41b5a4311bb4c31fcc374d08d142461a8aa71095604a6d56d4a5162b6c979cfb

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c732ae41df68c9f0e58e813ba04d1c4_JaffaCakes118.html
Size

19KB
MD5

3c732ae41df68c9f0e58e813ba04d1c4
SHA1

aa43ee2981a5f4f0667c02cfc46dd9e09f488f2b
SHA256

41b5a4311bb4c31fcc374d08d142461a8aa71095604a6d56d4a5162b6c979cfb
SHA512

ceb31c7f93490f080c76543623a9cf8438cbbe1873e769aa1eac89d8e2c6e85943f9ec754f4435658a123323ec1f34f8a88a7a7e557049940ad3b7dd5eef80ed
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIx4nzUnjBhh782qDB8:SIMd0I5nO9HdsvhgxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2949F881-1167-11EF-8FA5-CE57F181EBEB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421793892"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1676	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1676	iexplore.exe
1676	iexplore.exe
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2308	1676	iexplore.exe	28
PID 1676 wrote to memory of 2308	1676	iexplore.exe	28
PID 1676 wrote to memory of 2308	1676	iexplore.exe	28
PID 1676 wrote to memory of 2308	1676	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c732ae41df68c9f0e58e813ba04d1c4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4d7c5f988a0296f881d2ff10fa02031

SHA1
34fb56a881b43528c2dafcd39a9f927f4146a77a

SHA256
ce79aad45ad20b3d45443098a23bf7715ceac1c06e2b964919bd9976e1fcfec9

SHA512
c13d4184a95b884d620aa0a692a0490f4fffff955ac57e86a9820ae659b4a06e16db62ddcf1efc865c8e24ce3afc7e90dd3b8dde029d1c541ce1e0d226bd2ce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0453897b69b6bd0012eb8e05b94a47f

SHA1
f395f4f3559fd3b38d5f67265a5d9775b87e0e36

SHA256
306df70689d177c2e90d6744c9375419a93387255418ccac4abc8e69f6c00329

SHA512
634dedce3021e3903b71a65b93e26ad58970139593b8ef73757509356347ffd4ef5647dc4e464ee684fa35941404e50b377a633284e9e62c9b74b75aed04d9cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7e170acecf1394d241edda37a539e17

SHA1
dea24d56626c8c8b497dd4f973d851cfae43b569

SHA256
cf8ecda4710b42304f6ac010de25d5462d5e4c2ec0ae75f9b4c40337d60e8085

SHA512
d565a55b6fb26d62ded0cf48120dd02558f6fa1970d64a37ac1d0125640ea5fdf8a0b5848e8aeb8dff0d08e1b13fadffc6e0db8d9a3dc6d9b5f895a29ecd53bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8e8e2b5545f43435a719ceb195e3f06

SHA1
d677d99ac9ea7dd8b21f04d797a1d618c841745e

SHA256
8e408299b01c5abf915cd34a7c31caa12bf8b26fe62bbb5b3ece37487dbeb3d9

SHA512
0b3fc33f939fd272b1e7aded341438aabebc1b1c2cc63084f31a9e5481c0eaf63306c573b7dcf9ee6189fbbda228a8317ebeb3520e7f00934d36c04eaec1f33f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
982c0e8e655d61fb5bde7a83a2174a69

SHA1
3d393cb779ceb7d287b40e7ee041a0da5aeb0067

SHA256
3d5e0f2ebddc789ab574de6d7a6628910917fd6d602b976a8107deadafc77bb0

SHA512
2c29ff23b12a97217333aba6e1c5f4eba810d3f44efdc1918fe45278ff5d3e66300e8161a9219a1669fc6625e540bd3d45091db388c3e5fb8e83a5d0b66af849

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80b41568e056897c94be2d53d1386423

SHA1
c0ae1d2852b20a54e4c48e5b579d90e0e42471b1

SHA256
00a5fd3c2bc30369ab94007c7fc4ef9d7b621c8d8e3619307063d9ae5c52101c

SHA512
033378b55dc854b035cd2164d123efaf4434dd1601ff9c79852acc353c4ace3308e942776cf8bd25d3ddcf9e0cff43a60f0a49dc07bbd4593811900fa2878f02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8f083bd80c9a40d901bbc3160e8decf

SHA1
62b6afc28e14b1982e9a696cc71d4676ea3a3213

SHA256
5518400c0b12250018948263347cf8028ba726f8f2cf0a4e1cb35b5c55c66b75

SHA512
7f086a6041308150556d754194eb97531951490a03a2c46cca5f2d65253b7ac97219950afc29fc1a34d37a3478176140b72bec807d9f09833dcb9b0e6f07fb65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43733ffb97ade36bfb89554ff65d01d2

SHA1
e2c9a7edad80251f5de223ee09cc1c90cacdb44a

SHA256
23fb6e48ac4401d3fa68440ef91a224c01578ee5443eaa4bf4538e316531d062

SHA512
dc474a361ba0ef676959b31be1055c389f2f3702f8ffa495231db3f15f45353c0de33f2bbb7d7650c286b17a3f083f92b75747c272d3d7e2821d783884806256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46fe24e7d0eb78c6de40c59f806a7382

SHA1
1b771b3a00a7438fdebf338da77ffc94df9e1bb7

SHA256
06c3d37777c94c1a732cb436ec72deb5dfe527cbe141c927e6cf7263dc322b79

SHA512
93eb5d4fb9dbf9221f8275de219c48457ecc725fb4c34de76640581f812f23454746cd1694f701deca16a8326ec4c1fa36511856a74110167ccc2c3bc05bd285

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B6E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BCF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit