3c07f874191d7876e5aa77192562eb9d04991134e8ffc3dde21a55a92601870e

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fd64b8f965f0c5aae982f1e0d76c3cc_JaffaCakes118.html
Size

18KB
MD5

4fd64b8f965f0c5aae982f1e0d76c3cc
SHA1

16e155a75f09303a706d34a2b660dd04cb2a962b
SHA256

3c07f874191d7876e5aa77192562eb9d04991134e8ffc3dde21a55a92601870e
SHA512

cca0a13c79406e3e04d231d40253b8af41a4cdaded50a2952bf890dcfa42ce5e47eb8a08adbf3afe11217b5c604242508d4060ef8d836f87a7b0202a1041d5e7
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIo4SzUnjBhW482qDB8:SIMd0I5nvHPsvWLxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C008831-144B-11EF-99EB-F2F7F00EEB0D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422111912"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3056	iexplore.exe
3056	iexplore.exe
2460	IEXPLORE.EXE
2460	IEXPLORE.EXE
2460	IEXPLORE.EXE
2460	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2460	3056	iexplore.exe	28
PID 3056 wrote to memory of 2460	3056	iexplore.exe	28
PID 3056 wrote to memory of 2460	3056	iexplore.exe	28
PID 3056 wrote to memory of 2460	3056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4fd64b8f965f0c5aae982f1e0d76c3cc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3924f057eb38fce6aec0a1fb0f2bf0df

SHA1
640639b5b3024f0c9679f8f5e51ff0d871fb154f

SHA256
968ac4512acd50920e7f4aee2efda93d87844374e7dd66bbe6f62f8134129781

SHA512
4bc8e89c397771e25991711d60885b9026cfd72cabe56455425aa6ea0925c603b560eaf7b7369cdf9a5dc1fc46a5c8b8ec8cd05969043f2afc9874745f982732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ccda126630fc5070094c02925bf3bac

SHA1
b16cd90a8bd5bc268df6890c9fdbf29463563d38

SHA256
21757af0c388a0d3188364ec1a848e4fde796abb9d60b5ee485cd52b845f3e3b

SHA512
29552c7a6d4e328e5add313aafafe6d5e193c1cded52d131c85b99f512b5c3f4fca66256eb89c3edb70e695ba8e5995946e324df0532037b5cc7c014b3220253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb8d3d3df7a058f8b3a30e3eb05c1d0a

SHA1
7361362af13c15e59f2cf5ec59e4543a282e32f2

SHA256
28e73c4d8579d03fb17d81392a01576f166abc9c36579d9e74bc10daae242588

SHA512
e340f4c621a941cd6ba9bb37b470527c4f78d0c0ac360e5dcac11a2a0a8702d280955c15f5a83e22b23d446c5b476e5b11b1dac78cbc9acc237fb31feba5c142

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11b98ba45c040c57d1e2b61bd65bbb98

SHA1
c253cd6a621c353855bebc1b279001380c991e60

SHA256
b11df80b5fe086e8345ea3cab20237c0583eb8d68d00dd70b9cdd2b11508e18e

SHA512
defff59080bf97471e6774b9f4af7cd7e806df7e7968bc377184e14a9714b819ad5fe497b895052913bcf2541ea840a865cb5dfa50adb1d46eeacf6da173a7a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae12c8c0dbb89b343fde41b5d44dbd1d

SHA1
b1bd448a4966975b3675d79d6d79634df915530e

SHA256
7658c5af2ecbca0e660ae24aed4407b9e2d654b897c90265b4205868092734dd

SHA512
bfd179582909bc53d639ba0f5035b18ae904ffa95a27736d6aabab0044a2b98bdd4b99f42387fcc0166fbbc8110766ba54b8574e643ef757b34885f9e014e3cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b29287af7bef3f01021da03f892ab2e

SHA1
46c9aaa20e11cf1f92e9d9c974970f92ca5dc1f4

SHA256
87038399901f7ebc953c835eddc3091e7776ce1304728727ba17f0441a2c9ec0

SHA512
0ce0cb5d23b965e8a04d88c9c6bd113425c75b33d64e54fafd18baeccfa1be9adba035ec3adef15d16c779c48bcc71a4f5b5cb712bbf34fd00b56f18cb0cc464

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6328e731603ae7f07707e68206deac2e

SHA1
1e43a05fa9a95bf027b8cff5caec4d6979a3ab98

SHA256
2e416d152ba42a8d009bdfeb813f710c754434bf30b6a7edb9e252674ac161d5

SHA512
093a4c30aa75947d363564da16c91bd95cc65d6cd30947e0db65f45fb962d9607abb40e14742a8d8cee4eaf4434af09bbf02962cbaae66cde378c9121f7302e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab259C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25BE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit