8c3ff91d79d772aa5e597f850ac79d2fdbee35730bd3deaabd4dd4e415ac7dbc

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

428fb2bbea7db91a7748e30aefdd36a2_JaffaCakes118.html
Size

32KB
MD5

428fb2bbea7db91a7748e30aefdd36a2
SHA1

0f24777062144ba9be33ab3deffd673b67f177d6
SHA256

8c3ff91d79d772aa5e597f850ac79d2fdbee35730bd3deaabd4dd4e415ac7dbc
SHA512

33959585ed1d1d110dc2d97407d94f37b479a82347c8896e3c70e6aa74902d132fd12c97263e890eba44b313cd4cd444df861c45917fc45b396960f3e8fbe91b
SSDEEP

768:TFtb+1buzkb2vbZQhw5/49bDULM9LMoGet01JZ4JKYAX2VsSeP:TFtAizkStQhw5+PULM9LM/p/ZGW5P

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74FBDD51-1222-11EF-9E38-E60682B688C9} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421874334"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2544	2256	iexplore.exe	28
PID 2256 wrote to memory of 2544	2256	iexplore.exe	28
PID 2256 wrote to memory of 2544	2256	iexplore.exe	28
PID 2256 wrote to memory of 2544	2256	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\428fb2bbea7db91a7748e30aefdd36a2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7aaa32a726a310ebc8b573b43d3f6f8e

SHA1
a5bb37c56588d1ffbb5389aa09819439123bc55d

SHA256
b3fdf8a1ef5f765547142ae6e15d9744f25006e12b9d2d9fc9fd688ceca49ab1

SHA512
ab519980763cc9a00914811943b07cb7b9ccf821ca4543f2b4a193c2ed56ea5c9812885a763ff2d992bef4464486abf2d0e55f5852b4979332357d6cc89d5913

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50bde6dcc6508fddd1761427668ca79d

SHA1
ff2b1a5eb6e2184a1e6222366b0184f0804edb57

SHA256
cbd8d6fb8c6d528954e17d763b3ba03ed2b75f6c479aef185ed786f1192b89e8

SHA512
1128aacc1845c61a37b5656503edfe3330cbea5150797459f9de7f99eff4de084fbd1189a0650886dcea6fe31d3b2b472c322c04ddb3fc1786bf6b06d8525afe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8db631ced8ccdf098d4df6580d40f82c

SHA1
aea07d7ef5f63f2d093a624a32c29eb01224c6c6

SHA256
9125623ec5972a9137cfe8e4c9f3fffb1426a741e76432b8be1e852049377e4f

SHA512
b973efe943ad3aad497924209170835347ebb5a2bf70ffc301cb1df7d7727e6f1c313c43f051e44d5b5cab1aadc1f1c71b2a4c281de289ec61445321f7f522a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e835a74a560024bba70b2447a2c979a2

SHA1
9d57d2898a62d7ba65b1b71d565568bb6584e1d7

SHA256
83d60131dd6731cddd2b63409c3625624ebf694741b0755151e0a2d95abaffc6

SHA512
9f89772ef030ce5900bfada11c069180f58e4025730cd74875e7c1f4b35bf9fc540b77753a63ba939147cc6c2f1e51b1e3c3cef249e478fd393263164c971531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65004011d32b231e0dddb32d9dc68193

SHA1
8a2c128d188fbcc0f7710f7ff4c545134ebe44a2

SHA256
0bb242c0c8bb8174fb5a170691cfd1f5cec3a3236c0c2d5027c1e801af76ea5b

SHA512
e3affc15e1aa1c6a9ef5eae979499c294b0fbe73318a2847768ef61888cffca1d6a1390f497620b2c2d970d6f11d04ed26dc53e21164902b931c8c15e517f4a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
864e00f648315da74748119177fd7c08

SHA1
c8b6eb8877b769a00c2c649d4652a00c0be8549a

SHA256
01c3d85bcece142511e7f500b97de71fa71c1b161c3d3b731a3e0cd36fdd713e

SHA512
edbb11723af25e0351ab958fc99f02c9d2702ce84078d4ab7002c4c341cc4d0a243a7286aa643c5b0a7c1d3222f7e7128f27695dd3b4e6a597cc2eb7beca27c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd95cda4b21a0f45cdfb6a747c3c2f13

SHA1
7d76115d5530fc505cab5ff354a96f67e3906903

SHA256
848562bc18777a1ec8cb0c8136cb2ec6cd3a49e78f2df1ac98fa1e068b6a74f7

SHA512
fd3b3ec7dccd38c2637eae63b0ef25efbf4880c19947c9f2c1b31668a376ec8c4cb9b9e186a4757403b5f594aa3e6722f10e609a289fab27df680fda14d87f81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0111f72bfba059a05177810b3762b143

SHA1
018296062b2d89e938d97a1603b81510ee64596d

SHA256
558744777afb1961681b97672a3d29b029f5d793d717d17963aa06b92613b004

SHA512
f3fbb8e1910737338cfe263d456339ebed713f8e91509aff69c631eb035a410194705aa16238488b8fdf1ccf134ed9838a403d68b2c8870611a32ac7681cec5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d50bc730502cebaaa0b6c46dabc95a4

SHA1
c4a1bfb8d1defd319ea1ff319d8bb7882f29ba94

SHA256
fdb6d75b0cc4c8a1b592a96073b44d741ff8471f4bdc0dec7e1db3dee06c8f80

SHA512
4eb8e2f1789fb4cfa328e4e6eae50abb21bbc2e51bf67396257aa1fe6c1a712c396c4c5dea41f0c3edba5af1455cd5b294436c17c3a853a6f94268ddb87225c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2211.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22F0.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2305.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit