4f64a0981c84dcbf8ee5c3006604577689320d518477fd76193f2a9c1ddccd2b

Analysis

max time kernel
124s
max time network
131s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a622583586acc89263c2b8f2a73f55e_JaffaCakes118.html
Size

48KB
MD5

2a622583586acc89263c2b8f2a73f55e
SHA1

768f639d62906a465ff72000c5d73dfefe11043b
SHA256

4f64a0981c84dcbf8ee5c3006604577689320d518477fd76193f2a9c1ddccd2b
SHA512

c1763e4e6f8524987254db99148c2c1b2e15d040d6fd71e72cceec158dd238e52a14ddac8d5dbd1741b6b0f981c8e8c7d56b3e6586baf805fcfa6a4ac29a8ff0
SSDEEP

1536:h3yMeTrExhdsFf2coWIqboWifFo7ERsy5Hqo9y/INUMitTiD9HZXge4zaJrXK05x:9eTrExhdW2cXIqbXifi7ERs1o9y/IKMn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E3641CB1-0E0F-11EF-BA3C-D684AC6A5058} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421426555"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1276	iexplore.exe
1276	iexplore.exe
1380	IEXPLORE.EXE
1380	IEXPLORE.EXE
1380	IEXPLORE.EXE
1380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1380	1276	iexplore.exe	28
PID 1276 wrote to memory of 1380	1276	iexplore.exe	28
PID 1276 wrote to memory of 1380	1276	iexplore.exe	28
PID 1276 wrote to memory of 1380	1276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a622583586acc89263c2b8f2a73f55e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc5d7ddbd257562e4150c6354dc488b6

SHA1
e801c33fc6c0cfa3d4ed5b3902de78deb59de88d

SHA256
b5302681afe10a7d689f168c2a54d4aac84702c2c3d489f85017a765f3a40515

SHA512
3a6a6e1e0585595d69e52043791de3034f17eefc24b90e1d1a5857e72a4bb27e4b7d5e09abb6e7d4dd86effdd971d42af12fa2e7d1f225e9a7f4e818f80b2177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c821666d96fa52f61d245580f66beba5

SHA1
eb9e67389bc279b39f2d597bff3e1bc1d5334cd9

SHA256
762c002e3862d7ed26042105e917e333e216cc3a8633dc3e714a930f9495e50e

SHA512
e78e43745da04706fa2119562913d807d0eff57d9140e2a68b55699f37965b65b9033b92d8d8b37dae9aa58a9f94b2cb6253a681d6c601e28f03d23b240f919b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5533b03027256c26f1a72a890e90094

SHA1
e67b8efabaaca65ab40bd5014e278fda5fff85ba

SHA256
5e859ca8c076b2e7ffce9f73492022cdb9c06da85ec71ca8e34ba02a933b7475

SHA512
3742d577e9aa17c21bc01c39818c6342a89778badbcd38e830180b14498eca924f413233e67f45f0cc27e668889c3a4e3a7537e43204591c478d5b8b0d743389

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22d178d0c80a82050e6baed506565c92

SHA1
00f7392b4d2bdee8ec90f24061161c2674afa626

SHA256
6af5ef5fa4a6b63bbf65ddc0a1163d2622873f779a6eebc728de131bb4f6f56f

SHA512
9f81dac3e932848b16f1a724a3b36467142cb96b5f2b7f0cdb4f87c174e3284b4cb513b004872f8a10b087c04193a539c67b6bd0ec8ef6a4dc1a353203cd9e5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10dfb3db1092c60ee60f56696f40e781

SHA1
6c7e0d0e180eaf01dda46d6db83832ac612f4b30

SHA256
da8b0478ef9b6e3e8ef08b4ac0dcd77b0478b6e74791aae44b6fcb9dd11246a6

SHA512
1cce114cf58ad405b216a245a0060b3afe27e8e451b04f3cf66af6f6a0996f2b3539efa2418fc2d5cdf44bd414a148a01af371778745232287e18b906e9dacfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
443f7d64279eb5da0ef57bf182c8c3f7

SHA1
96a7cb7e5283fcef1aadee0082e6ddfea5e80692

SHA256
70e6b5086b1c06880c60787e7b7450567778ef8734f77a564dfa3ca1a1537908

SHA512
44bf98e16d6dc7187d7926d4742519c6857ba519d4ed2e47cca9ca303cfe12f6a77b9974aab6670175e5d8caa0b23339c8a9b25c222487a05af9af710692324e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd4f64b731ddcd668fbb71421184c453

SHA1
e84da7560aa5ec7b03c72a5ebe79863ae2910363

SHA256
c99c6d726e20da4192ecdc5bba7d71499564b81da9760f37c0a94049f9d64501

SHA512
8f16c940ed51dcec01ec51e96eb784391e62302728bd6df3e0fc3423f53ad4d92f3e5c3371a0b9aca40d686d134829330f93d6ef7798a5fb83f0ac48ad3961a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19577b74e50945b512f3cc4c0fc10ff4

SHA1
e521c739caa7ce3870ba04b6b3dcb315832a9539

SHA256
3d48f4e4991cd8fa0f613a327b36571f105f5ee670358b816829294e7713076f

SHA512
8fa7a5a60efdf04f454a4c1a2bc2d688062be0c8ecaf99e6b9fb1c8feaf52d107adc52442d7c70fc60645df86a27eba917607e166a9038140c489e2a93866828

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63233e77e717b9678dd9a255b430a08a

SHA1
d3950182a7289b1f5b309958b0e39c773fec15f5

SHA256
21b173f2cd8b73457dd66d471bb8fd58d14d7d1ae5e9881770f208c7f18e041a

SHA512
0e8667c064a1554386bf75331e313c7e2fcb47ca9131ea2af0781cb42c406d5bf33e6511e35e7b3e1f9edeeb3a03d2a545c0ea7d69af78f17c7cf020e057bf4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
202531dfb47750f456be6b9c487ee5f5

SHA1
741672e111cea803e3ab29ae7edf727383420d3c

SHA256
9516837d795d3b0cfa0aa650959dbfb4ba3cc02ed97429b7f229cbecccd1fe2c

SHA512
859d877761f358494a66e6f47965d53e2601adcd4bb83319a159c7981b90a58388e5179148a7e2fd790e78912802dfe6d11d1216c421a6563579a4cd73bcccc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1640.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1641.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit