8c1a28ac54a6439fed9161869bec9d63c951f1d072e6aa30361d6342163e1c4a

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41be5d64671cc6ddca7be8b73a86756e_JaffaCakes118.html
Size

19KB
MD5

41be5d64671cc6ddca7be8b73a86756e
SHA1

2070b74f1475e32696439da202b4537e925f7d79
SHA256

8c1a28ac54a6439fed9161869bec9d63c951f1d072e6aa30361d6342163e1c4a
SHA512

276386ca1ce6cfbe77a6f4aa5e17bd37eae7e0060ef6af4bc7432743abf3e0ccd5edea1697c3705d6626480483a6ba926b9c83773f0e3af869fbb0912aadb722
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIw4IzUnjBh4i82qDB8:SIMd0I5nO9HNsv4xxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421856911"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E38B1AC1-11F9-11EF-931A-4205ACB4EED4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
328	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
328	iexplore.exe
328	iexplore.exe
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 1908	328	iexplore.exe	28
PID 328 wrote to memory of 1908	328	iexplore.exe	28
PID 328 wrote to memory of 1908	328	iexplore.exe	28
PID 328 wrote to memory of 1908	328	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41be5d64671cc6ddca7be8b73a86756e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:328 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fe5ca3e319afbc1e660936001dffb44

SHA1
db756cd07b11cc112e5d90a692660450dc8970f6

SHA256
f0f7a5bf9596da246107474df36fc855450c02fab92ea0e52c800929db045bee

SHA512
24865babdc44420ff6fa85c52e5f8022ab4a7efd643b3e4b3d105439dfabfc3384f8fdf43c48de4c76259c11c04e4cf0da3f84b34cd823a4d8ecc0c4c2e0bc36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fc5866c982488210e1166b95bf224f0

SHA1
aed64011b92ddc896a7d409a5195f75eb96f71b4

SHA256
20dd40f6a0dbadbf88b6851f41d617768f7090f27edc6c0ef0e27a569c5f102b

SHA512
8d3db67073a2706c08f3d8eaeeaab61d8997e2da7242fdc0fd17d2524daca303a3e150af030f6c132f8533b7154e4debe208d3541e75be64bf0f74921335b7db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2d8614301ec861b53dcae8c8fd00f6f

SHA1
e71b7384302062c211db66cfb00f25fdae5d59bf

SHA256
27b2d584a4913db30232f09deb43b804024c8dc4a457f5abb1f885d1f3790655

SHA512
b04277a72e975daec744baf73295a4d452bd4a02dd8aade38404fc76274712aef414b5e5aa6696d13231c31bfe9538540235191c31f6f1e8a5d9d584e18873f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b4bff2c3c88aad020247f86dbfe6fcf

SHA1
849f3694e9e5fe203c3e9a86a4347d99ad54b01e

SHA256
ec9e6cdacf47213dfd8081c0e0a7c48fc3bddaa6f7615b050bfd51dda200e25a

SHA512
f4f837872923eb08a2bebb6db8afdba77827a926b8805fd7694d51db853f70312ff3e450ee37dc8de0f1a87089327f73efa3ddbae3978ace90185ea5841118a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5df650ccce07bc2d115db27b8ce41d03

SHA1
f81011ad74cef9f36137423ea255b81594cbe964

SHA256
0e37db41e05b306eb526da132c3d11c940aef8ca540e218a43f3552b80cd73da

SHA512
5de01c03f1332486ca4c5bbdad309e60dcb635275b5da052d932b72a57c67b395e926994d69a53373983f81e8a8bf1480c763106635a39122887feeaa13dff01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
119e67f3143986a4137ff64c0cfa546a

SHA1
c1685f765ef7f8cf361961ee6d4f50e5685326d3

SHA256
a4aa0b513e16133dd001a515f560c3c3de2c5f202f752b6243f71adea288699a

SHA512
bbb5ed0d356c050293a0cfde1a896f74dd1a6614110f9f2c0bc74b0de05760875aff0fd07d236a84fb0a8bb71dd879bb2cd80fd3e7e61c0cfddb4748077a79e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f71956a8a72ef15549ca6deb5134830

SHA1
10704c2fb8879fc23b5e2d9c057dfc9088612a8d

SHA256
ee509e50070ac41f6975b29881534b675dfd8878e57736f3c59362caf67b199c

SHA512
cd978fe8efed1ee3fec7943dfd969ec687cbe5e106a80b97a84320e03b7097defed8a597ab75da6a40094ba25278f330cb199a4a1b3f9cbfd3aa31c0510aaf7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b97a58bc946dbca21218957614e37af

SHA1
4c9322438b6b681162b5c2d06813db0aea38c9d2

SHA256
abe55194ee856c10c28674f5ecdaddfcac71fb0c01d4073f9c631f09e74c3e1a

SHA512
42757373a2c25b80bfccd3b98f7f971ca818c606bdba25ef5cc70d7b57508f7879e87ba68c7be22ae5df26696b55a536700b6833674b2d4dafbbba6fd6edfd21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
147b06b956e7177acf5f48c01d03a2c3

SHA1
07933720ddb6e629e4618f67989716e5b832c802

SHA256
b00fcb0872913fa47a00b34fb59f23b9d22b5c6623809ef50759236d0fe5b9d8

SHA512
80d593060c3c1383b0414b797265af357412908055e48f820db42525e24f7374b13b8371310cb52d78c66bf38e4f9315bb95f0c79e28f0c63862d846ffd65713

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C97.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1CF9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit