d64c86861adae04348a16c357fb720883d686f8df375644dbecdbf859d0a952c

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

402dbc0e355a541068248755f52e8026_JaffaCakes118.html
Size

235KB
MD5

402dbc0e355a541068248755f52e8026
SHA1

df8a517f7375e6040520b392d89a3ab1c03a5641
SHA256

d64c86861adae04348a16c357fb720883d686f8df375644dbecdbf859d0a952c
SHA512

474e0872e1725350b7312ada7bd4d60f5dda66b001f7b09df857d9c181b81bdeeb5649d8bb6260caad0d8ed806df6a3fe0697242322aff27d672a5cb4e75a2c6
SSDEEP

3072:Kir4yfkMY+BES09JXAnyrZalI+YuyfkMY+BES09JXAnyrZalI+YQ:KipsMYod+X3oI+YLsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421776345"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E6BF831-113E-11EF-B781-461900256DFE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3000	iexplore.exe
3000	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2984	3000	iexplore.exe	28
PID 3000 wrote to memory of 2984	3000	iexplore.exe	28
PID 3000 wrote to memory of 2984	3000	iexplore.exe	28
PID 3000 wrote to memory of 2984	3000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\402dbc0e355a541068248755f52e8026_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1390bea951e0eb896b9addd600459602

SHA1
24abf4163ff32965bd173908984cb50e74fe8c38

SHA256
cb48bbc79d049dca2b480b1b3c2ec25aa80c035b28a80916e21c4aa1cc0ef582

SHA512
5faf2cf18688cf64f7c057ff515ca8411c432134613a912ce8c3437e0b36aed9551bde89d1633915260530716cda85b64d7102537a8e2681f12fe0ff0b9273a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1035ed9d571cb2bbf6dcbd2bae6420fe

SHA1
f70e1b488578d3b977c7755b33c348c8b1253442

SHA256
51293c0a2117d44cec03db7b7d6928e898e1520b4064dafad30ceac9878fddaf

SHA512
7920890b2e3277736069b4e3ca7b2a42a3912b863f6ad45265a737a5c5e0d4fa78ca8deef4a2ebc91daccb10a73b3db55eb85c594366e8a02abc24058eb53605

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c163a486d1eb66589225a3cb64774a49

SHA1
126fdda4e0bed0404943a2b67029b9a4c9a32ee1

SHA256
287fb0fb3adc5ce4ecc619ea15d2ed40f7b38178ab8c425e8cd8cf6dac9bed3c

SHA512
19beb91d7010a6cea291fdb975ee5d2439cc8530120ad7c28ee8cfb1746b35dd3838b56a444718838dc9b4eb95707afbd03032733400e0c05413e0edb56b8228

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
244f2a7d6b4b58835b9ddba30503daaf

SHA1
0aa65033cd2691c33b38cfccebc3c21a0e104c4e

SHA256
72c6236909d6f5bd1ba816eca61c5acda1efbae51fc934ba079023df1c4b7a8b

SHA512
06c327a4a551c1c2dd5df624ac9c469c8f940abf73b2d199a686cf46c8b53a1e0cb4f3be08b31e6d98b4f2152ada73bdbe68f6016d7593a63adfb78f448e55b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb30b0195a1cab18ca128a891858b233

SHA1
978af42e015236b8aa9796c20b5655d067507a50

SHA256
1eed6f3df69bc9d94bd3092967ba2d59a6eb6a7162bbb6061dce8d2f131be93a

SHA512
e1b49d4363e690901ccfea1a0be442ab386d5a3005930880f39222fec1b5e47df949b95fa5e801de6d37d3b4d1ed4c3492305ab5583c9746927df8586242cf68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61080d486a1a85c252b0fdf0e00e15fa

SHA1
02c4580d0754ee480a8985344b99ea8946223cd2

SHA256
4b83874caa1fb0437e316460ba669fdce4e8e800f630307051bedc4600c5f8f0

SHA512
34be632e0d00da687b5b2b15f3e1304c08ba02a55504b3de3402ff38ffed8b186dcaf47adb910168f706d2f12037861ca0bf52b52cd2f2c9b04411ba52f07c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99b0569515a08ee5e328d26e22895b4d

SHA1
27423863a683ed9075202da596c0cbbfca932bad

SHA256
c7e495a8036385289b0545bf26f4650c289d33e896101885af95892c7b0ac3ab

SHA512
425b5aefe0b6c6eee441a36d8beabb4728ca871b5015fa3fb9a2bd481c98ef79fb36fb7f02bc3379a4f0c64089b7dd2c5f31d5e6226cc2bbb58e49dcc611f792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
492ba1357a41bef6941142307f81dc60

SHA1
8e63df05c2c364664e60bc61b854fcdc88c98c0a

SHA256
12e9b77f5451ac8810909afc2b90b1167912443f44fa61c8eaeb1d9eb57aae82

SHA512
d75632adb66b9af3c7beeb393e0ce5b73baecf8677c6db0c7abb22810f3367b59abee510164a93e1ed680f7d00b13f95c494fcd6f187aed8089f2ac9f0e31c17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6764e55a06381bd6b3b1fbd9c610c8b6

SHA1
6b67ebfeef3046d9657f85c5119dbd30f66b08d9

SHA256
173d95dbbb03f2c12301ff7dafb8a7de8f0b74ecd075cb699ef064d083bb0ea0

SHA512
e0177cdb17d8dd5f039f092fca0778faf6f5dfaf56cb4e500b551807c8246f8adb8be16452899a2af77f01920c61896d58a8cbf1937b4faf581f1e93ffa819dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab12F6.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1367.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit