b77adb8a6e26b9ebb848af9f732c6e49e3c24511602afdb59f45a6b4292884a0

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

634e9ce28d0329e10da4b78948b81ec3_JaffaCakes118.html
Size

243KB
MD5

634e9ce28d0329e10da4b78948b81ec3
SHA1

65a115280071eb2f158387c47d1d705a2dce0255
SHA256

b77adb8a6e26b9ebb848af9f732c6e49e3c24511602afdb59f45a6b4292884a0
SHA512

7086de897cfbf9557e8de63017432c3f7012c3deb8d819cfbed21cc2eeea8ad4bd7a4d0c0e3729567c5947e23b2be46236c4ae133edeaf60d5573b9ff930ba51
SSDEEP

3072:SYd+9yfkMY+BES09JXAnyrZalI+YuyfkMY+BES09JXAnyrZalI+YQ:SYdbsMYod+X3oI+YLsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422456632"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{39AA3481-176E-11EF-91CF-DEECE6B0C1A4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1776	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1776	iexplore.exe
1776	iexplore.exe
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 2020	1776	iexplore.exe	28
PID 1776 wrote to memory of 2020	1776	iexplore.exe	28
PID 1776 wrote to memory of 2020	1776	iexplore.exe	28
PID 1776 wrote to memory of 2020	1776	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\634e9ce28d0329e10da4b78948b81ec3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a47644904a0919fc8f68e8277826541

SHA1
0a3b1909ba1d0925b47642703d121839097fd8d5

SHA256
524eb6e6d14be6201abe422cc9e764cf94c195fb5b80b713cec69b59083122c4

SHA512
e4943b2ceb4d0e82ab657b065554482d5d851b45705909834041f8b328b812d2853257687afc5e8a94461d7f687ae48a2a41bbb18067a3d4435b9cc9e083e457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c23589cc937f786db52385411ae3a597

SHA1
7d292cac1123e520291d3606ca4a755e5a2e380f

SHA256
e8f0592202e6da50dc7a66652aa02d8871c0e353ab9a4bfa04396e781cb29ed7

SHA512
0eb9cb4db23bc2cfcf8943560ae16493822022959fc57efcfb3d32a1ca4fe7b9ccf99d8f2b02a6dfab230b426887e5a9e904651ccbbbfd7c81081244114c1430

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a835bc3aaa6acdba6ddc136c9c8ba5b

SHA1
485cb314f27316f60a6b434a9614802f1573e7d8

SHA256
15ef37d7044d6d545809bd868224c8c6a2c7511b00e86e2d3522e81b2e084bc8

SHA512
9bcee43de979fac5d3631cb61b52ff6360f1e0976bffff217df695dd4f06d513a5c0ba30310bb39464b5169c47feb7cf2f76255586c823a87c140fbb107c5b29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd45cb4316c1b4ea840d3fa90e01263c

SHA1
e53cea261f4a95262e8e258f4f7d7be76c7435a7

SHA256
dc09fc3926cd1247a84db875f2775c7d8ac47c4b8ce93e5354bd4e64b98c3807

SHA512
9a31efe19c696fef5899bcfc193451e0b2b0afb885a2b15a3d501a058700388a1f328da3bfea2b1b417e1faced06254a28fc2ff1ba167e675e61aba36db4ceec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78d9c9dbbaf2558a8e1406b3b1860050

SHA1
535906310d9c5ea7efa3580ae15234231ecb100e

SHA256
2f3217dfe4efa5ef3d28ce6093ef5437926bac4d09907d3e231f8961536bc08f

SHA512
cc8d4b9abb866ccc3edff87afc7d2919b75e62904d4d8a808c8ef8bc5a5356ab8abb12d4adc4e296bec72eb735563475f009381f1c5671790f9d4ea29c630ad1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
549d2d229ab1d92f1748fda3edd5a724

SHA1
9f100c31a66a50565e54deb460e8dca7faf73f9a

SHA256
5227f8110f8a8482c7cbbf9f9b8237a74a68b085f012a56fab1497e5b3b57744

SHA512
c42464d5840b5d8f03b5175e75dd77089b21e85b291f5737ec7f9d0aee323ae1a91abdac61cb0e8c43bceab053a03b23c4d036763b979375f54d452c0c84dbca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70a9f2d3e99ec8e1bc357edddf55017f

SHA1
60e8246298816f88454bba9fa22fdb748d37bbdd

SHA256
d245f4826d146da8043952c7a00eb11314cdc20c539e558ead550df74f78ea71

SHA512
10ebfc7ae1e4d46dde81e3a31948dec4556d47d930e99b44fcdb0a789a75ace406b744b62b8bcd667f1fadb0dcfed97c98631935c45d431e40ee0e2728b02d06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
347fff06446797ffacd5bcf65ec1a890

SHA1
a7d98aadd3108c449ad0d7b6932520d22afc9bd5

SHA256
f004e093d1c58f2c3019bdadf8aa211b4e851f3898ce63951cef925649a29198

SHA512
5301b9dd65e06acc0a0034eb46b12d769273abd4a5d1332ae77889ea6e814b9f36078d0c8409f1d1b658db5862fe5990ae6494dd55f412513baede02b7f64d87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14764fc9c92937977a828df82868689e

SHA1
7bf29e2c17c9607a45e5c88607bf822b055db452

SHA256
141ab23f5516d6b3271f004969b9ac411ae2657412946c68d2bbc1005ab88957

SHA512
250d40c09d61f75710e3228476ee00386a2bde7388a4faa92c2edc2d84bf76e7756d229a1efa0e1687e5a6bd065a88f3a4beeb33664b6b137fd45db5810b32bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab14BB.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar150C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit