5d1cac8499d90c1362f7b2194e05e087c5b9d4fe8ab1da4b73718def2694ace4

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3192bf72cfaa3f4edd63a8d76933885c_JaffaCakes118.html
Size

19KB
MD5

3192bf72cfaa3f4edd63a8d76933885c
SHA1

b77fc9989e93b1ec57c119af0e64b4517b505292
SHA256

5d1cac8499d90c1362f7b2194e05e087c5b9d4fe8ab1da4b73718def2694ace4
SHA512

2c43ffbef1a930aa470665eb86181c347b57096834deef9435c2dd0cc401a5ce208b81e3131548efb3834a5392d24d02bacf3cbfd1bf11f092999853f76b6754
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIm4YzUnjBh8W82qDB8:SIMd0I5nO9HPsv8VxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4270121-0F24-11EF-B8F6-D6B84878A518} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421545500"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3052	2928	iexplore.exe	28
PID 2928 wrote to memory of 3052	2928	iexplore.exe	28
PID 2928 wrote to memory of 3052	2928	iexplore.exe	28
PID 2928 wrote to memory of 3052	2928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3192bf72cfaa3f4edd63a8d76933885c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e26002fc7270df0a1e6ca33601ce156b

SHA1
cb7c4ab318fcf1fbfcc364733781f4d22f3c326f

SHA256
799bfa414089d6860a03446a340de16cd7a681328b602889a50625187e918711

SHA512
c73b613e31ec4a8d58cf316493f7fffc3df7f80f0ae07d5115f85ea004a7732da1867f9da011bef91ccc77dc56e4d8a283c5ee960695fdc934042d7c7bf5417a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51d0f1712e4f98a92284a94f2d05cea9

SHA1
7ff276548b8db6467974473672bba2e72e9be77b

SHA256
47e1d7fd10d831a02b1230b69fa538e0335864adb91b42f1c10a848a9b4b89c1

SHA512
d3b6dbbc29b069d0f60be4ba5b0f6c8b77b297385abd6debf3da6413a8cecfcf03d0e46e9007761f4e54e17c5ca9b73197790bdc88688e9f5b098983ae73f7fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36bdbbcd0741bd05a764bbab89bfd384

SHA1
8912925235333e3dd5f4b612b2ff956662e5628c

SHA256
51a55fc8c90290533eeba728a2b5d6db29ae1fda1834fffb73b7424ddd0a2266

SHA512
81d67df3445eab551d259e0341c5b1a8fc74045da1c22427ab17099b38f05fe49861d25950bd7851c973aa48b834e35a8b02008fb33ed457284aa5dcc7cdad32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bfd386f196b605f38718005baf1cbce

SHA1
cfe261b3e68d4b913beba39fd4e4af0404756812

SHA256
de24b517adce30750eac622e30b113f00386edf13b2ba7978c3baa3209573501

SHA512
48a1630b9ab9065c5bb01c2a5b5b09e8735d16c913d69a6b735aadf737f45c95e7cc96cd6b8ce7000e2cbcb891b37b9c110cedc8eaba116116f8bb9f6021f27d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62db1d50b77c89abcdf7a3cb09dc4338

SHA1
405024325b448b238c923192871cb432b6e80eec

SHA256
dc64374aa2054f37bd2069278209254985422a7a52afa77bb71331bd8ca46971

SHA512
7785840ca90f28068b1ae8ea1056dad7d8ea8ef5c113b1302e4b07166997d1ded8579520ef24bbb3eb391227b6e20a0b4fd56efecb88745a8173b5f31e7c9fc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eab39ccc5cc8575374ba424178706bf5

SHA1
96b5edcb3fddc2c029dcdab7c128613a227e3221

SHA256
116fddd7a196b1fcbaa22eaa19777a475c89a8a8674ffa491ac02c551943b311

SHA512
74fa48d20606a5fc9fa7c4a9d862b2b0bd55ecb379f00cc34b7a2bbeb8404f4ff47d704ccb7a4540efab4f17f8e76af1ec58c924c5ff4868ffc896a36a6e74e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39445b98b3fd901fa3064a35ef2e7cc0

SHA1
d14a7c8e078cf218de91963e318db6ecaaaa464c

SHA256
9539f3284fbf509831c8b5f6d1584dc7b3a9ccd507e6da141bb98c77fa58a0c2

SHA512
dc5c8436c951d8a2e4714ef2fa52b95ac95aa4bfc153dc25119f13efb8cfac6619c5c485b395160ccc265537fabeb46bb23af29a738b08961dfb9b97d11d3b90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe3b0922f26eef648e241fadc717aa6c

SHA1
8aa69450d480c9389e4fdf60f0083b77db9d0a11

SHA256
f09b60dcd8597d20521f52e9255b1a3d54d9fb8746deea8bea0ae8ea3207b998

SHA512
8474cffb5c74e04b27c27b1727d61276d76bd5c918eaf7a0fcf97d536bea51966d0d69c7db8af3e112ab34d7965dbf299a543d716feeee3e70ccb323f1d2744d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D61.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DC3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit