e1b87c868cc2cd07e8a5a3e8797814c76982090c266a5db8acf31d129838c188

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64aabcc1a97216e861a8e3946dc41ea9_JaffaCakes118.html
Size

20KB
MD5

64aabcc1a97216e861a8e3946dc41ea9
SHA1

db06f150651519dacc77f1d8412b19ffca416daf
SHA256

e1b87c868cc2cd07e8a5a3e8797814c76982090c266a5db8acf31d129838c188
SHA512

b8a97f22ef87d5a324ac0e296fdf65b3c0e3e59e38556ed827718d02d330a0744c4291885fa546893f752ac0311f10aeadb83a9ab868769a4ce4dd7c46b3b26f
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI1WCi4K4iEEEqsXClLzUnjBh67SF82qDB8:SIMd0I5nO9HDsvW7xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BB4E5C1-17B1-11EF-9C59-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422485415"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1084	iexplore.exe
1084	iexplore.exe
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2272	1084	iexplore.exe	28
PID 1084 wrote to memory of 2272	1084	iexplore.exe	28
PID 1084 wrote to memory of 2272	1084	iexplore.exe	28
PID 1084 wrote to memory of 2272	1084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64aabcc1a97216e861a8e3946dc41ea9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ea1f9325170a071a3d456fe04dd2b6c

SHA1
b893cec683b618c961193981493cdd77c54a6474

SHA256
db44f0c516a0900fcf3170b4b912642088bfe9c3e356c14c2c385f67c8d4f73a

SHA512
cc1d7a361c0c08fe03bb4ccf875cbc3086eb2c9e99894397a750616036eaf9652b468f1ebe36c6836a35722a5b64553afa83acf985f779f8758f0f788499660e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
411ef6fc0f3d7ac7f7c2be3908d58ceb

SHA1
d6aa66be5d3c66b27d75529d48ba0b52c55c0cf2

SHA256
6854f5fae61d69fa09693e58f5d69f64b2727291a5b7daa354992bec946dea3c

SHA512
3a529eec17d0c4716686d1573b4c8c8720bd0b70d539c01c91e9b31307272f58f04156b6f96cf198225c03dfd71cd4c4c947b5cd439759df7e8aab42ceb712f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06707982a8a79033acb53363ad508858

SHA1
a0bc1f287b6d68d51e5f28e1a3ef83aeae3e674a

SHA256
b89dc580c577828b4c5c992cc7bf82bad468fd9056854790e0ef4dd81d4836ee

SHA512
4e2cd897c34a7d5d0378c7c4507e60c7cdaa2714e153397d015317d85dff7569634ba1f9572332c7db5e52ef118676db2bd8688db3d9f365686737856407404b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66f84e952beeec92d0962f35973241a0

SHA1
82a2dfe11ac2a6a052f3f2331baa34acf13b90c9

SHA256
6af7ca61518103090e16cfd1432ab9bf4fd1629595e573609f625fe4311360ef

SHA512
244d6f251bc32801318db14c7d65379aedf67d9d2652c5818b4745d46b459b4584518611f669ead8be733cf752e1dff8137cf24dd2040ee372b4b5f5cde19010

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3247345445c8bb0fa6035af97075e61e

SHA1
57261d52fcca4f8454c6427fc27d27a1d7e697e4

SHA256
6cbd2a1999819a9b6d92326a0a7a9e497d1ada9954fdab2d265f181fc75c6321

SHA512
9c96b16bd2b364da27b31d48e8d99f7fda72531048de8725c825985f8a336936ca4bbf314a844ddb9c234cf3c42e820f2a4463debdffa4d1d231b10627d57ee0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa999121918cd560bf63ace3c4990c8a

SHA1
739c276412eecf879c02a6c03a5d4f533974e92e

SHA256
16929eac64320ca29dae8289108dc4ce7279d2ca6d966c8a723f76f0cabfae37

SHA512
f3f449dc06b5d4efa7fc713cdf9ceeff69d1890c3f6ae0684f010ca443a32266d68494c145974b879ec2a662e826b843070e4c6784935f3025e8765c94bc3e7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
849a657466c9af62e9fefbe5baf0e844

SHA1
0087e3ca75449a2e42a66de5f7d4910447f0be05

SHA256
f27896ab16fc3d20713fe7a70f0c681353e8c32d326c865bc7b10cc428709e33

SHA512
70b079fef363b41e46ba46f329d1481f6571632842b051cfc2f5f155146facb0267b9d383f704cc18c405164f71b2bff3c3f156a57a6637797b28f67341f6436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cfeec3b96393b37acbaa6714a074ef0

SHA1
824aa2590e0967bb6171f2401484fdc28f764d43

SHA256
4a34797e3349eaae36e9f29f68b45a6c4b00a26d3b387a33ee9dad500f60d831

SHA512
269d95e0f7c7f7e9a7ee9f9209ff0317c4de14356dd13dabd217fd3b8ca98fc8952b420a17690b8605329257e5039f319e503b19e535c48cf02132347b34858d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89f2234c524ba162d745f2403bbf3385

SHA1
d85060c96903ba2f3d0aa95ce559b2ba97e86751

SHA256
58ca3a93be0403726f32f7606a5a3dffa443305f776e14aec699a4ea1cf5f720

SHA512
9fc1057e499e230fffd65d75268285cd372520ac9beb5a37e64e53856907f914422b3e9f21fb6af64b5e6f938807f8540c49bb4c9df4f12b859693cc9c54a6fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab91F4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9301.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9382.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit