2ee0e8465931b13b76536f43e11ac7a3672fa80a5d6a8e5dfe3c899588f09b23

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f74d70ea2f1186269898390b7934898_JaffaCakes118.html
Size

121KB
MD5

2f74d70ea2f1186269898390b7934898
SHA1

c7b126720081103ff41041cb445a9d8e73bd01a9
SHA256

2ee0e8465931b13b76536f43e11ac7a3672fa80a5d6a8e5dfe3c899588f09b23
SHA512

206240f9a9ae1c4eb08d1ad8728264dce2164f98169a9ebd9a41dd12e9fd904a18d10a40b06b67def7048eac513ce4b64e294793351c2ca1e1608f9902670d68
SSDEEP

1536:SHpo/OX53yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:SO/k53yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7DCBD521-0ED5-11EF-AD96-EAF6CDD7B231} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421511424"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1280	iexplore.exe
1280	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 3020	1280	iexplore.exe	28
PID 1280 wrote to memory of 3020	1280	iexplore.exe	28
PID 1280 wrote to memory of 3020	1280	iexplore.exe	28
PID 1280 wrote to memory of 3020	1280	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2f74d70ea2f1186269898390b7934898_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b7560fc37ce7b06cc2dbf5fea70af2f

SHA1
a448ea42cc9c34294649edef213e39d2a2db0d4e

SHA256
7f0c5770b5517ccf796413377dfb7220a69a5e9a26a720b57c24ea292806d08d

SHA512
5ad79cb599f6b49b2aa9b883e7fbbeefd90d52e33d176d949ffc646a54f465ba42f576b4a78ad9f81d859eae817e4144453bd01fc1eb9ddf9d7c1c4ef033eae9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a70889eaedf32e7eaf6c06c625d40743

SHA1
214050ff2730376812fec53ba948f59779904445

SHA256
367df06ffc60df426bf3417277099f3df908eb7feb28bd336537df05552597e9

SHA512
a5f512093e232a6f873e37bdb22843b1b9eb6342742eb26e09130bb8f8aac32a77af0652d6730f10553ee64bc0a5cfea405a74bc0ed8e83cee83c4620018bb95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a46db7fd64d82c5b3aaf3e04598cb86f

SHA1
48022190493908f77e731c753ea210b4dc2b8a3a

SHA256
04ae62b1f42875a17b4cde687935ba0217b824dd3eba95b6ef51ef7b28c64c69

SHA512
454da41cbf8c97ab4101ec15b8d8c3dc5af443923ce635c0942f33adda05bf8db3fd841615c72f47f30c2d68fbb5d959464c1369dc425f450cf1a3b4d4809977

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65140c26f8bb928176d89b5728d1def3

SHA1
99022601fad08294ee9a6452754d2e8ca633e30c

SHA256
9045f04c89a6661d1b6c6093e998653164154bdc505310d5b7c496648f8d0744

SHA512
cea77ec587f5a6fd55929f6d4d9a0803ac3ce9f6c7277df16f50e0e2404d10caede2b263220e7d852e4c977c59dd123d86f231679b77acbd95ee0226c9d96e44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14b46af26ef6c178fad1377ba7c9ab2c

SHA1
e13caefdc8f57e955d638b0a6c5dc6fe501312f0

SHA256
2f9641293e2889104c5947ff6f3c38a58f03b3cfa0ce386f28553d64bf3cf42f

SHA512
8bce68899aadef8b72ff56904169404cc250f957fbe6235406b5007f2622aa6d3358dec281aa3871bb467fd7c2bb8c22a0586ee1d3073172122934cb1c868853

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e8a41e79ff3c76f87ffd95d04e21778

SHA1
d149c9046a9d1bb82a9ab0b3a48249a5f406dced

SHA256
d222878866c7d646a70a46d533ae517e235c0fba4e511628c11f7e116ae063eb

SHA512
d0a16793ecd952c18e290e998ba5f3c355f5c44aff58e20896f580b34d8e1484b596f46a7dd221bf497f39c048f5c0823583528150ed4a130b6bf9369edcc480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93a27edf6b3e6182be876d4c8ecfa808

SHA1
53415aca6af0afacc5259f10bdbdd416d4d8a03d

SHA256
f238cc3941e0fc2666176b7aa7bf26528fa9aedc6c2ef6afdc735c5672eb55a2

SHA512
c3b94de29890270cfe6cbb334df94b165cddfa16041afcdb9e5dc2f90798c8761175980986c4ebc65e0324f03a45a37f85dbada5a3ddd59e8c0684c20152564d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6a2657a1daaf8d90932a958ceb27313

SHA1
a6a1eeef35b74df6c294040a3b43287c75a2ad8e

SHA256
3db8d51f97c5229812b0ef8f77024e3ba77317f037807fdf24c37827b1d3aeae

SHA512
93c7c7a1825ac0aec494b9435beb1100918d753cbcba7d74930906d040dceb2222a90407e1b105ed48bb1850b057c55fbb6004d3962c5849ba239ac7ece18d4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19d6c31f259cb738d6244ca005fe79f8

SHA1
ab7394f03d839d0910ea04ed0b67efdacce68790

SHA256
6938159f98d1a71c5f222e6b5972c877d7effddb4a3fb8317783431223a81aee

SHA512
49af482b9d24e38d17ac7c99f7840099439f5969267af059b53dd4bc69ca27ed36760be4a2806dd9425821a51cc5fa29e30cf7521c2df70e9206579bb3c8c0f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EAA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F0A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit