4489b1b5bfa81e9deb59f2f2c390fc470a551a4002da0cce7f505fd41195f980

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

335c83a2138969fd832ad12432aaa577_JaffaCakes118.html
Size

36KB
MD5

335c83a2138969fd832ad12432aaa577
SHA1

c2ebcd0633db71a540c1557265c25a0628a2cac0
SHA256

4489b1b5bfa81e9deb59f2f2c390fc470a551a4002da0cce7f505fd41195f980
SHA512

3fcb3c7fd2a2a83c834f9f68f1c8a1845228b0b1bd5459193f3c5b804d9868fa46675570b8660eaf3ab5f6adbb46cb5218d3ef55d0d0bbe30b005a1dd13e24f9
SSDEEP

384:Bob4Z7XezirHApb0D+v+fuJ6jm7am6KhPqquP2pR6C4QRDYKWLdagmwAbp1U0LlZ:BOsRYb0D4zl7qdquJ2DYKW2wATU0hh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421573193"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E6A6DB1-0F65-11EF-AD38-76E827BE66E5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1860	iexplore.exe
1860	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2140	1860	iexplore.exe	28
PID 1860 wrote to memory of 2140	1860	iexplore.exe	28
PID 1860 wrote to memory of 2140	1860	iexplore.exe	28
PID 1860 wrote to memory of 2140	1860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\335c83a2138969fd832ad12432aaa577_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
382449a1ad5d67aa5a02af2f5f413410

SHA1
846eb70fe4c68d61c75fcdcafe85039f3ceb7beb

SHA256
95ffa1ad907a0be4391fd4c4d8ce4351cf81d77e0edcd47bb425c60b0840a514

SHA512
09c72c5c5942d2b989cb99a816d0a594d413835e1f28db36bce2eee0246257ef4e7ce2f84df6fab8f3d500cc6ceb765535b1eb830dff480705512da782ce8cf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f6bae2de809438217845b5bb89b16b8

SHA1
fc704c134bf05f7c42014cbcc3bc8632bf6b57f9

SHA256
fb34e579a07e768787b749b670c7b946b12691af0eae72a7b503d63822a2ff63

SHA512
b77ce0c793ba4227baf6fc566c6a487b9fd043e3553738335f54880714569a8c3cfb5ccd120deae295d146f84cb90f225022442391ab6b78a3cb6bf8720cb813

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e136de5478cad63772b1572f40d718b7

SHA1
961057b8039b8f4efc5c440651ba5e104e45d092

SHA256
b221746e110c329653d097a99e30b370968d11f2616ccdb147057f12e9cef0c3

SHA512
5c444f12bb38e67be9c41e27bc31afb9d1bfb62314b90a222e0f30438dbf22f499dc897919f0fb99f74437523ed4d631800b757b1f8b2a38ea0a5322493fae1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d487cb06e5a684169e9505f0e7dd801

SHA1
16e0e31d1f6036a2a4ab4b40176ee4975484eca4

SHA256
88c8104954a70934ee947a8fb301ed3683f4a4c733ef04cbbaf8f870489b2ab3

SHA512
7bdab4f292afb26ca1371ac88a461411cb82896f573b9edfa724f2a4ab36bd3c53574bf573cb094168260643e5dc9d7285768c4758340269c7332460aea1f194

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e2db25164842f993dec500d2a42596b

SHA1
b7f9244d7c69a5d722d0ca463dfdd1cd5f772f6d

SHA256
1c85a805296d4c51a767223421d5414bee3c3e657665d60362e8fff85c4a9cc6

SHA512
2442cf96b77c184b9c6cbf32fa1ff1c47dbcf495c260f9cf1f2d526fc32e2f16110b4fb72cec4784023f98e6c02cca5ec89a1f7b3e9a26e2ec4f64aa804fe9f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f560150c8b5c0676b73dd53cd0be461

SHA1
42a3a5caa2ad4f839d69219c10bb4e9ceab7316f

SHA256
8462739747a42d88a29776c3ffe9243916677e3fff19fd272e67a0a4e54d9bb5

SHA512
63fc1ed6c8eb99a70fde415ecec473b7c559ed42c2f3063e415d40c3c16a00b715645fc81d55697588bf6c164cc6935fdb1f0bdc493775311bd851ff18335cbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5edb621ef6bfcb133d305fdb0101d8d

SHA1
a07c02f7c49858c9b123aa733ebff33c87d15fdc

SHA256
418f39bedfedb5daccb7627b28455cdd2d2fc1180c21d114914b9c1f2fdfc392

SHA512
2ac0896d457bdc2e01bd29d079f9e9b56805750ced44cec6c4336490101827c1be21d5607d8e12e038735989c10694fe0a8f26a150cf6c413645fafd9da8dd57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56d1b5866a30da1017c86b02786d4cb9

SHA1
b100c607e5893a66910804c46457e7220a7245f2

SHA256
2abaffe18f6c5b0b7c846428723fca90134560357c21a8384cb0ac4ec4e84d30

SHA512
37d77ea8a79c2aa95d98378792dfe83dccf1c1b697a2464955745bfdacac6b569c1fa95bdadcfd040706419f8fc095ff9d90f76533f511e69ccf59f114015438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8efce80f54064f1c17ef8bc42e944f5d

SHA1
6427a6e7452e45eb799e5f897b060d1defaaa786

SHA256
467a27b30c623fbf19681003167b4b9d42864ff20a0e57d88dd43130498a9223

SHA512
9e04e3fbf8a6aab53b862a70cad4ff26706fd65d53ba534809d2030171eab8aecac950dae3233b55f5d868af4baf61c12cb0a97b761650e631a0d01cf1448c6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5BD.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar61E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit