23b2d4f6572fb439ccf50fe6c0785a1c559a320f32b800f254b97d39c85817a1

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cef7ad38a54b69c71fe2cf00397c2a3_JaffaCakes118.html
Size

19KB
MD5

3cef7ad38a54b69c71fe2cf00397c2a3
SHA1

afcb33dba3f863ffc9de311016dbf2c0fc2eb649
SHA256

23b2d4f6572fb439ccf50fe6c0785a1c559a320f32b800f254b97d39c85817a1
SHA512

5fe046c9da4b505c598da6e234f2e656ebbd0312322f17055ac5c57ee15d6ddfefc41c0c6a0fcb75ddc6e9bbbae5bc50f6988d6507f60ea601b58942f9e5ba1c
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIm4EzUnjBh4C82qDB8:SIMd0I5nvHPsv4RxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE652891-117C-11EF-8859-DE62917EBCA6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421803270"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2508	iexplore.exe
2508	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2904	2508	iexplore.exe	28
PID 2508 wrote to memory of 2904	2508	iexplore.exe	28
PID 2508 wrote to memory of 2904	2508	iexplore.exe	28
PID 2508 wrote to memory of 2904	2508	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3cef7ad38a54b69c71fe2cf00397c2a3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
009c4352432c8772b486f22af67ba609

SHA1
d841da993c72db392ee7e1425207a7af1e01f9c5

SHA256
d20a9163e556f80325653e9eb6a3862f0049c4d54cadd1dfe227d4538ebd82cd

SHA512
d96a28564172f803e33556fa5a52e618652bcb42864f144b8bee8de87b82bdae189da4dc7df2f84ff51e3948271327624bf3baf4e1ed4031695ec1b511bed6de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb983e3227f197cd9c59c000eca6a3c2

SHA1
d1ff0e8fb16257469b8c017228bbf15373d6f6ce

SHA256
d209aa9063dfa11490254acc4b62ba6e6fc2d8060cd960ffef2cc01763748ccf

SHA512
cc3a90fb646f4498de02905de326f7b0e8fc95cd47dfda5027fa60e08c8126bd2d7181de564bc955809ff4b56dc07f6835c740e7391c033823fe48db27ffd6ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
685524e6218da8b9c9d73484d79c4630

SHA1
120725d34da1e89afdafec62528d433db462c5dc

SHA256
4e88ce9bad80ace6ee49d67c08c63ad18293342c2b98a76420185ce1c92384ff

SHA512
642e3beb402a8a09b61548049cfdde84920d7d9ebcd075bc4a97ee9ef413b577d594cbb9454b996343e5c8d7297c390cb3b1c9506f22f4ad62a8dd510620b8c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73db02279603963de2b78bb25e93a363

SHA1
95fcd00ad421a511980eab4747f251d2ab952374

SHA256
5bf5daf84598c8a9a22506f459d5a29ccbe6020c60ce243004e45df5aaa6d326

SHA512
2df4118e90ad5aab6fdc72e8013e2a8313efd56c0d1486948c41cf4218aa66f0f14b72cfc2de50be584fc68a8c32fc1395edbe644b682c6ecee6295a176b0e55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fc31111f0fe9dd10258573986095f35

SHA1
8e42e980186b9407e98831748752db33056531c9

SHA256
69a3e43c932cff57960233c8c2ff059f621f2efb801faa21b4cf1a2b32586da7

SHA512
9db2d3a83eed2956d1ea60b1aaf6297e877c553e1faf0912b9fd1e162c9812c3881cb18422393b670bc0042cab2d2a5d6682ffc77a8db9ddf219a4a450aa6254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f05a7654d3fad98b7a0747850d2f2cb5

SHA1
55cea3137a2cec456401e0db944b585c3807c578

SHA256
3ea80286e43738cc362b28a144623aa3569cf9c9d29a1ad21f5d67a7b8ffa463

SHA512
b142324727c0ac4935a5bec7769ba0cc1dfd9f5ff210d39a4af299272e2e7a13aa92ea3e756da0d420301c58ccf47c738a4e43b51e2f632f13819e1e2fbaa3b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48c3e04331b6aaca3f1f405980052756

SHA1
8e7bb33589bf089edd83a186edc67472e837a9eb

SHA256
3529f5c9b39637576a9eed20bc919815cb9b3d5afbe2923776b16eedc857cc4c

SHA512
38142deaa637b9dcf9a93eaa5affa5437430dcf5a137290495f24cdb3acde4f353ac6aa92cf809fbe6ac5c0f60543ff868c8fa2ffdc98edaeee3b9582115ce74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5e63623ddea55b254761f3b6a6cb2b5

SHA1
74bff62e9064c0f7c3cfbb5b75a9bd9c2f8b8b00

SHA256
0008d49ff977f54b25add16b73a0415d0d7de00f8ba06a883525cce1907d5672

SHA512
79236d531724ffb64698c66b2560b29617d3e8ec7f5b2b0f1a67452084dd22a8e8de9d266ba6ee63b72225f95f3aff8a9d870f67f73fdab9294c4644cd1ca459

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d7317430fdf30e9b6b5db9bc5ab3b9c

SHA1
da991096de9700560f6c3f33270bfa98bdc5c0d1

SHA256
144245d6b0063cd79d4f0199f14a68bd94eb7cf2a59ccdb2dcf7b8f14221cbd2

SHA512
116a88871b4e4dd05e1e3f5aee032dd56f63695fdcbccbd6befdfcd0348bc6edbc3b827d58972acb2d37a9e1e95ab40d19537f636119aa2e00cb349159eb5f7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab96E4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab97A2.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar97E5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit