8630658f797f522d03663011aa583353366bc87bf67480dfe2b9cf98b961eec5

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b897ea285f028f57e96afcb3453baeb_JaffaCakes118.html
Size

242KB
MD5

4b897ea285f028f57e96afcb3453baeb
SHA1

c90b6de300eaec4b8a6fb7c7f7e18e2f0313f385
SHA256

8630658f797f522d03663011aa583353366bc87bf67480dfe2b9cf98b961eec5
SHA512

68d5f3cf011b731a9a1b720eb49af977333dc6cca8abbb39cbcf26858b70b64b0b99c91bae04fd99db283fc8d0c766736378f8ce4bfe59b28d4f0cd905f4de2f
SSDEEP

3072:rBy6klr2vrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJ/:zk8jz9VxLY7iAVLTBQJl/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422031442"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{40AD5371-1390-11EF-84D8-C2F93164A635} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1576	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1576	iexplore.exe
1576	iexplore.exe
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2580	1576	iexplore.exe	28
PID 1576 wrote to memory of 2580	1576	iexplore.exe	28
PID 1576 wrote to memory of 2580	1576	iexplore.exe	28
PID 1576 wrote to memory of 2580	1576	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b897ea285f028f57e96afcb3453baeb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1576 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ade99cd2795526a283d5dd147ee36b52

SHA1
693675b7c8ca7dae849137bb7d8264ce55d2f567

SHA256
ac3e16027f3faaff3651b38c299ccfb36fcde138720f3af1ec02416ef6a7e202

SHA512
5120049a7c925ef587ad25d8e79f621308ca1626402a27219f2c5eae3db57637dab1a88b4f04ab296e0fb77923b418a254d146acac821251fe2c1c8237dbd670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3078dcabdcaf9dfb9c21e2c8ca7e4704

SHA1
4e0f9de1840ece28577b66f77bcd95808cfabd9b

SHA256
2f676ec9834cc623b06107144f1aa10915fecf2f10c34714855c534e5ca731f1

SHA512
967cecd4d254bf19e60b3b5eab27abe2d93aaaf15abce2b28368a0eacc66eb747b113849e20d4c0948fedeab0345cb238662c149d12a3b88b75f23943b758485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be8be02425fb91c00c9db82660b680d0

SHA1
0cf3f575b9c7adcd2166f693ff7a0a1ccd3acb14

SHA256
8719a2ee8cfc83a11d6e32eb0da7887717b260e44d7e6137c93b4936097dae6c

SHA512
a9e045af84752eae5ecd9b4180b81f3399c32e2b06d6bde1c8a4fb1c5504b86b78c5f7b08dc0a98a98abfc0410c2995404d251c77ee2a0a23d87cace78443ed1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e3d95662e3a04d214d3b2d8110de7df

SHA1
551a77ab8c2b37d1cca61ef4bb2c6a0f1f2dd477

SHA256
f94c50b3b8fe4da743db13adc0536b2daa4abf2df1a599e9e98c2bbe7cda2aa3

SHA512
7a8d5ba6a1cae079ed7ed0cc8342f245af87b5f8a025b33d78334116cd4129115fa68014d6d22fa84fd196f6e93be2ba235fc02e8e40da0565f827b3d1404dce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d108e78eadfc104e40896628fe1c87f

SHA1
f03eff1adc29fb0d2cd67fd6e81a0f02fd22e939

SHA256
a1c73d2946e69388d9ba7fadd6fc18dfd2f444acc616f82fb8bedaa6d18236b5

SHA512
741a44ef5865b2360dd0a2a3e4982ed91093bf3420352a3ea665cc0d6c9d153384a75caebecd72190ff1c8620a140712e867e927c157bb061be2fb887ec5eb49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d29ae4ef5263940d77077c811f205243

SHA1
42967aa0e7dc08629de976941903dd6fb7447c57

SHA256
e810ca3f835b257eac14c7e6efac322369b8677b259c89e30b374ebad6d0dd46

SHA512
1bc17a9a9c95b10647c9cdaa646259df1332c419f14e5a3046f0408f0abd591c91026b62ffc461e804c3b6038fd7d9fd76014e9df48ab4e319ee5c87723669b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb775d5f03d213f47cfd8ab528c0538e

SHA1
079936f970304c84d4719c5bd26464851c2b13ab

SHA256
adc29e88f50373ba4410bb99066053d26bb00739c9f399fb495a4bc601a77254

SHA512
eebf24aa0f3f1f0473cdb9e4d59ba901478d0807654e9c354c99157731fbc745f33ec16b898d31f5b8ee658c8f2733f294deede2f23ce6f8ed1980c7cef045b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d57d7fd2ac64f69fd490ff267554e36d

SHA1
8ad3f18a3c7fe6d1424415455f24050264d7c964

SHA256
229e9384bd830b3c47aae3b0e64b07bfddf5e0e134df53486bd4a8c45ae0daee

SHA512
0f2608e88e5debcb08706b0173a5c26785dbe1644e04e957b49fc96dfb53812e5547467ff4fcadcc55db3dd9d869bc43285d271075bd589562190e8adbd2596a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7afcb7aee96b6903670f94605d48a197

SHA1
6d283702e0d578b3d4242be6ccc679c84f115e2f

SHA256
8d9c261495370f972749bbe487abe047d4ac0b0aa8f1b96c7b3f8759f8274c80

SHA512
8cb548ec27128e55a1d3713da28ce03a5f36a07ddaae87aade11953302e427e307317b53d8ffe3efb976b7162726469ad73092be439f4e7e043fc842734ca0e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A64.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A76.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit