a4346c5c21e3df6954b26a8f57f5004da725e34fff3c8f261454c9fd6e0e5233

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39a0bc1be0f3950dc4fd41e5d18bcb90_JaffaCakes118.html
Size

19KB
MD5

39a0bc1be0f3950dc4fd41e5d18bcb90
SHA1

16731e394a94a234a4e0f73a39a2c12832e4f4fc
SHA256

a4346c5c21e3df6954b26a8f57f5004da725e34fff3c8f261454c9fd6e0e5233
SHA512

45efabb7ae7f1213fcc8dbaf90a396bc6c472e882db90044ea9de9b0452a5511de1d1bdaa7a766f2d32e20fa6d9efb8a9c734aa6415de55836784122c5b28d2e
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIg4YzUnjBhQ682qDB8:SIMd0I5nvHVsvQ5xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4903051-1049-11EF-B804-569FD5A164C1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421671397"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1652	2972	iexplore.exe	28
PID 2972 wrote to memory of 1652	2972	iexplore.exe	28
PID 2972 wrote to memory of 1652	2972	iexplore.exe	28
PID 2972 wrote to memory of 1652	2972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39a0bc1be0f3950dc4fd41e5d18bcb90_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d59636ab43dd6de933cf11238980955e

SHA1
f930e3d08219a302a6cf37fd62011afb1850ffc4

SHA256
a10f4a54a04605d5161eaec5e53a5ec72c93277590b66a82743bf5ad6a2a56ae

SHA512
0f57557c34b6f21c0b5465cbabc1091241876650e02afa7edee52fa69b9c8863e43836f9fa39c162c1b6ad36c6fd3449a9872e40e84d7004ada9d4332ce7ad77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c030294719cf8e2482cd30d40e05c684

SHA1
4cdeffb0ee19203a5e9c14bb6d888c31496e518f

SHA256
11cd353a729445d21e805c57ebcca0b40f9ad9b8bfdf221e8056af052618823b

SHA512
409f55b7e758149c8e27eab3e556e34004938cf6b59918b07e1f1f99ca3210d413f0495c74b6b950db5accd566998974f8340215a5001201018f887010da1c32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b4c6fea9ad94f3ec12d0e3b83aab97c

SHA1
1db81f5276e6ab882a64733f69e3bf15b6083bc3

SHA256
4f84983590158a48f6089faff86ede78f46550f99945984fd62519edd629d6f2

SHA512
ce9a7ed3e29497f20a63bf26cf7d1f1d40cc1b71e56157c4afbd70ac406f359897f5c7479d3ea73b1038394e3615aed315d5e23efaafe7ff559d7c4b2b1d6690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6da30032570e30207b1a7eca26b00855

SHA1
38fa7ce87bd26f81b8fa63681a3c0f35298188d7

SHA256
da8607e121a5fac2c37577fea4e90e132b5ba2f259b3a1fa17d1d13df62c0ba1

SHA512
8d47f252c8529a164a45ec42ee5d0e04be6f297e3d8b051f7759b4c3e9d91596b2be24ccd10a5ddcc1af5d6c129d630082ad92fceb7b9b99cfd0b668c9b74d61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef3a47eb45d57309b5f96ae575ba37e2

SHA1
44036167ac7f1d00a5816f7cb19904832da50504

SHA256
88852a45a41ef3d21c26a4d11cbaeb2a38255bce389098353a1b26187e4cc945

SHA512
57ff42fdce7c7e752e876d55f8e12beedd7157ceebb5a6f52a6e2da4c94ef9b8fec3e397c57a1ba1cc8688799a5993b6f78878d95f20ae292530d1055b36508a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca1d079521399406ef4df4e824df38c6

SHA1
35165df612bdd6c470a26b67f2fa452c909b717b

SHA256
48d744879abdba7bbb319a7c0e429bcde0a07e7199493ec1e543551035eee6d6

SHA512
c6c0897ebf894706ae9d7c887655869f02b85209efa4df366ea17a73d41ad3491c9a09ab846505aecf555d5d43208f6bb3e1bb42538b66eda6b1f5fc8a904010

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a3af00d5bce83d0ac11a537254bbfdf

SHA1
66d675538ff6ba12b32abeb7a09dce1528b723b5

SHA256
0f113d5fc07cf949254bce5724a4e345c4fa58681bb374bfd52420c209a7a336

SHA512
99714faccc684e042ae9b5c6d6fae7d84e5965067484cdbc9de9b2d37b633d27ac7aa96045d1f13666e88999e8563660fe8a5562d1cc032c0a3cc809c1b91c79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccf18a366db0e7fc808f13922734b5f8

SHA1
a90196f7a374d88e0a9fd35871abc7a5deb6cdc0

SHA256
6f204735f02c016df97088589545a5c6c1991b41629b9389a9ddb5517cbb72bc

SHA512
c590d86ee79ed743a9797b75220781743198aeac8073d0e1a8e1664a89f217b759db1b0b8a0812d53ea3c50a7b8481ac8d73d3d26be5fcaf764f6a81f96aadcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db01336914517b1834e4811c16a09027

SHA1
07916cbbe6141a46006b67d7b62da0df78c430d4

SHA256
b023516108df169d4fb481d690a87263c1358bbe244f234cf87f5ff4b2766f8d

SHA512
8be94b63b202d000bf0eefaebf3b1bc5984d3cec9e65b36b221e2806697a1f5da20cd7baa455d57acd352ae9013e498da65179a7ec63543ad6084781ee0be27d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D14.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DD1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DE6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit