4d12c772968b5df9a05291dc7cadabb53fc50b15d0422f961a3b711902c94630

Analysis

max time kernel
149s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c28642582c31e97cde428857cdf452d_JaffaCakes118.html
Size

19KB
MD5

5c28642582c31e97cde428857cdf452d
SHA1

87ebc2821b235bb465e0ada6ecd4c56134ea0762
SHA256

4d12c772968b5df9a05291dc7cadabb53fc50b15d0422f961a3b711902c94630
SHA512

fe4eda472faa9645959a4e1878ad19f0bc24e1ab1d8a18f247260ddfbee1df04af70371e0a689aac618840a45b18bc158d1cd9d751e947f8a42161197d367758
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIT43zUnjBhF/82qDB8:SIMd0I5nvHxsvFExDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9F13141-163B-11EF-A7EB-E60682B688C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422324994"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1208	iexplore.exe
1208	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 2520	1208	iexplore.exe	28
PID 1208 wrote to memory of 2520	1208	iexplore.exe	28
PID 1208 wrote to memory of 2520	1208	iexplore.exe	28
PID 1208 wrote to memory of 2520	1208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c28642582c31e97cde428857cdf452d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab7406ae8a43dc61383996e8bc7d3576

SHA1
57c32bc843da00bd1d9306ed2dbcdfe7ad9bfe33

SHA256
518511531e6720a88f14049b829f9bd6c089fd4c692a1d714ce4121bf0b3eac9

SHA512
678852f45333150616107838781768c63f78d339a24ab28dfd8859f0f1f4f89e272e307d2666c369271e89fce1a9844cdb498d29aa769d839a447e7057d75568

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2f32a5d888d969c135b02a06a7551a7

SHA1
cf1364b69b60522e50115cb92576e5bb90dc43b4

SHA256
513bd9c347b22f5e77c7ecd3dbd2da0ad5dab832745fbfc59b940e94d92c104b

SHA512
e05ed431facf85fd64841c02efb2cba9febe3e0c45543c7dc6d88aed3f008a141eb63610fa9dd1439bf67bf0bc83c0e11153631e9fe2982c7a3113cf733535e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fd90da446e6ad0705330c2ca297f312

SHA1
d8f20549b041407e0a093eabdb7db5d0c8caf754

SHA256
56501af6a04b5093dbd62f0fae86c6a7c03148d6bd6f7c808352c04a81da66fa

SHA512
cf35061c51f5bf87fcf378ef5a17dd32acce1432ec915fdf46247efa3a848c229e57a35580813326cd24f0c1170799d711f76b39364f8cfe2149dd0f750cd662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e7a5b30f9ec8b08b444ca78618303f2

SHA1
d512089ceb8aed9c2d775885a2a96d7b4a94540b

SHA256
a666a74e1682f60d54359420855a62a95a3200c7ed18b1298710dbd491b2e2b7

SHA512
5e495c99803638039fb87a517635e192da48ab6bd1768cb11d4364a95ba70e5b741f03d56a2baf3cbf8b39da94d8a0a98404cd055c5df6e5447387bb9a61d6fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be8f8279dda8a9c275aae7d3e4b0bed2

SHA1
158822b6d8acd125dfb1e3a51dcae359648ff1f2

SHA256
e17ae683a7109ada8266fea2f0fe72124c30844180d11eb6130d6a7dbda56b5f

SHA512
fcd071dbfb68b2bfa62e8887f7bfd283aae63408226083a3cf2bdf33622a470f2dcfab064642bb67de23e724cecf58e83717d20140ddeba05c28c0f7c965c14b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cceff2bc7c2d52de416c09684969c2f0

SHA1
2e25790dfc48ad9c2b716474600cf01682ecaf08

SHA256
fb169503b178eb4e04a06e1f5afb6df65791012eab99c9fdd5249f176a35fc8c

SHA512
5899828afda6d31387e6aed29e1a4b7fed04405d77463a018d305a9b1774cc1f9285e64d32749d1e43e1583489972fef7dcebdbd0cdee2f0fcdaa9ec87a3eb27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f433bf4bf180ab79fd3383e0ca1de69

SHA1
435d1dc69c44dae828885fcce029caf480c70b4c

SHA256
086c4dd64cb069b8a2b6fe46682d804258c709eccf39dc1fead9b5b0dcb61159

SHA512
290d73f7c20f6e9cf0e871a775b218d4e5ced39a30b44f236dfb16a264ae32d529abc9362d0a0de16a79f1f8b94be8c61f84afd88fa283b21c3f4ee20ef23317

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fedb59cc77bbe4c5f0f8cbc30ed03554

SHA1
e45fafb6250fb7b2a5d19f41f70b5af522822ede

SHA256
1c1d2880a12f8a9d36379d75ce8cbb49628d4127c186ed2e7aae75843b3a162a

SHA512
3ad24ddf2b968bc2a464e52e1e57571cec6368de2d7f0487fc65fcb745f999dbb8c626bfd058a4eb452a5d78f638bc1db3c88be8bc7e6a07738ddb1de272884c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8D05.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8DA8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit