a4e7747564e9bac46e6f5e4e06b2ec8c59a37f7b88ec5496c9b4c887807

SHA512
ee0415c24a1d38599cb80827196c46f31094d6a87258fc3d227028e0e84379ddd55168b6050098adff17e9a3f23502c936a067cdbd5c42f7fccb735f85986f31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf709970f0ccdf84ea2dc2c0548da59d

SHA1
20aaaf0e043d6cd577b1e02d858590bc47c15560

SHA256
54c27d9024cb3355a7c4443942ba7f26022a304bc2da1118eba0a8a2f365ef25

SHA512
345b01a9270d0b548742b663fb78a0f2889ed0b7870105007a9a3de9459aaf54d000f523791a609d26d375947510df5a7709647122a3be276745819fd592ce52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b605a8d54783ec2529d9e2669ec5f9b4

SHA1
eecf85bb2ef2e569cbe493a84648c8aaadafd279

SHA256
95aedd13e8c87575ea938064b61071f5de7e69ed3765dc1a6f1db155974274a1

SHA512
c46fc1ff903417b2a350fcd6c801513ced405c0bd511c10f17bc8a34ca6f87b690c60ef66b7f8fa22dc1cf5f008d36e7cb6699ddec4807b954e7573537df2cb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f58e253c0d924c88b5b390f719ed15dc

SHA1
9cd1ce05c21b59301645f626375ea087d11f9315

SHA256
7efe124b1c55afb90639ca936626844649d846a391c30d37f915891b50f71151

SHA512
f1a0fc8688e43dd3ab0fff635538b9d2e41396060cf569dbe2448e9afa13a7cb4b3a75b957889177cbcd3395b195160916f6fb7b18bb5357e75dca0e3822e021

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e794289671cba7c81e86ab83daad0e65

SHA1
14021383378ff88d182fbbc77a328315a002a1ad

SHA256
e153090007b448ccececf37b189ec82af1ee327cf3488938241be80ad20e54c0

SHA512
e870aaf8709f1cd775345b35b1ac4d34408ca48a77508eb008890d178f2426e2058f5d3fc159da2cce73dee2b5fdafa2e31cedca45e2aa73e2042ba348e35a41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3a28d1442ab734c6c3496e90aa8ac51

SHA1
f4a516b45c83e88608810e2d4a23861d6f9dedd8

SHA256
643966eec6b54ffa8a7545071cd69b85194451d12ff6e17dd5aa7b52b1a17658

SHA512
e38424ddd028c2d22a4cf95f3d6cf7d44e9609ae928536de2708ea96930c830febd71590f9568eb6ce7e1f1af6bbef84d2361222a3288f422d8e20d95ef198a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDB9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEAA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit