59096371e492aa7df7eddc0585c7f0635db301d0084c666e682e274ac16e4134

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 17:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

474a75234cd457d5ff7fe86e9f850879_JaffaCakes118.html
Size

20KB
MD5

474a75234cd457d5ff7fe86e9f850879
SHA1

f3377a79a6e82775fa0cfca693469a9c48814038
SHA256

59096371e492aa7df7eddc0585c7f0635db301d0084c666e682e274ac16e4134
SHA512

e11e0919f8487bbcdc4d3d966d384e3be5d6fdc7967a7bd42ac3929672080cefde07a3d64da4ebebd80ac0a02dc8178217e314120b91ac954cc522a7a588ea70
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI9jfTH94Kd91NPC/M2zUnjBhyaaU82qDB8:SIMd0I5nO9HNsvvaxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421956757"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C60B7F1-12E2-11EF-87C3-6E6327E9C5D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1032	iexplore.exe
1032	iexplore.exe
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1680	1032	iexplore.exe	28
PID 1032 wrote to memory of 1680	1032	iexplore.exe	28
PID 1032 wrote to memory of 1680	1032	iexplore.exe	28
PID 1032 wrote to memory of 1680	1032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\474a75234cd457d5ff7fe86e9f850879_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e53a37f04c82886416e758408b0d12a

SHA1
960e75470f7bb3d8ed3dd7c4c0dc3fdc8863786f

SHA256
80ac7631d4bbc07b20bc29c359ddafd8fa7fbe3a53288aaf23569ece1c1027fe

SHA512
5981e43222b87c78a9be779455adae80dbc4a4108c7265010188dc10d4da86de84cf294c52af5aaf7c8d8a5dbea858a46ab159beb661859d3f370c5d69886ef3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a52702377c18d28b585fb8a679985f26

SHA1
3f7efb7ca7bf3aab2f2c53a4695b2887a18e4ca6

SHA256
9535fc5a73b1815324b6de51f1bfe0c0455a21332a70309b4ecc452e67c5bf4e

SHA512
1246b0c6dfd59db5277f08fb5e6e79d4619e33614046f89288a3a29b4a47b5e9f9c66be2d6ab9655fe0ecc380112d5f2e79442db03e039d2bd6198cc5cabc015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c68b9d20f078f158829bbf8283c6f72

SHA1
436aae7c7a5063b2e130a28b2a496ecb2fa00231

SHA256
cd6f490a6c82079c0c48dcd1343577c57d7e632cb7096d0870896c67f4528c6c

SHA512
7ea06274c1e60ea37c3c3d2114de2247212b71157b56c17359783fec98422801e0842ad1fecbe35af4a0c32a603f13177e0e94920577b8fe46cc56b08dea4fed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
757cec7cdf22fa07b75765d13d495033

SHA1
e94112eef4308c75e73b93bfb9709943deb427fb

SHA256
79bd93d87ea9d44da89085d1b822654c8b63c6a9cd601148b6ca22057c493a0f

SHA512
6c5ff0f8a82dbd2ae04d0369bb95e9ce50854603b93f6a869c5613e7756b608ebb0583dd7ff258e0adbc5a4db14054be064fae14f51cb673949d8977b0d47966

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ddf4674e56f54cb618c8e7f47dd79d0

SHA1
141aaba6743089c0bf46606265c68fe25dde76c7

SHA256
fa4de18887723e0abe05d25515cc0706d2f2a9723d62f8c5fbf4f9bd47efe406

SHA512
6eaba019b423623dcb8b63e0fa6558627f444802933dbf64f0cc14418ed208a2ed084cd89889a1c259b086b054b385cb0a00c0a30e3ebefaf1e0c4b7bc4e0b7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b14762105d7ddbfa2b778aedd6e387f

SHA1
68c212f663928baebb274d9bf69d4e1bd1bdb3d2

SHA256
33053bfa5f596aa271caaa90968d977e8fc2164b0271105a07c7f6033e04b13e

SHA512
7f12e1111641a77862663027fae0eb30323865d078e30a2a7e2a3cde56557f9db5e51accf34bb766044da4e4ce9a13367755635fba078337a7592e222bdf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9c20a405ecd652abae2a747057f608f

SHA1
3d3e2d2a9c2ecb4845eb40a74233dbbb7ca8190b

SHA256
d8c0a79038757fa3f43b0d5809b1554a5b516135db0f4a2a21ed0487e71e3092

SHA512
3356bc8e1625ec2dbcadf700f04d449414d821313d9c32fcd2b96f3d0341e063319560ded5bdd682e349bd745ed040cb4b64c0b43ae48a2ccf59023f902210a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f8b71e145bde1febf3df631656bbbdf

SHA1
772869c96f3d43ce0e9d4b70393f836a592c2bbe

SHA256
dfc865fa9175a61d3b3ef0b462fef205020b377c56533a41905c08ffa197063c

SHA512
640b7f3c41a973507e7c206d46a84d1df55456927f989bad07ba737b8b7f9acc5c9269fcb5fc21252cdd4a0312d0d2d4596d310185f7139c538c8dfa5be00ecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab19AA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A8C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit