cf0473537fb9a96fe487677122f6a8c8f02e1c580173d91fa752c81fd0287c22

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e4b44d24ab2365fd6a2071f9809d1ef_JaffaCakes118.html
Size

25KB
MD5

3e4b44d24ab2365fd6a2071f9809d1ef
SHA1

1575eccd129ba15721c4797ce1ed2669fc5a26c6
SHA256

cf0473537fb9a96fe487677122f6a8c8f02e1c580173d91fa752c81fd0287c22
SHA512

3b1f9af8998e635621a491ea931358ea2c8e5a1d4a7a3b626b9dd88c64877dbcbca55981eacd145e5ed31555e44727145879fc8191397d93ddd82391f45113e2
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIl4vzUnjBhJz82qDB8:SIMd0I5nvHpsvJoxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C82CEA41-10F7-11EF-A346-76B743CBA6BC} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421746054"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2028	iexplore.exe
2028	iexplore.exe
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2016	2028	iexplore.exe	28
PID 2028 wrote to memory of 2016	2028	iexplore.exe	28
PID 2028 wrote to memory of 2016	2028	iexplore.exe	28
PID 2028 wrote to memory of 2016	2028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e4b44d24ab2365fd6a2071f9809d1ef_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d01685e9ef0256bcc6c1750eacb726ce

SHA1
31ab62a0c07971ea117f5359676fd013cab021bc

SHA256
2f9ec9efaa9c1a8d0044001361c2e5ddcbf9c2c93c3cafea7c285daf9c479e22

SHA512
7716af5c6386ef1788c41df61234148dede3df1337276739e352f1f9509679d9628f32d7ff1e9890429ad1a80247da79250587d8941f4a1a4aa232bc39877690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b2a148192a0ebd787270595cdc1394b

SHA1
d9ca65c11292872a282a3fe38509d5a365b98db5

SHA256
2d9fde6e7f2984b150b3257a2e86d072a8b25d28b4745cbe8d8eaf6c83aa5cb8

SHA512
6fbadee3ebeaaf47777dabf6f7d62aa0e9319911439905e9b1e56e9ee1beda866c40bbf51f4e0821b0d531513aba23005a4381c8c22f9f66f67cfedadef9f163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b93d505a207ab24824d943c0247fa693

SHA1
4c7548b14a844e631605004498fd6a9de42f6ff1

SHA256
ebbd99ce540596ac555be46c4a1c3a2d779b0636c6e7dbb5b1076927ca4e87ec

SHA512
75691564b6d44418c5f0a48ce0d7ea8b351de35e8392db6474cc024de6920afe0977c0b8daa182144dbf3e58023b039f26166cc05220321b029ab26c20f1f1dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8b6a4a5b09fe6292587471acf6c1a08

SHA1
a930aa076815a4840b418c552d35b1dee31020b9

SHA256
d5625f86544c6c20187470686fe3980d4ea9c3c7b0b846c90927efdf6982b40b

SHA512
61c7ae60f0359bfed94029db621c0d3aa53adf9a10095581ab48501a1cb5db3a53f4b2fa3bdaa6777eddb0269c87da293e7f2d63a71871265a13cd496d3934f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69be2761db4ff036135a8b567acee010

SHA1
a90d36899963ba8f31b8ee2a692d21536c3f044e

SHA256
0fb815335fe0fe9c4ae00fd4816289193f8aad4186db93af70a010fbd7a50332

SHA512
f0ae8c094173aeec20326d0349e7ec4265435a456eade6ae22344401f2f280b986e53ed4c5a0b1faa67039db96972c02fb18a45edfbbc613f3c51a3ee8bf97a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d98172e16ec6ee2d021d267d712be344

SHA1
7be1463c333edbf1bc570ad29262417ea3b117e3

SHA256
ad20f76c86e15d1d3f922e104198b2bfbd393e1905a13ac9622c74c81b2597c6

SHA512
257fb356bafa48522275ff18e9a160711995e1d1697e209b6945025c5126b4faf9a0ac2d20d592beb6b3518d7bfb3f609a2c47847c801791b5a718b78ec1877a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c1f2c310e24df451c1170d518e1dc03

SHA1
30715c14572fe1bf47bfd19c7da56ea555908f00

SHA256
9cc47d388339a977b07450fb674a549977b388206eef83409f2c7ef9a4372684

SHA512
0ecf156993da8ea7aeed012d9ca6aee6af194ddd15356ab18492155742d8751633308dee85ffc6724056e878a177b0873a672f8b269bd13433c74b0b4f25e6fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ca73f50d87e29ac3700808eb2c1d010

SHA1
b33adabf7e18e659d19f06d5b091c4c9bc9843c9

SHA256
201caa207fec37c1a0e3f451c082d0e52d21458141fcc0d0bbad99de2eadadfc

SHA512
2ceab01fcd09b3ec1425e2fab5316355f54eced6f877ed4dcff328caed7ddd36ece18b51f6da206d34d006435ab9b0e3ad037c3b13f4a49d1995dd1a56d558d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab138f4c5aa8b7ef7361cc9a7278a8e3

SHA1
e928f8f3b9098666fd5f2b5b59468e3a5e608dc2

SHA256
f6ca6c25871fcf555e3cb027d61d6bb7f8272098833aff69ffe71a0f4cb50fb9

SHA512
63d5b30eda3aeeb835feab36bab0e6298eee986425bd10535f821c303d95ca224f7317227f3f0b9bbce48c122343c46f4bd63f7bf13e8aa11e5b55c37920f05c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3AB.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar40B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit