adf5618815c21b795998dfd3cee8a06ccadef52b46c5c7dcaf71388d5cb929b3

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5c50d829beb2a0e3c2ad1011a1a9a632_JaffaCakes118.html
Size

129KB
MD5

5c50d829beb2a0e3c2ad1011a1a9a632
SHA1

caa69688cc88e9b982e41e39efb0107e7974d038
SHA256

adf5618815c21b795998dfd3cee8a06ccadef52b46c5c7dcaf71388d5cb929b3
SHA512

84288bf186eaee5e8686189b33ebeec4b5b5bf551a645d774e7406c3bef5c114256a5294530113bfd6366b848fadf2db12d485bf103376f0d2f7c7e28a4b7736
SSDEEP

1536:zsydlEbbA99YbHqRHHEExx66++IIddtt77bbSSSSccllbbFFDD998811qquuHHI/:zJdlEbbA99YfV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D3D78181-1641-11EF-9BF3-52E878ACFAD8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422327613"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2832	1700	iexplore.exe	28
PID 1700 wrote to memory of 2832	1700	iexplore.exe	28
PID 1700 wrote to memory of 2832	1700	iexplore.exe	28
PID 1700 wrote to memory of 2832	1700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c50d829beb2a0e3c2ad1011a1a9a632_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0a1f71536347e7673d208240da3316a

SHA1
b08ebdd52ffc0f9f127965b70e9b31ce8f638a67

SHA256
ea07362f5005d7f26a06ca74f756be3cf6bc72619853e06e205d56ae5e3c73b0

SHA512
d34ebdaa88527bbbbe9c0e5e0204435ce061acec8374de9dceb61d726d4b6b50b7ff13e37ffdce4a90531d170e6e17c376efc71e2a8e2af39637e755ccbcf3ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0ffaf46147a40e2ea4db953ca98e4b5

SHA1
c4960b0d47db43b7c5fec9acd9a8d5e193771245

SHA256
5f8a62a5d89e02050deec07d293f3b3135ac429229e766d004493afe2a48bcf3

SHA512
20686c1c20bfdf9023b9e64105ccf385b9511abcea13e671dbeb6d003a4d397fdace910845710bcae35377861408a39bb7a68c13dc5d7fed530452ee1e3f57a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d0aa068109b3fac0cffa4641ef57400

SHA1
9be3b94c826d841c23b94f2c0da663861f93a792

SHA256
d146c8066c872cb143fd598fe8b1f60edab882a481874fdbbbe95b66fe9ed230

SHA512
0ab4c4ab0ac7246f66efe858a142385e0eeecf41f1cf9019ea0f46ed18ff2b2873889ac1f21234fe9bdba4d7c8668f8b7d7ee1307e7fa7a2be1c1549e79bb1ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a77368bd48ae706bcaaaa56c0b2f2f77

SHA1
c922f83c28a8f6ef1a7758b22356b65a2f9e6fea

SHA256
c3335f920611d5bd65f847b41a2a631d4c7f76e99f230693d1c05fe015e32447

SHA512
58c0fe04fff7a6997302be9ed37ed39c57396e7c2b2f6066f4f16090cba61d9acee5c960540d413514ba65fb8e953fec5d49a8863a257210e05c3b8bea5706e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
692e624eb18702dc9e02756653e2e669

SHA1
a80ea462cd117be590300a51a08883b8a428cc9d

SHA256
a11138d1cec053b9b82b5708fd2583fd6836f408f4a048acd42c988831db4e59

SHA512
f4a3f0f44ab1472fb281e1a685703e12871bd40454093f53841fc06aaa3ad28e7dd4e814d001ed4885cbca7ea11d8161d6fa471f6b8606c87373768dbd7ab66a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8879e069bc9d55e3adf3faa5bb515abe

SHA1
3c148da458a4e581c31de7f42d3c147000f25a6e

SHA256
c4f4cc685d5dfa2b78971fa6edc38c9a3bf4e5ee8d03c010f2e3bb0141022bdd

SHA512
03395ef72494de344e033c3c3be304905f6b3eebb04f8b9ef667678eb4f9b771e6098dd525f64b5a50801d1e2ad1fb7f09c29a11f291dd9415fb29f066a7d6d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
521f559877d3119221f3dd1e799e8a5c

SHA1
8b584370e3f3afa98b8646e5e4375f0c5b7cc38a

SHA256
06384c10125482ec349d84c619dafb6753b893e949891f051967026354e01d9b

SHA512
a9846706943ffbc0f9a1b1874cd8cca8d30053ea51fbc96a39f78e5b8ee63e8122720dcd904b44090429ae2b91f48b913bd4af646eb6774fd5fb5e8db15795db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
392247faafb0c8dece40f93b045f67dc

SHA1
62e2dd9ec79595a7fc5f531a6a3d027421ebd841

SHA256
3b165a9741e77198bef936a5f92088516223797a35f9c35fda31b7cffaa2265c

SHA512
09f5fe5c7443ef389af0ad6f0e8180dac3c634970d540c1b17bcf4a44d7fe7a508a3b3ef38eb133d5e787650b81f993282e8ae438113741869fa1e8b13baa30a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5aac8d0ba756927641de51b5a6e50398

SHA1
8cf0dd7c89031af33d0c3eca3bc28123f40fe55d

SHA256
83ebe1fde9e3d33465f6971494197be71732f61483be14fa88102416a9cf22f4

SHA512
c3ebcc18389fae0bb1fc6ff531ac6f5e7b77a85b1d71c4492f94979c19f304db14cbbf5448157f80336be9ada47eb6bcbbe9418ccd724ddf015c1d710d13640c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab659.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6BA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit