e472a55f9758d7752a4b3420ae7bafb6414a2d8117ede586d94e76c12f9d0abd

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4240961f45a1174d285d65fec9380962_JaffaCakes118.html
Size

22KB
MD5

4240961f45a1174d285d65fec9380962
SHA1

a4ad550c260e36074fe91102de08a09816a1e567
SHA256

e472a55f9758d7752a4b3420ae7bafb6414a2d8117ede586d94e76c12f9d0abd
SHA512

d37c5f1c2a3aa892af9e92748ab92edcf541fb74ddc99ea5e3246569db807b587ae5b2277ec2c27d350f639e9f2db34b5823d0da7e3d65833eae039b9f48ef82
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIR49zUnjBhXJ82qDB8:SIMd0I5nvHVsvXixDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{68CAF9D1-1213-11EF-BC57-569FD5A164C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421867874"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3052	2104	iexplore.exe	28
PID 2104 wrote to memory of 3052	2104	iexplore.exe	28
PID 2104 wrote to memory of 3052	2104	iexplore.exe	28
PID 2104 wrote to memory of 3052	2104	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4240961f45a1174d285d65fec9380962_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80d346cba498d2bdc147427618fce6e5

SHA1
b5e8096af5c7cf2718797af51a19c91a9e0e44a8

SHA256
6f4d7c2a18f0b9f28a0403edfbaead29a8b2631d3373272fbb206363f5927e2b

SHA512
5d5cc916d1e86b3fb6263a092122077a4017094b572114cf9aeaa75dc46cdc989271eed0596f34153b76e02d52158ba9ba1db83108599a3bbec2a3001ca64557

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
830704287303f6a059bb8d8d394cf8cf

SHA1
15641d176dcf70c9de923183318cff306dc8d734

SHA256
0e9a9a771c450cef827b80234cd8d3ba40971d249f377b994cdd8565c05c2544

SHA512
62b54d242ff2233fcc2c024f3b285f32c5aa4d486aff5322c98338f89bc254c3a2e833fee5e9ed231e9b94e7ae09c30f4ff9841cc15a89c97475541e46ef1eb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d5cc178d8118c5538fdc202ed079a61

SHA1
22a3e609617154d58814b0321fdf552cdbbf49c8

SHA256
b3bfd0ff918730064cc522275e7d48adfcc4ce696efeea671825eed132d642fb

SHA512
c9a348ea8252af5cafd0ec1908e773dedaa4efb517f16b43eee2dc5168963c74d47d32eeb451a472f621c778244193687664939a8783e345405bf9ff36872326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17c420d454ce8014f3b0f266625c0d33

SHA1
117e1396d3d6a9e1cb130876ce1a230339d1f170

SHA256
9ff73a6927f2130971501cd73b14edfd3b53b6b2c521b52cc5e18f5a24fba977

SHA512
f0e29d0b8067d9b82d622e14cd8a1ed1eb00cfcc9140f883b6a5ad4b8052fec0208e2e97d9aeaaf3bde24c556fc7d12edb468e96b28045e6bc7951e541f3e702

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
092755687e110e38d817833c9179e070

SHA1
9194569020fb830aa070cda0a78242f00d44c7fa

SHA256
15837f103a5dbe085698897839772dfed5a1a9e1783d903fcafb8bbee72affef

SHA512
796fe0324b881660be4043d30e1632d0bc63d06bbf9395b347c12a6c2008e939edbc2f1c7ea3caa99884a1ca0ee179336f3b00d6125b4eac0f18236dcc94e92f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2de5bd4fdd7b1008bfcd00868f2ffdc

SHA1
8cfecddc7a5be6c62aad7a4a509ecb3054c9a975

SHA256
222c72172be14354686b2c62a56b90a8d03883fdf29d85b1a2184bb2c5ad1d3c

SHA512
1b9711fc3a5a616e5d70972cc2f398ac94722ff43f5e034c8efd64ed060077352f2d4b7aff499f8c0d7f8e2ac984c6432333f2df577b61b3149f7553dd4ccf14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
327a458c234629a2a78f8d1bf5d63137

SHA1
de67195b4939415266bcfcd51e0580a41eacb382

SHA256
1508bf2ec1953cfc482fa5ddb4cd6e5049d50932726b453930fadfecb3755de8

SHA512
d6d468b02a271aac5c8e7ca41d89b8dc640536299f083a9c9288b8da4802d509c5e4b16051234eae56c6929bc121a8de4096980cdc75f37bafe8e99b536b768a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d51948acf3cf0e837b855782a13e5ced

SHA1
f7ef1b0ccc3b22cd1715e03e9e25df9a983084f6

SHA256
55443265133023c5a3489da10e4cbe612aef805c111e2635f946d2845870c562

SHA512
845fd5e8f46032c6503592c03b04263119385700670efbadcd6bec09ce47907fadee89f84a057d80f4d131cb3622fe4b2aea4bb2c1b41fc5030d1fb1f06bc0c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab21F4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2371.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit