7d267faf153a6b7ba92c399ec0a671c8b1af4c5e1345153c4739203b37031a94

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3991719d8099b23c1b964c7f35756afe_JaffaCakes118.html
Size

134KB
MD5

3991719d8099b23c1b964c7f35756afe
SHA1

cdcde925ad1f862e373c2465c62db290e3ffc430
SHA256

7d267faf153a6b7ba92c399ec0a671c8b1af4c5e1345153c4739203b37031a94
SHA512

97b435dfc17148c47c796a4ee1ec3c3f7bfa4bf2c8081e4585b067906121f3f770f76c7eaa574419a4c8bbc9b8f7d5456334bb19e5afde4a386e6cfba4bfe648
SSDEEP

1536:SgTS0EtW+Ga+yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:S1GpyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E57E5171-1047-11EF-9C59-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421670515"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1136	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1136	iexplore.exe
1136	iexplore.exe
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 2308	1136	iexplore.exe	28
PID 1136 wrote to memory of 2308	1136	iexplore.exe	28
PID 1136 wrote to memory of 2308	1136	iexplore.exe	28
PID 1136 wrote to memory of 2308	1136	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3991719d8099b23c1b964c7f35756afe_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1136 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7ce64a81243fe718238b465e8ce9945c

SHA1
bca4d14b04f9b70952c8d495a06ab8acc5e0c7ab

SHA256
81e41a778ff732e54c6d2402f8ea275604376d6399e7fb93b074cc72c113a775

SHA512
f45be2cf37f30267c324d0d2dd0b9db9a90b59f9925aea54c71375ca6051fbef1fe77e2fb182b54b7ebf81ae7ff2029432c057ec3935f50e27570816ebc03ff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d976157489aedc3127cb3adbc5fb6c3e

SHA1
9aae6db77f34a3da26a65f735f817b136f618da5

SHA256
e8a3f2a51fc6773b113f7fd37426e0efc87787b3b26cf3cb7529f4e1687f6b80

SHA512
0db5dc8fb62ca0521d064e38c83ffdcae5bd0f199e7d63228c65eb9be788ecb3cdd1ba7c3472b5d304b45a2ea622072be86a00b232632dfda41da1020b34d19f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a593aa0535b4efc3574d6ed982ab1780

SHA1
5076c19dcd5fdf016d72525a88188b3c49764be6

SHA256
efc704d5f91cc192e8659c6bd75c79fb74054ea6310ce589a7c76c65098235e2

SHA512
57386b2942deb310c363dd7aa5d17ef7988302895d27802660e1bc490a7ba506e42eb7ecb527425e9278c2aa1af83f90a51d5959278ab44597659c97adac5e57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
512650f81117f9c598927f13fbf78bba

SHA1
e7ad2c3a66508a97248570f9eee054d293ca2415

SHA256
ed8daca1a0ebd18b9c0ec44ae776b98ae730f8b841eca2cf231fa86ee590949f

SHA512
d15dc0122229a6fd7f76c38c65497b9f61c07916e9940aa5d93154d2e33e3ce2609f7ff17624fa04882688a6be452d0368f28cf66920a9ed584a51549d8ad5ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
47b8e5ad1874cbf7a5ae688300b19b71

SHA1
394c54973839b621600b48cca3b5b018c4328f22

SHA256
3f483e5330e2cdbb13bb92010f5ad624a3d63ce9bfdfd8409a871fa5fd129d1c

SHA512
f6145d4b0c88e05e1f07de7b32ac3fc0c23c1ad456617398e9b25699ac33e5d6790ed7730e31a63043d5cc09b82a0498ae26818059a2aec417fa93d52e063ed1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1d3bef0f054f28d22389ec335eba6c6c

SHA1
7cca8186330eb08fc6623280709f6bdccf5d2255

SHA256
e73a86bf4af6b6058889da23ac2d8b083f896eee2e6a929e7b89627b12234eba

SHA512
c439fce68a8231fb40d49106f0ff39192fb9fb27f2818404886f51c08a343eb6505d33ccbf1324362b166581784e1d5c9d0848bc32ca69cc19abdd996a12be3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bdb5134dbbdf476cbc8163d045a99691

SHA1
5b5b18376217cd593e41f843b4b592c8088138c8

SHA256
8e59ef033d4312d62e610a2b41cd5a32ebb1d47c2969acd79d4f10f99f3c0705

SHA512
e36decfd69efd84cee872a6a978a49fad7e7c63259cae97f47e955416d62fd44720e16cea7be09dcaf0f32e08b0915675e4f7bf2a8ab52e26d64a6544a5029a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4d20512155fe3f519c7a21f02b3e7f20

SHA1
86e241fe23ce2a7919a709070bfc7c0e0a17f2e1

SHA256
28710bf21dd70a7ff52521d6f1a109e8ead43d1dfe4860ce4defba95a0a69633

SHA512
ed728f0ba2a6e9a744a6b3cf2db5ad7b715ec3f9a585b5cab0b5ef09084b3693db623c946af7797f0effbd8276c5f2f6f0f32ac9754764d52b496fc7a6f5cbd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab907D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab913E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9160.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit