6b1437c1abd0cc2ace501d6002f526cf6e5e9afecceccf040e76d804c583f195

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

464fc9a563c2b5bb4c489bd9754d922c_JaffaCakes118.html
Size

216KB
MD5

464fc9a563c2b5bb4c489bd9754d922c
SHA1

8c1bcf486b98810695853dfac434d03a92bb2436
SHA256

6b1437c1abd0cc2ace501d6002f526cf6e5e9afecceccf040e76d804c583f195
SHA512

8ce99fb42ca3592662897dfda3d5c5b60153509cbbc9de15ff29f364a51f547044e5ef9e59a2cc6423ffc3e5d9ca9c4f2d5338f53991a404a107af25a9fe162d
SSDEEP

3072:rIgCkqzmNiI+GAdbGtpoKakliiTztcJqyg3yMUyGn3Jqyg3yMUyGniJqyg3yMUy+:NCkqzvVh+iiVeI0l1G

Score

6^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3364	2152	WerFault.exe	28

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421940337"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21E14611-12BC-11EF-B27D-6A387CD8C53E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2848	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2848	iexplore.exe
2848	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2152	2848	iexplore.exe	28
PID 2848 wrote to memory of 2152	2848	iexplore.exe	28
PID 2848 wrote to memory of 2152	2848	iexplore.exe	28
PID 2848 wrote to memory of 2152	2848	iexplore.exe	28
PID 2152 wrote to memory of 3364	2152	IEXPLORE.EXE	30
PID 2152 wrote to memory of 3364	2152	IEXPLORE.EXE	30
PID 2152 wrote to memory of 3364	2152	IEXPLORE.EXE	30
PID 2152 wrote to memory of 3364	2152	IEXPLORE.EXE	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\464fc9a563c2b5bb4c489bd9754d922c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 6080
    3⤵
    - Program crash
    PID:3364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9900af35b66a17f79fcbed6d49c81cd2

SHA1
39ebb3f6ee8d567e696a468a4149238b349b75e2

SHA256
94a61d38c3ef31a0ba65e15ca00be5eb560fb8507147ef5c84a03856eb15ea23

SHA512
b87f95285628571a9d367d01a96234c6e8c19b0f2c2aaf545407459e274379f36ec3fe672db90023ada2a1364c17bf61e7ee6ccc850c5a95e69ddd35d6cf4787

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b9b5fe161725a20ce8e89b783977320

SHA1
f0a0c8bca673dec509e45a3a24bcf131a0674753

SHA256
f8553d67a984f374818aa9d7d2e8b5783df6715cb0069a0faf90ee63e35ead8d

SHA512
885505407ac35e6b12291032016d12b1854fb5053806b43ee74e39466ecf3e85da25018110db4482330f82c58a3b3e4064a68758325930aabaf7ebb15d8dd2e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7abc8506d1faad4e7b08bcadad0c5c20

SHA1
1c320e837f7791bb6b78711b69e07fa745c25846

SHA256
0b29af13a63f6112b487a799c1a29928277e709a695ff2fd7cc7d14b5badc4ba

SHA512
3d75a55f664eb05c5bc8fe72dead8f1d15d764b99207db2484012e52d09ace4f6eff17ec8c1f6f128eb6af0eb437815433640389d835f763685e35fda301d995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08dc73a9c5a1021b927558b0fce3c08a

SHA1
3b4be9a8649e4de56dde59705f1d1b8e06f7f275

SHA256
4d3d6268e72b7ac67cb0cf3a9f1c01fe3cb30616e6758761fe3eff21a39aa417

SHA512
5515b1608b914764425a9fbc9a8aef29d659dd993376929bda4d2fe5583704fb4af8c200f8fb6067a2c192b5cb9ad1634e57f9f1443a8eb267494c3a5c2f856b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b93bbf3dad2701c7ca164b0e10c15351

SHA1
9ff6fce56695c2ac714c596d0de1729e94cfbb8c

SHA256
9aa55c4dfef0a46e7d13d76ede63cd298fa7cbe4393fdd2c48a14c988094e039

SHA512
f52107f83ffd4630a2f31fa55839f658f13c3ed3a7b3be44b6fedf8110d3f0694f0a97adf3c4840f20512665cd7bd740b289b6bf8dc600da8d03cf2515970afe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3f75192328c52141a15e0350fd48fdc

SHA1
c897949fd8b62118d15ebc28b24bf2779b841032

SHA256
f14210a260f67db0a446a1fa290f0403be444a83e295d7fc518da291d043a3ab

SHA512
ad5210a0a0da98a3a779f4282df127c6b8e645dce5eca3e12acb519f2d7e2713cb2c8f6dc3c248439aff949c91e3eaf66d5c1d8067a719b880a3758265d5e814

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
094f9713cb6427fc8793ae188ce9872e

SHA1
01db588282de0649f1985d8372033816cb4e7284

SHA256
b62537b164d6c70bf44de39c68e9e1a93a6c1867cf69a747a225c9cdf01ff466

SHA512
2224b6e49be3e4ec996009481f74f4b6d6d2681dbc7ab0059a902714ea58298158f82e18f03a6fde0afd9fc8a03ec03321c92c751a5ad72807e77087ec9327f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a6e8b899848a27c691d4d86665b04c1

SHA1
e4d8c52eb877e756249f6bcfc5aed232b1912628

SHA256
06c46e23cd6b6b9caeb911827539c8f53146ed26f641e48f1ab4f47ec20d3d36

SHA512
c42be57c7d33296547f4930d8b8cbcb11611a8d14e94bbd3227785a5c8c3d00bba1a9f69f0d328f7407b587c15cee81da4462f595e7150864f31568edf856cf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab15A4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar15F6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit