685b774f40a2fe5c4d2f2783a22cf131367ae8edcc4151d42a28157b20ec9afe

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

452a34bfc3a5e0ba096104d23e00d02b_JaffaCakes118.html
Size

28KB
MD5

452a34bfc3a5e0ba096104d23e00d02b
SHA1

3023b2344e9e946a11d4c8ce86dd8cc7efd4edae
SHA256

685b774f40a2fe5c4d2f2783a22cf131367ae8edcc4151d42a28157b20ec9afe
SHA512

d841dfa65ebb1e5d8e99ddaa3fa5eb1781a12ccbdf045b01eff5c16d14a2f065193b9cdc5d67b97a4d2ab8167a1cf901bab86835b161c0f627b98b3ac5ad1b54
SSDEEP

768:b265DZ6wyeoeeeeeeeeePeeeFeeeeeJMzLXiljc7eeKeSaeejEjqHsQSOqwqF:b265DZ6wyeoeeeeeeeeePeeeFeeeeeJB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421920976"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0DCFACC1-128F-11EF-AE77-52E4DF8A7807} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1760	iexplore.exe
1760	iexplore.exe
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2400	1760	iexplore.exe	28
PID 1760 wrote to memory of 2400	1760	iexplore.exe	28
PID 1760 wrote to memory of 2400	1760	iexplore.exe	28
PID 1760 wrote to memory of 2400	1760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\452a34bfc3a5e0ba096104d23e00d02b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
902f9020c462cdbbf107eadd93e51041

SHA1
7e89dea3b2352d6a42fc2e328fa325402a382145

SHA256
da36f33c959ffd581f832a98ed285005a1e597714731a594e250ad55716d1fc8

SHA512
5b91209bcb7ed94da2c028c53d2c96b265f51a21f81f9b19eca5f6e9d032f1aca232d0a63375ded9279d9d1db516d4acc46fc8b40b0aa46ec69b5e8632998064

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd629162c323803a19b11eabe6786006

SHA1
be47cbf77b2f41aac48b02950d5a681743f73415

SHA256
9e7927c586d60c624d48a86d128678a89f138be080b923d8fb3765857680b7ab

SHA512
59df9c24cf050e556f24332a19b596cf9f18163cacafe6fb23a495c67e115ef13f7b23cfbe9a6bbcb2eaffb15b0f99e1fa92ac8606bec69cbf0f77aaac0e6ffc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec0d79a6157545f1ce9be6357ecb471a

SHA1
75b9874f182af968d9dd9922029976df1a051aa5

SHA256
34a7ca9e0750cfd3b97ce5e1c171da230dabb7183a130e1f60f81ac813cb39de

SHA512
036f80ed89286522d0bb19c70b26e48224a51a0f456db887b1b44d7dbfa4ad8c029a6ee3e6e2f3b54f3df75b87aa554d6c1640c01c906377ddbe09b729aaf7fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
942e9b7a5d076741e773c942428f3449

SHA1
f34f4cbf2f48198fd961811d5680a7c822579768

SHA256
9663ad294f897a24cff2c3aa9e1d0c40c95097a4f2e59e4ddf334eba08511d1b

SHA512
e59177f4799e27714ae272cc5d86bb98f68e4bf0dea32f9b00ba2a275ab81f25369865d98e0015aca26bc8ee69c690fc97297fc1c1763dc320b6a6c39f3f9042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8122363a63cb145a03b72a3fdc77b1fc

SHA1
05dd5946b74f10c4b6e323d9f267fc1df8e44d5c

SHA256
b69b85b38ab1b183c68837195f6a320c5f9951baef90d41265a983b048e1b35e

SHA512
55b5b6094c2284a698c11017b1d839259c715437b4c09a5a04e121cd1dba66c6072c5cc36edfacd55e4499fece5915387643377e6e5cb055e97cf26f734faf61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99747abc07bacc100985d33af92bae65

SHA1
cbf520a1ff45ee73c8e8007d7266b55574f6aeaf

SHA256
2811b5799796a3b9c0db3aebc1a26258df1d04882da3f075c98c6287a05ca1ac

SHA512
b952f0b6e6e9bd803b1188e740bfadb360e8854fc3cdbd565eda805ec34230379e41e19b948deb99d6c3751d565df1d7932b29190ccc80329c09c4749536793d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c494385ee9abc1978007145a99ec4be

SHA1
f972d49db2da1014ac439e8c91f6870e2aaa3a20

SHA256
c743d7a6ff842f7d51e9154f8bd71e1185eb0f6e213287e56b0807527a347fca

SHA512
08a5ba8e61f4a67cebe010e0d290e21d6071ea97fefe37cc8000146a18aaea23aa78fa5729739cd72b7658c64e5c1deef9ffd617ae2b4076537e53dfab515fd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aab2fc36533f9a91f9c85633c0956290

SHA1
00e7ff2380883c2367bf0cfb546bc4abb3e01830

SHA256
114c0c33de2196e638405f8a140ec722cc36a4ad795ca02711a90d7ac838161f

SHA512
2f67d7eedf8ab6d8a72e0520c42766ed8ab639d168659f90a53acfb79bff2b2a59a74bc600956b08a74e0a4084b3a63353439903b27fee9e68cf8dd63ccd13d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4484147e6e83db37651d17a45912607d

SHA1
9ab42d1dbd4c702178bda9d50b91cd854eaadade

SHA256
5d0e4fb6cc00dca0143a0020ee22ac0d8d7abc69b79ac197a019fa97c56c2891

SHA512
cabe90e5dad3577341fd966ec04503ccc43885c205d8b77efe55ffba1de73c750c6efa2b159dd754d11b8630d47181b4a20ef2255d8f084f68ccec33af3c63f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab198B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19DC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit