55956624809a42bed5b2b33350f7d38662cdd6d02647cd852d7f0538ac796789

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63b9c2c60940e0f21eb36a17461d8bb5_JaffaCakes118.html
Size

120KB
MD5

63b9c2c60940e0f21eb36a17461d8bb5
SHA1

7854c8a38cfeb9bbb7ba3e7343594ada5dc6e746
SHA256

55956624809a42bed5b2b33350f7d38662cdd6d02647cd852d7f0538ac796789
SHA512

3583547264cefd21cead67299603257a23626f9a6ce89fe204db6792d04d46e5fe036c13deb7c6db72d7ffd4db93b697f7e8921571082d506403cdc16e5d8965
SSDEEP

1536:SNkyoTLMZutmzHhHAH5HDHgHcH1m2FjcwSCF4mPk1Hc1gq/:SNkyoTLMZuMzBgZjA8Vm2hl1g4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9D8FAC41-1783-11EF-AD38-76E827BE66E5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422465820"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2548	1732	iexplore.exe	28
PID 1732 wrote to memory of 2548	1732	iexplore.exe	28
PID 1732 wrote to memory of 2548	1732	iexplore.exe	28
PID 1732 wrote to memory of 2548	1732	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63b9c2c60940e0f21eb36a17461d8bb5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d99579481da5317e75528fc3c8bc62f5

SHA1
ca2259645d7079092a783877ae5ea049b8815ef0

SHA256
4f1255487cadcc71853749ea4cd6fc1417371980de39f7a7f4971b62db597f11

SHA512
5fba5331a6e9fc0bf3614806fa31b9cb1492e4358432315631e7ce7600ad317cd4ca81820f27fe6ddb4017dec224cbcc0f22dc2af373c49c9dcb7486e49f8b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c750fb8c5fd363c23e3db631dd29396a

SHA1
9a402862964aea698db0c557761c70e2a3b77454

SHA256
f4f07e5031ffc12877cf963a3188a17ccad85ab22a820a62dc35ff4f3f8c81b8

SHA512
5a908cb6437eaabf9dd0a1f408351f788a9250731197e1f24c57716657325803ddfb435c56a07043aad02a2d89b05c6b90c6f023dbc54491e3d4ee8caaccc231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dad07265ccafe62a7393ea0f88545598

SHA1
559e483abde65027c2dfbca8dcb1455d2ca6dbaa

SHA256
f0da2e03abcba92f4fe6a227b4ae51290a602256def578a0db6cd67e4aeae38c

SHA512
d7295e4a30f4320f83d3bed5079ef547e4a0f732b6d8ad2fc68eda0bb605dbfc1e86b5a7ce6f4dcc11f7ef67b0706ea80ac22e1a5965f715b014488253ea07fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26f882d8a226101dc691be8f671af5be

SHA1
f4363651e29e127305fe9bba398e5504ff9f75ab

SHA256
6c2134110d8cd2d48eb3bfd723c1d179a80177c6538926e1d3f03f62fa0e060e

SHA512
40021082acfda854a0327070097b309285774e224d9352c2a179fb6d16cc92ad9a103b09475c5d6a8251703538b010afac0d6e2f6bc19ea353a567d087dc5474

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43668954dceaa93c18757d4c953cddd3

SHA1
085e064ef22e48d2e52574c59526239b2465046c

SHA256
cbb0e9ac233980f6e9ccfb58cd49919a873a76e0182a2a0d96af0ae91d259af0

SHA512
7263be8e57265ad0b54cc76eca4c7e739307893d6d6ee44225bd418da4b55c62537a338c3014c503ee655baa899709fe6be88d8a3688a55bdf1df16998101f8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7039801025007ec34060aace25b0dcb3

SHA1
dba5d9a9586257db362e4a3f1b66a26ff0b208ba

SHA256
3d06fa99d53c4b7de94067ac0dd53bc7534ed68b372d6107bd7fb6df4328b085

SHA512
f12c71232135a1c2c24be1f56e018c44875437467e477ac900ee1b8b2c180453584aeaeee45c3dd9cace9b6f62fb5bdfca484866dab2dcff11c6b01eae87d6c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c4cdc2d5dcb8d5406b089810ceef756

SHA1
13dda7d57460564983392cb50b99c33a58f29180

SHA256
31a7c144da80533fd07f64ca1d5c3beef271ac75e89449bc568f64542fb9e428

SHA512
2595406687c0cb080c9c5044c25d23e833e59e85166843a3f613610de43a10f2120b3273543494a74c5a2276750398658228a991e0b6423bda136272a286d2d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9d85284f7b6401fb05060064a9b39ae

SHA1
a8aabba2d90075e44f16a140e6b108af430aab9d

SHA256
1f0ee672435e1160acccb5962d063560b78e4229158435b382e859d763e72c39

SHA512
5cf06ce1e59dad71e9dff16350c9c4b7f470ac37feb9ea99a70eab7d09b9c9bf0be4ba888f7954868611eba032383d73b8a0e17c048a558f801f2f99d130247b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2320622c3c3ae442f14363d77e9b184

SHA1
e39f6d523d4c9aa49f5e1c3ba8295bef9fad4d11

SHA256
f522d4d39423daa02a02cab6074f7bb42fd3c2ba1f79071fd68320d1e126eb7a

SHA512
4dfb13a231fd9df707dd1848de2003a258f63d405bc89e1b58b1393914a020be3c7d2edc5487ff855d1a666968cc883da4963bcd3301e04c94d813192ef0bedf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5CD.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar63D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit