fc86e2496544b9925a7096fc470851a19d168839d2dd76ef382e9b84f6884e76

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

415fa5df4627fa758d4aa05b01d9c24a_JaffaCakes118.html
Size

20KB
MD5

415fa5df4627fa758d4aa05b01d9c24a
SHA1

eceba5cd6498fd87b34239238b142e5dd49bf977
SHA256

fc86e2496544b9925a7096fc470851a19d168839d2dd76ef382e9b84f6884e76
SHA512

9b2498cb3aab302fac910855692fdd6ded8f5ca9da347dcacfcb1e2fcf6314c9ffa1701bd24b48f950f677cf5152cfe987b4fd66d16ceecfe98c2849304ceb04
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIm4MzUnjBhAK82qDB8:SIMd0I5nO9HnsvAJxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421849030"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8AAD1051-11E7-11EF-8FA5-CE57F181EBEB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1676	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1676	iexplore.exe
1676	iexplore.exe
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2536	1676	iexplore.exe	28
PID 1676 wrote to memory of 2536	1676	iexplore.exe	28
PID 1676 wrote to memory of 2536	1676	iexplore.exe	28
PID 1676 wrote to memory of 2536	1676	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\415fa5df4627fa758d4aa05b01d9c24a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8838d6be95300bb39383e4fa5b8e6553

SHA1
1e2ad8ef76dc516c436240c62d7965073977d194

SHA256
46d342543542a4a765f946d904b1595ce425b532886ce29750ad1b0fdf008b09

SHA512
c8a50b603a1cf8c42a21caa186b8975860e238f7a0694ea3601d5370e0419869002484d1afba1b3c8110c8c0f4eeaefdf1269c0ccf6cade4ae62a3e87df29faa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e11ec6d71d7ff7f46edb62030ec2e81c

SHA1
543c7c888b95bb57e8031db4ec882b26215ea815

SHA256
e6d587b9fdc2a0b7a61e13fceb59cc1b69957d9725420bdbef1913e504166271

SHA512
3bd353ff7fae7c921c5b4fdc562281d0d75b2536effdbbfcb73cab6ea060ddaba5df57c9ff9c67c617d31374e20bd528bbd15b0ccf2519f6154338bf0dabb08e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ab75106379012ddc55542d4b9f002b8

SHA1
063a95bbbf926582b99cdabe633835bc620f9f52

SHA256
1318bc723d34af24c651a6910f43bec62a6991b338a4c34a2af0d1ca71b5c625

SHA512
4b81dd10f9cb9cd20af9d805e3cf28cd4805caa73a1f6e80ac226c374bdbdc9bfefc95b0364e8d96b10ce4546ae8649fde54afc28498ae3d8a11d04c89eb07d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbfda226658c3fa3164eca81e0f0ad82

SHA1
6c8ca29fb851b4940d005232bc92e10974fda8c1

SHA256
404c8b28a3f129bf0e2e547c43b768a12ee10940b430f722e312caf0ac83e148

SHA512
0329713f5d402fe8c2bd690f776ad6c5875f3bd1826ff8007c446830956e4795c37d7315f93261e504480104eab56c68186d5808baa64a77d2f65ad1b1c16382

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34950d0b03ff7bdfdf9ddad813e0d813

SHA1
4948252847558b915a6408dddca410bc2b3594d9

SHA256
9af3914cf0f4bd50a7b4a6d24f7f3e469db54e403fc71737b235e0597aa0b3aa

SHA512
b7e24c4896289f7f35c222f8eff45200e11a78cce0c084d2a30a50421806265baa2da4f28fb3965111a2f4e8aa8789d6906deb4a1a73ddbaf218c824fc507dc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
580f669cc2933d1500033ee41d13fd57

SHA1
6ae518c169b18505182ecf08fd314a12f607bcd5

SHA256
829ea1c0580f95bd7e4a35e65f926e89c409c88eb95da0cede71c9d5fcc16f1e

SHA512
6cd0ad76c2074e30daacd0b1737a2c05604b37bd66410c0dbaf706f990487f40917067e4ec9b439b4dc5c218cbcf15430b2d8470e00ddcda632452e65582f0f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f20ea7895900fea9c4584a27318e1191

SHA1
f99b53d53e6cc47ea757742ea31446211bfb6b74

SHA256
c185e838b378f35da3bd356411b216b80cfedb1b80194997062ba7171579b5a8

SHA512
f08847ac1c2813ac41e30f9d26894c7cd585edfdf22a0472d21a6f7937bd671a45dba057e39262161318d97001cbeb5616db0b45b909fe9ab059f837f93b5932

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3afe689c5740c2b2ed2d22c8e37ba53

SHA1
e458c1dd92802bd0dc08f495e8296f04eaa5e692

SHA256
b63417e61040077b57634f63aba58f3d2232f01c672fca55891040a838183a8c

SHA512
3ef1fa9c414980c97c5bc0cbb2be315c5a9db5664f782bee5cf1ef9dd18592d41ea9baf83851e8ffbfa0fa40759f34dc2d58a4c7a6af98f780ddc6df9f87c519

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B30.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BA1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit