61fb5407a32c837c48f8b47f261800c9d482756c9a31e1b330d637c10d211c19

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3df891676ca49cb78ffd107b84934851_JaffaCakes118.html
Size

20KB
MD5

3df891676ca49cb78ffd107b84934851
SHA1

dcedd8134e1079759a537dcad277d0c266028eca
SHA256

61fb5407a32c837c48f8b47f261800c9d482756c9a31e1b330d637c10d211c19
SHA512

5ae7eb2c80e8c3459552fc1cd51897a961972a6b5bda1a9bad9d1794a53857fd2491d69fe9543919ac0efcb4295bb9f70f003e820067437503728aeca09abd3f
SSDEEP

384:SIMd0I5nO9HaOjMOjgOjgOjWOjkOjKOjKOjKOjIOjCOj1OjgOjrOjjsvAOjToOjt:SEIOjMOjgOjgOjWOjkOjKOjKOjKOjIOo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{44382571-11AF-11EF-AE43-7A4B76010719} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421824860"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2028	iexplore.exe
2028	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2780	2028	iexplore.exe	28
PID 2028 wrote to memory of 2780	2028	iexplore.exe	28
PID 2028 wrote to memory of 2780	2028	iexplore.exe	28
PID 2028 wrote to memory of 2780	2028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3df891676ca49cb78ffd107b84934851_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
392329552dd7217b8f7a32ac09a13cad

SHA1
986f2ac33234a157ae231502558001fa094da9f7

SHA256
41c37f9790bfaba732a0874d45905f03661a33d2f44437795067928ff117ff6b

SHA512
4b02cfa9e5c1dc81eea1f058f118726d427cd393f65a8268cd299b5c9b96acd279a82810cd5d63f4b91a74f31438e006d73dae2056a4559aec6fcddc2a24fedb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91422e5548f40e957762b826a02999ce

SHA1
4011cf9a281210a58484db491878c3560f3cf2be

SHA256
afcfde218fc21e2025cc5b44654aaa14b034fc2c68b30380ced061e2dcf3d90e

SHA512
a47ecb9a1cadce280da5c2a06aed01604599fcc7c4fdfa2d0dcbb8bcfb3a8e669b815cebc9530e405e1b13f90fe8c6b3ea9f81041bc8f9200d3323b5b7d3843e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da7924f6ffc9f5ad678c7743b3ab9341

SHA1
f392ccd771bd7f7d3ac10439cd98116bcd51be29

SHA256
8c52a2d13d25ebf65931af1ace54dff662b1901c69c76b02e9666d8bcea7f305

SHA512
1c9d06d18fa6458416426a9cbac39b55a24cc1b9147d53db6f73f95a9ab503fe005aae5074aa921b4d553325cbcb5b063e6b83e6d282cc053aacc020578a8f5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02dee01163ab6ce190fe024432eabc42

SHA1
0dbbf5e0d828b6b56e2bab8772ba3892fde89bf5

SHA256
b02abdca5d65a6339e5553f0501b919adbb30c01ca1a859acbf2ecda8bc47a1f

SHA512
fe66409e68cead43f55c61ef5ef284239115ff241f91043b46ebb83103dc1b8362cb68edbbb6b9a36668a254ffe74e9ef76cb814f7c356224541d761a19c75ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bb7b31a8267684b35392da3040beb6a

SHA1
21d2ad088ebfa33517f0fd29e3035de09a9fd787

SHA256
c8b96573423e10e6e4ce772c576955951c2b2a27119191f0f47427626a74a117

SHA512
cd09852dcf4e1b19108906f95ded6bfc0b43d0dc7a3dc1f44399db8f5c2d107db7ecdcb1c960ee311f33fdb3790c48197fe8594efb5241bf3bb6f650a78f185c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3bb682e9a13f24e5bcfd9de241a1fdb

SHA1
cc43897f544662f1170e59a475c36be516f99893

SHA256
80c8e2b7204cf9c7b4f9fb41e77811e5194bd9061aa73d550dd7239221d9cb19

SHA512
03d17462485a3f9a106f7d1c082192cf363edce6dddf52cf88821ce2f46e4be634f3772d878daa50c9bdde0814306c5d24104980045cec177f3fce86a86c0df7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cd0ec68c5dde3a1a278bb1fb23b9ec1

SHA1
5f201dd3f61b3b1f6c1d67c4ae1988d5cbe3e202

SHA256
9b2003236ea7bf156fb5effa88e89e17fdf7dfecf92b067632b677cd910e5f90

SHA512
e82310ba565086eb31b95a0378876c1d4f47f82d7b86844dde3a032bc6f2d223adbd91d48fd3bcf7aed80049253a7998dd19c1d6c0be67626c52d96d5cbb8419

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
095149dfae71c793921bef69939d8c90

SHA1
5057ba2aee142db0c7adc438ca68d8cf9b69ba18

SHA256
5759e9c1eb4829a3addd805d268b5807aa9f498bd257342f94e1e8ed43e54856

SHA512
0a8317e79366f8a1fe1c4dd54783dcfebe49d5b69124a9429e8eb6e1503a414429f43899ebf0a48718cf375d3aa36bc6f137f638d2f2216b6fc6244b18af2c2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58ae15c33d7958c6b09322e757178d88

SHA1
bbe3562f8ef78308b4f94a758876bb6c14fd390a

SHA256
aa5acc381d50a3376dc8de3d275e342ece89c2265095dded1a3301fc25a9c263

SHA512
9c8ca3f2e9dc0882f0131f4aa870e7dc4c9267fde440f8805b979a1a90136a5ecbd7b1a998645b39cd313c08101d11a56e0547ddae371ebbd0f792587971a6cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A07.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A69.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit