a47798e23dc3f7e7253db4287a6edcb5b54843cdc822ac10b5de51b556e421c6

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3adae49826f870dad091ca692b3f221c_JaffaCakes118.html
Size

19KB
MD5

3adae49826f870dad091ca692b3f221c
SHA1

96ac39e7016cadaecaa4e72aa2ca25765a3ddb8d
SHA256

a47798e23dc3f7e7253db4287a6edcb5b54843cdc822ac10b5de51b556e421c6
SHA512

bba15423a589f6d9e4cee57f8b2e6e5745de2ef94658f1044375d352202369ffc22105790a04c05f2a8d51f34f39b0af5e0837418c9fe06d5e75e42f03d52857
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAId4xzUnjBhTV82qDB8:SIMd0I5nO9H1svTuxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F404B531-1075-11EF-A18A-FED6C5E8D4AB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421690293"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2804	2208	iexplore.exe	28
PID 2208 wrote to memory of 2804	2208	iexplore.exe	28
PID 2208 wrote to memory of 2804	2208	iexplore.exe	28
PID 2208 wrote to memory of 2804	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3adae49826f870dad091ca692b3f221c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f47728f4d4c10664c412fa3160c72cb

SHA1
58ed41575b858441cd818c36e91762c14a208165

SHA256
d74da117511d139d66e6bb8c6bcbc9937f13adf4ad001b695f685f34246277e8

SHA512
32b10108ef19b7519c972babef6f173798b49de4b10d0dad6452e3879f8fc6d677b20b4992290ec1ff918a205d2b3615325ddefd64af477ec24e11491ca61fba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e245d37d902e9dfd7c5823099f1c6c9

SHA1
08a865fa93ebebd803da5f34ea9deb49402649d4

SHA256
3a38f61d87224a5375345c31a9318b44709adf333df82f1671e03851cbbaa57a

SHA512
f89edd7814005ca7a02dcf23f2276e92ca907a600f8ee64aa20af4b5819847b24853b06b433278770e7050a1e5c1b4c2d65371e919cf3d4b167c1cd48688df4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
679051fd4fed9c41a5890dae4932fcfc

SHA1
2b7c6ecf5d11164601723bbca11abae21c805784

SHA256
eeaf1a3042363da7bfdeca0a90464739676185c9f4c6e825234bbdebab189632

SHA512
37553f1b0502f7f0bdc120e7199eaf6634b139d36bafc57cdfa01f130a75b66f066bb00fc21816b3b08ca2a7ece58f8be9711d5d03ecc70147674684496a8fe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b62531414e9233563a8958b5cbb7101f

SHA1
e82f68ab49d506c1b0594c4ebba95fdf4ba02047

SHA256
35cfa9527249b35df823f26146677fe4506ddeb2f4092488a87ecaf12ab4e87e

SHA512
325c8fbfbf54905e784e390d1ecd3fe6c66c5e3b1ad91a5e6fd89f50443ae4574ff54499155dffe141a283a57b40428a51cf80029d6bca9a3b4699792388efed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46c795ffb3d82a7fb52c8eca09ee3680

SHA1
c6b60c2cb224f23b8201b3f8d646c6198fcb40c2

SHA256
c92f9c4f3813e30ebf9101eb7a55ac4eca28239bcdeb98897d75e891385df328

SHA512
556d51b2a59958c989772dbd75cfe99d14a658a7d2b114226cd7ddded07cacc43e07e6cfbb310d184e53132e3f5cf461e55f9a48c96715ed2a11d8123319197c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
378b40774516013995d3cd133dfffd8b

SHA1
95b68fd82551d1a08df25306660aea2b2418fcb7

SHA256
0712f6810c373bb4985c6b37f02d6a171a53401958ff1017c6b12b922552e28f

SHA512
ba9c1dd411a7f6e14678543a1067272aa18c0d8e907269668cc5d01c62f4527d16f48d71ed6c9ce65f13481ed07a5943608ac2e0044196224ef3dca0c77d3027

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b7898b56afaeeb08d9c96d53eb17513

SHA1
f8d27b99a6fe1a04e5899acb361498c4a20f98f2

SHA256
aca26008043a24db0da95a7b900214a8bb244bf7acdfe7a7aa2eeb1599f48013

SHA512
c11f65760059e9e8aabc83c249a6f0696032641377d05e10349669b4313af50b0bcd6862534c411bbb0e9748af33504f30899d41ca221c056df450f37299a249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f5c56a6ea2eb0e0d9ddf8c4b8c1cc4d

SHA1
0e9b8a8bc05c43eac26a6b80c132f78abde7b157

SHA256
b99e4f44b0efde6ac455de146bfe1b752d5d84cdaed21026943f1e24fc58f1c9

SHA512
495139c34851b67f6bb9458015daf0fa1457424f2d2a2fdc23089de980c8abefd6940d216c21e59d36a90ba0a7c590ab3433b2c31d0cb5c7b879d1ba324384f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cdf6dbb9b16bc4d500d536ce80ee539

SHA1
d1dd90d58a8e2da24702e5bb7a0f4bef394a20b8

SHA256
484d1b6eeff4592e460e11a9ff929d94dc08667386be3167587e33e7ba71feae

SHA512
e6c62102217a16c8c9802476f7a5c5bf74aee07318b21defa8579fb1f50e61cd07a61a9eea243255e3d2f64b6c34087cb702483a6d0236105279f4df608a9a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab25DA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar262B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit