8549d3c798845351515cafa5f36c30a50274b7d603032a1e6ab77050f01b54e7

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bf78b5a5941a78a00ac8033d6d5fb73_JaffaCakes118.html
Size

18KB
MD5

4bf78b5a5941a78a00ac8033d6d5fb73
SHA1

c2cf14e0a8fe66d7a4102a5fd192bb534a22d8d2
SHA256

8549d3c798845351515cafa5f36c30a50274b7d603032a1e6ab77050f01b54e7
SHA512

1dced3ff57831d368e79c855c4b7b68af75eda2eadd30b34f6ccf3d2742c30846c7abbbb2b1a2f44ff2cf8b17c25dd7429e2478222676a558915dc36e4a8055d
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIZ4lzUnjBh7982qDB8:SIMd0I5nO9HBsv7mxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422038291"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3305A5F1-13A0-11EF-B587-FED6C5E8D4AB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1240	iexplore.exe
1240	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 2168	1240	iexplore.exe	28
PID 1240 wrote to memory of 2168	1240	iexplore.exe	28
PID 1240 wrote to memory of 2168	1240	iexplore.exe	28
PID 1240 wrote to memory of 2168	1240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4bf78b5a5941a78a00ac8033d6d5fb73_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c0a8a7be4179b7ecf44dd0e7931758c

SHA1
5fb87d219e4ea9f1560888d86ae5943653d6f01b

SHA256
0cc703893200584474992eeb411a1c75a144fd722c8c026b19017ebe0e88d387

SHA512
2de7fd468d1cbe1f3241656df8eb24d475fd4e8418592ec1f295aba666982a68696b91b69f60b8ed8966031c7967ac6687060f04407ffa3f61c03972bd7e26e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82cfb0d33b41d3a1ab2f454209974ca8

SHA1
b2f313380d723badbdf73ff3a9db3c2c7c7cbf6f

SHA256
41d91ee15eb50cdaba0932e420683788f76640a7943d24740ff9b40f798b1a3b

SHA512
a18e5180b5f29887da5dc0d605843347ede244748fed61031199efea5c8500198da4c5a677b42dd6e45ca14610b332d1fa188ba0e851a9d3d84da21755f5c7af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f238073e1499fd13a89ac7b0991ddac8

SHA1
9d3188d900f3c5bc2791f60b260bc95d7448a243

SHA256
3159bdbc2afa52aea437b7b1d91a9396be6eec44d3aa39d0dbf03cc0ab9ef22e

SHA512
4c3ffada88d56b4561c3aa01ac2de21a71ecbc742a33b68dbe03b338686cb84e0f6a68015f0928ba4dd391a6703801376f68b140f320fafa9b21af88d5bc4f8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae5c44f13c6110e91b44c227f3bfd4ec

SHA1
21729d0c7f01ff844a713b022e5a83d4caf1260c

SHA256
0488ed92cc375db06d0539eaed7204222b0164be352a164510fc68f5ca56a308

SHA512
40512f6f583f2e4ec2f302ab70510b551536e10cb8ce5a682ea70704a8edef9f30ccf66683ee32ac2e4b413fcc5e4ccdbbbdd01a57790c5bf0ea5095733d51b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
345380ae42931a0e46522e5240d25bdd

SHA1
8bdabe9b8f3623d2e59174c86c5eff6b95e3cfc1

SHA256
fb14cf5326375acee6cf01044771c9744c27b9cafd5c34294ed08eff3fcfcb4f

SHA512
eb103a8057556c529e51232fad119b0f512aae5c7a65b07f2393281e963788d2f49c8507af8c970892518014db1b826f03a8eae211ee7816b955434ac2ea6755

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9a0e9d4f9fa38de2a586eeb04b76777

SHA1
d05df2c7f0ac2a0a860d5f31457d06c11bceb6d6

SHA256
0a789b2270a81004d3cec3d7031a3bc22e04e4e987ffed68a13cc6a4905db394

SHA512
e1682fd1c618d90b2c669baedb1b26de4fa7f6c7a04c8f19cff6a58086178ee1b08617e7d66f4897ab76cd68266feb69bdebf8ba7df78ae421fd1d563eae210c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cc682d08ca1f611bd92b4ec3f208053

SHA1
4425b145fde61920973941015770470d92e40a16

SHA256
2bd7cbb1d1027da696c2878bece7e44f3855803344783a95d7b74dd2908089ae

SHA512
8ea4973d519e254f88048d2539a83e558932eeb23b27b5739c92cebf5c4e54a3bcba7bbfdf23077c224badc57c4bd59269dfda43d7792368d7094104d1bf3586

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0ac484a67f74b944f3e995e7f9a515c

SHA1
86c2822f48aa0f059f26fce974e19c37e9916f4b

SHA256
719b7425d430b460264092d047a1b22ee8b4af0636645d83080693c2d74c3c8d

SHA512
4d02f9d6353cd704875e331658e2d394da6b2b37a277742287418454935fb6bd92c6ba75860cf16fa9b78cd0250d28b00dd19a5e3dad211c6f0e7129d9fedbb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8648d2ecf8df0c1325608b609d95e3c0

SHA1
407387ec710167fb1bd84bccf15e5cb2fb96c08b

SHA256
ea80645fd0483de77b11c2b17a604933064d4b1dab543153a3e0449b582671da

SHA512
abd60ca1a9c4c356dc937cfe394223820febef74eaaaf678c2181a3d09e39450abb4e2f82e688cb22c32015065ebb59ea0e4fd8ef0353a907e45a54bcf146d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab315F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar31B0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit