44590c775f31873fbc26642d94dc41d1e7f4a75fbe8c7f0473e27a55ab444c76

Analysis

max time kernel
72s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

511637e7a0da183ba6590ffe1f6b7d75_JaffaCakes118.html
Size

153KB
MD5

511637e7a0da183ba6590ffe1f6b7d75
SHA1

f4a139145ecafae3de823618ade40210b11ce51c
SHA256

44590c775f31873fbc26642d94dc41d1e7f4a75fbe8c7f0473e27a55ab444c76
SHA512

8b78a13a51f2aabea9c01a3a96107af1a8635a194e9952cbcb0ec3786ab405503c5b620a89cff62f57473809d61432d57e0185b2704d626819161a13ecdc4b9e
SSDEEP

3072:SvRnwiCFLwI+yfkMY+BES09JXAnyrZalI+YQ:SvRnwis8IbsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC31CAF1-1482-11EF-989B-729E5AF85804} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1708	iexplore.exe
1708	iexplore.exe
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2844	1708	iexplore.exe	28
PID 1708 wrote to memory of 2844	1708	iexplore.exe	28
PID 1708 wrote to memory of 2844	1708	iexplore.exe	28
PID 1708 wrote to memory of 2844	1708	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\511637e7a0da183ba6590ffe1f6b7d75_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63cbfc3ca6a05627fe7d4c355d788dee

SHA1
4ef43d30c9a086edccec6ce878bbce6e5ae44e8a

SHA256
e832bcff3ae16f99aa22e516ec0fd4e265ff971c3dede2a79624eed6582aa1ef

SHA512
25ce4f2398d22e1d8a886e38c13c6a63ce6b0b25da52d1d84a126a6d5f444d7e809033f985a4329274627bac368327521bd3385662f188a7ce34ef72a1ec7700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fb4daffb514f9fc4f912e6899f2eb5c

SHA1
59bf8a6e4a88cedbdb0e205a21b0d9018086faf6

SHA256
1ef72bec28320a96aa2a2fdc5bd34a1d9bd5342ea96d05326e239daed408ffd9

SHA512
a6336f2497e44abc4d3e706c630a7fa9704b7fba558f13ff5f6b0bdf0ed024ca1c1ff8d2e2facbe4e9d9875cbd12641b7d85a226ef1e78d2a404888310d994da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
711635143fd3f4c87fe0ade8e92534f8

SHA1
3e6604506410c79bb5e07547600b3815ac2e5482

SHA256
850f237859489bf0fa6da3c319af1a311ecdf9b934a140b6a9665dbe6c171704

SHA512
8e17f6493b3f57914e49340343d7afeee592331306c7110a2ea1eb5da38383eba5112a7793b3550de611a4db11cb1a378281682ebd7aecece29c1badccffba75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0201dd2efb36f6b51273c5794fd988ff

SHA1
a42c36932e4ca99c921cd639cda61eaaf188506e

SHA256
4cf8ec10d8c4c8cdfa857984a9e2710fcffeea2abdc3b3533d4e02eca18da797

SHA512
98ca2fe1cf61abbd7ebc8ccbaaea97fa3101b60d946c45b7339df3480d2bf8dac2bebbc8d9e0fe98bff05a932379dff38cfa0d070c16e9d2d367447036a7fbb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a716e1dbccd858dae7e1b66cda60ec40

SHA1
4ff04fb9acbc148410ab453e3141290a0a905836

SHA256
76b30cdf797d65a1131a15e5a10b555a3c8e62336cc37fd7cacf7c37d94171d5

SHA512
e093f955a2f6cdf3515d2ff4381e92445764d645db44dcfc2f352ff4467bc9b816c35addbebe3562aed55fc97edf69411681acabf142ab75cd98f8624818ce31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
804f731907dbddfd79f77b98156b6528

SHA1
b631c95af9cb54a4720913ddcf68fbd8f1bdf6ba

SHA256
ce045f97d8f58b5749bd12ac8e2fa132bb0cff02439e9e4a6b7834e617047d97

SHA512
9c38d75bc6b3d7026ab54fee819a6ae987af1ab5b2217f32e763b6e3650b4c62cfaac2353884cda184981a2558d1aabe4fe8e7f20d6327885c06b2f1ce75c751

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89d97fb2d03ed52dc0c9cadb7e008bcd

SHA1
f27b43303f11d6e116567c98c2235f19e69caab8

SHA256
2383ad3f3ddbd79d9070798c69c9a11874c98504ad55f7d92d98c63d0d4a6d49

SHA512
d756951ecd2a847aeb674641384e921d080848b0a488e003e5145f12e8d8966a7ed566517213afe7094257de2145844f57502b443a9c02dbb96373b085471a68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fb096fb10e73e24b21cb04af9e0c33b

SHA1
156b2f5bd3d626f05dfa4fe2d8f03828fd2ac246

SHA256
5e268059da0b5263c27773f1c4624bcd6fa74536fa4ee1ded16d9acb416ca4b0

SHA512
795d44dc5d6dcea45e0b097aba2a73f3ee332fb0724604bae98a476536d5dd37f5e82fd8b0ef384ec2138ca1d3125dfa74fa06f465c865efb79ec3d5ac813349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb79da854d3be80dd464aee29ff2e00b

SHA1
08ae91b90cdd4a6d403aeb2126c50f7efaabce62

SHA256
f915063b0715defbeffe118af109ec24c23e034ed7b3a3a6318d7ff8481675b4

SHA512
f4dcf53dbc8ca68008bc714f224fed73f42d3cbdfcbdd487c6cbee2b6e61cc4f81fb4595a513ffce5d3bfa43ecc18bfe39ec6c9af8b6200b247146b8bedaf133

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d938324f71268c919432f4a943ec24df

SHA1
eed898be81f2e56e01ea507aa9a3116a4f21203e

SHA256
45ba227ae6cd7cdb8174c9e43ce90a4aeda56fcc6b1e1d7b554497a91854ada9

SHA512
047f9eafeb80a34784819d628963bab070aa229d7ddac8c933533dffb934a57260dbc60d080e71f3388f89f4bff1214bfc7baefe8e7c796532b087a273885f07

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB731.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC932.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit