a317a7b64ffaff08004e9b8928d9b45e980471cfc5dadb7ec92ef4b7c0d9250f

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4ff595b3f9a10c2019fa1abab8947a96_JaffaCakes118.html
Size

18KB
MD5

4ff595b3f9a10c2019fa1abab8947a96
SHA1

fe0483730dd1317861c886248458180c0350ed7d
SHA256

a317a7b64ffaff08004e9b8928d9b45e980471cfc5dadb7ec92ef4b7c0d9250f
SHA512

98d54973acc16b16584632dbb1f4cf0bff1041088be7fc010bd5f5034622aa0313a0a922e109a4dc65c48b56b44fd5f5200cff740a8afb97f3f35c6afc4589ac
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIv4xzUnjBhbt82qDB8:SIMd0I5nvH9svbWxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4DA91191-1458-11EF-91AA-4EB079F7C2BA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422117364"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2268	3016	iexplore.exe	28
PID 3016 wrote to memory of 2268	3016	iexplore.exe	28
PID 3016 wrote to memory of 2268	3016	iexplore.exe	28
PID 3016 wrote to memory of 2268	3016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4ff595b3f9a10c2019fa1abab8947a96_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0a945229f4566dcafcd0c16385b4041

SHA1
7e905323d80e772c7c7abfc1339fd492d5484bf7

SHA256
8ffaae90c97c7832821ee7995cbd53094ea9fac1a2b289cfa90bc6be9f96391e

SHA512
6c85514014fc56aaf1d927a89a5e09c227f20fd5495c93ea08715117570b4ad0f57457d9bc814cfd22d567b455051207e3bd0266ff29355e4eae0a675f1a152d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd6c0f7c30fc6429767cb3fef72b314c

SHA1
b164637d22159b0a698a90ce24faa8ae2d364a3b

SHA256
ddd22bc88e140fbab7995fd9991c718951974743d8b415ddc533458cf22b351f

SHA512
c6abb3f56c4b5ddea73eedd50fc6aba44bede98bf0b67a90770edb5adb7f74f90669f08a9b1aa98a67763d377a4cccfdaee55f46186dbc3995c1f915b056cb5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d02e6dc556c310cd9ebbb5d6395049fc

SHA1
dc9a867ab6606ba7c3d8aacbee74716c52f29c3b

SHA256
e7e905dbe2922cf270dd321caed469f8f631467fbabe638fc347b68c9f52b86a

SHA512
e2cb40cdb00a411f34840ad2cce1417283bcf36a8212a8b70b829787712168155a8938e3a4ea962631bb1855bc195648f825d7e5790871ab5e664a03e3b7d033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d50079d718ec56f5d69156896a760277

SHA1
9ef43cb0f8081c82f3f20976657602abaf473d5b

SHA256
d14db0edb367bc289b07c4758a2196e5c958eef38f734c864772843c4df19b7d

SHA512
5574057b4564ab6ac1cbc1df64880237912a982ade76ff98abb81f8c1dfb23e190c665741df18bb7a9dde19f828b93625edc01312e9a12902fbe172f10360e0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e32fe1fb18dd3e045fffdeff220c099f

SHA1
ed34271e100b2e2e368ccacccf6d6cbf8860d19b

SHA256
ecea91b8251333be8bf5d3f057c862fe352054cc3fe80735bc3e7245ad07daeb

SHA512
f76cee93203f823ef5fc69cfd3b9592ad2e19254aac9713884bf384931b8043421e64ebba98645fec03b43fbfa707e9bb71ca45719d2a2fb8f9372db68e7b5d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d332c9c8962cbc584a30b6dad04946f9

SHA1
a8c6ba9eca4d2f8c80bd5d3f5407e41a289abdff

SHA256
36a1075542e391b7fb4834c72cf69640c5907f2ff7d3626606ac587d7a05b5ac

SHA512
41ffcdeab9238323f959dac0a53559bb078a5e4bcb8438e763b67d2eb532a64ec6a40840241a305af04d0ffdb455be057b1006901b32182101c945c396db801b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90c5038d15a30b69445c278d8ba24873

SHA1
5d16607b5805040d1ff8f3c8f5bf736204dcab5a

SHA256
b4bc9d12d976b42c29777cd5802cb1634fe62dd1a96e198b3479a88f49221d06

SHA512
e42477bbf09a8b65bdf43e89163b3859e92c4e6d3da181bd2db41007606930d070fd5fa0f22a48057b37f742018f737373526ab0e1987ee97eb677fb4389edba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a092dda143979aedcd3b1b1905d9956

SHA1
b736865851562e489f2c4da7353f3274bfb486d1

SHA256
2db1a7315f4b948827ccebacbae96c9cd01352676d783696ddfb42f9cbb693e7

SHA512
86a74b4f8ef0dc0ce4e2b4c9b29a3520c236f5295207fd7c95d26009e731b3f3dcb91ea4ddc306cccbca4e75bf49b2260f9bf3940fc52a97e1add6be580a3968

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b899d587229ee05f014cd620328f403

SHA1
ee7fbb84d2c522c041b8e2f7a02d8fbab0e73e62

SHA256
aa5dbe2dbe8af0974669c2e399c92f6d14a89478c508ef996713dbcd0dbf6730

SHA512
1f75fcb241c1cb295eb7bde5decc427ceda6256741f81a2a1e47f466d98dec5dc112d326bc5584ac9037ced0293456b3a3e84e82a964456e50d52438d9b480ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b25cad27db2be6a7d14ab7d069feb64

SHA1
cd2746f4f39be27024a6b6168b2cd06b58beab10

SHA256
bd7f848753030005388075adc4a43a49c563f79629dca76faa99b3b3389e7182

SHA512
d78cf8864676f68d25d5de1ce1c101be0150e69bbaff6e1bbac5fc8f1297835fabd049fb4fa3c91ba1a8c8f17a22c096f4d8c29cd1e4500f4503418b22fb0640

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EF8.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F68.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit