ce83fb6360e6573ac114b9aed101391652a6f3accfa582eb99fad00a4f687ad0

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

513380299c67f82ed56f4774892be79d_JaffaCakes118.html
Size

17KB
MD5

513380299c67f82ed56f4774892be79d
SHA1

d22139dd1d86b54150ea0a1470496bb2bfaf0516
SHA256

ce83fb6360e6573ac114b9aed101391652a6f3accfa582eb99fad00a4f687ad0
SHA512

9d069cd97f1927ce42a03dc3f1b45a37dae5a8256f8d56abfa1e3b54f2eb6dee8d250aa0d0b57e4b2b0d6fd89b0faab1a4e4976a338abf81fadc305245a94419
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI04kzUnjBhIy82qDB8:SIMd0I5nvHRsvIBxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2FCD531-1486-11EF-8D12-66A5A0AB388F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422137291"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	iexplore.exe
2896	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2372	2896	iexplore.exe	28
PID 2896 wrote to memory of 2372	2896	iexplore.exe	28
PID 2896 wrote to memory of 2372	2896	iexplore.exe	28
PID 2896 wrote to memory of 2372	2896	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\513380299c67f82ed56f4774892be79d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09e7a031cf361984a4af9d4701746c1d

SHA1
473f6d884e6dfbbdba9cb73d7ec60c2884a63d02

SHA256
6bda2c513fd0d4fd08171a5c7a1a8edfd26219e90a6ab3f905efe2e32ce4e47b

SHA512
ce8635811108219f7aeda7a526306d7c7cb9cf9e85d403488a72b35dd9d0de8a04e7bf364af3dafdf7f5baa43953f257e48ac4a5e678fc77a47e6a6c10b39400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9e48e3185ca4fa0a9bad3eb29b9cc67

SHA1
56a2811aa300814fd102202ac7cd67ccbc98cdc1

SHA256
db6e21db3efddadcb4b33f5f126a31b2fe7d04821727e5ab6cba4c0e95a22796

SHA512
d6aacee6cf7d71b919acbf450aae8fbf8efc30fdae7179b478009ee56c8fb9b0263c85bb0868725726a2882b9f515997c0fe3f011c245e33372d45e501992249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7de15156d2ea6a2a78bf96ce9d7efb0

SHA1
a4bd6033195ff5ef41cf2c35bc0f247c6fed51d3

SHA256
20c3578448762bd76f44342a118f6c5248652cc193075559053793ab390bd81b

SHA512
520b050ff36b257639a07afa8e921601746ea372b6b4f6d7fd3a0bf3565120efeb4b7fefdf5e60e0d80bf89d6d9b90f407595325faa285253ea0b58ca40ab700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb8764aabb75155eae812c4ea8fb7201

SHA1
035698a7870bd2f4260b728be53df2b0b4805f41

SHA256
aa119f8cad5e917add7642fed49f8186d890e55ee07d3d9918176116096a338e

SHA512
61b4817b76e3de31b43b2a00270ac1d13ee3c6b1353ae1be8bfd7819329d06d52cbe6b1c3c5c740576d660eac1b624a02bdd17e72dafc3a37ea80736501987ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5257b15bf78dd0a1fd0b9469220aaa3c

SHA1
c3f728c4dba5a3f4c2b09930918198e98424c4dd

SHA256
42fb45e1c3b7420c5cf5d2d12b1a28382ea3224598d4638262e5d46254af5e34

SHA512
ade7dbd3f2e22b56c1c65300362364cd21de84df879a57521e3bdb8df24564bbd8350f83fc84840b9cda6b82c2d307f2a57872cecc4a0e2c04cade8332db6ee6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7d1d3a5ad5d4792c3e6fe32e43cadf3

SHA1
964dfe9c2cbd1de0354a1f5525fa7e32a1d4f12c

SHA256
219877b31fcbfa49670180be62dcae0d6d9a3a46d703f04f850c7a5caa2acfb5

SHA512
5417e29e59ae4992aff749947981a9db2b4129d97fca1bca920323369f1abd37367f8ae0b6cd66bc11ca686bf84086d5515ce546d0e5395a5207cbddac9a8f5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f6a29ddf534c9f456ebb767eee3be84

SHA1
5fe43bf2ae3df041c8b119d0adbdb1799cb1a095

SHA256
ac581ad93864d246964d7700fcf3f8f7f2e0003e505e410b569d38a136ee635a

SHA512
b466ed173253cff20cbfd6f8b3a4790738fefd4e9a5fce0060f2a82ccbb46a3ecd73590089e91e32468b35954916c32a10d6829fa860a43682548b112af39851

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1ED8.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F39.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit