3ed6470a618afa8e1c2a9e1950d021efa2fce59efc44a65b32f65616b3b1bc07

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b4f52c1620a04cdf3c582d3ded028ee_JaffaCakes118.html
Size

45KB
MD5

5b4f52c1620a04cdf3c582d3ded028ee
SHA1

d9c0ede977c482ae962ecba57a41c2322a9fb673
SHA256

3ed6470a618afa8e1c2a9e1950d021efa2fce59efc44a65b32f65616b3b1bc07
SHA512

09ce739d36071e7068d80822c6f61a32606ccf0656cc1bb6186965944267a9e1112bc5fcdc014fbd2299b23173fcb3c583da44e2d2193605ae46183b02c8e7fa
SSDEEP

768:gelpmrIlbIXlgHMJyajz/fvncHbrRTbpU7R+kFv/OB0:tbIVgsJyaz/fvnc7dTo2B0

Score

6^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	3024	WerFault.exe	28

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47E73F31-161E-11EF-8C93-DEECE6B0C1A4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422312346"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 3024	2976	iexplore.exe	28
PID 2976 wrote to memory of 3024	2976	iexplore.exe	28
PID 2976 wrote to memory of 3024	2976	iexplore.exe	28
PID 2976 wrote to memory of 3024	2976	iexplore.exe	28
PID 3024 wrote to memory of 2800	3024	IEXPLORE.EXE	30
PID 3024 wrote to memory of 2800	3024	IEXPLORE.EXE	30
PID 3024 wrote to memory of 2800	3024	IEXPLORE.EXE	30
PID 3024 wrote to memory of 2800	3024	IEXPLORE.EXE	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5b4f52c1620a04cdf3c582d3ded028ee_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 4216
    3⤵
    - Program crash
    PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6725c1251db81fad5571c64fa549642

SHA1
2078f921df6a168e5aec7b5fcfcdbce0a1123fc5

SHA256
f43304ced63354e277e90d9dc4b4610079769d920f36de1dcd9a549ee74fcb25

SHA512
8caafba1a1153cd867214d5414c9e6f11ac7c32370952865fd27002d3c84e24156b75539ad6b81e1ff4f8618fcacc62c26a190ab4c67d5a72541241e73fda09a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef97e139c8cc39d115a0cfd2e2b70da1

SHA1
521fca21b6722da20a263327cb2fddb454f7ecf9

SHA256
4d7de5415ae589d41a8f49a20768fb0a0afae892f4c83dd7025963f26aba1b53

SHA512
76722f7c65d28576b0e173e4dd913b7d50bb16a9bc1755dfafbce9d1187f6930468566d83b9579c570f40e23959e3ce20a96fc68506bfd1fff052a6007399444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4a93f43eb899d87c022d85203dbb550

SHA1
be282e75bed1e97b2b0d758e3a2c90fc00d23ca7

SHA256
bef61dc2a9dc15e2a52ac19cf2e6e40fd453d77b16f497811e82456e42bef7dd

SHA512
dbee9369835801725d7e50a02db3e1b70de6b35458e8e00446ede40ce2d748fdb338e82e3ffc86dd02c111fd5e28d84da53d1f9313a6d9636998006f81427cfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afcbf20501230ec3072b09fc52cd2604

SHA1
36dae443d164df6837805591a0b6decfe76a9382

SHA256
7bce8e727c93546b0ed0b064e6a3df210f077abf623ca9181c3f5a576593c14c

SHA512
e220326d4523c455a79f7ccf51dab8207ff075f03a4a74402defdbfa5a130d7fb1a6400b4011b94fbc265838f28050dd95b6bb0ac07cef35e2836703de927dd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3e09bc84c10188a69eec44606816e0e

SHA1
cc98fd9611754129d5c35c872219448b6335972b

SHA256
88356d75b36451e25a4f856cf4d06c3f7b43226b05afac087d473f8ffa6ed34b

SHA512
9cd86ebba88b9e2b6da0cc8902a11fc4ca06c15c7b3e9d44a363355efb1a4967a19b8b89dfbf7cccb1abbbf3ede99ad2be4018cb6fb38c3e42c817b2efffdf11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5c5f3b478a4d7714ebd064f688e98e1

SHA1
275c0436924ab0e7bf959ce71b4dd6bc124c1488

SHA256
d1cf5fefce5460abe9697cbe37a5a1cbfc341ac59d2f5611c843764e57c06fcd

SHA512
0054fdacb382ece9c1ca2ceb5395f909653e555fa54ac7cbe6c2d8d563f999307e79de075fb1b86962b6d4e4edb60b1561f4ab998c2e264b21acaee9663bf74f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c979bc765e150330244131e49cb3349

SHA1
4f9712e200c2a6707aacd3f6f423a8c3bdc93639

SHA256
a74525b917b841a0cd37bd6e30c08bcc4d1feb3367e3e13c2ce1efd1179d63e3

SHA512
f41c6a7f111226de3ada2c9dda801ae2e0b3aef84814e4f8587a800c091ff575a92eb855bd65fa061979637889aa977251353683a7c2e966c0ca7d58db59fb81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe25eed530f43806ca770f5c9999d9d0

SHA1
8ad27681d8734bf0c2e380042001edb0347f1ea2

SHA256
b15a0f5885429eff6c7938756e188b6a026c1acbd30b6dd363140b3f5a5462b6

SHA512
3b6a7b3d03a16aac5525df213e77803188dd8ea31c5a978cac520f3da5b37f289df5ef327898539fb5e3a20f9f961afde1e0b0bb1cb9727b27236226f7840d61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
951422d010f982d4d432132b3aac573f

SHA1
0c09f7f45f47a81ed263a6f3a6414e3464d108d3

SHA256
a1127aaa309f60186bb133ff303309de3e8c96e544d343a4e96ccb4e2c780e58

SHA512
96c71609201375a2ddc6ed017a3bcd11de576982203c49dfdea9ee7c21f81ace3d266e865de909dd910ec6e52a8d4dbe310a868001e3113212e2918d95f69e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B66.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BD6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit