0d4a2a2d7b2710859616eeeba3b4b66b0c7e632cf4b0d0145eab54c80a4b2231

Analysis

max time kernel
66s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65e9f8291c570eb102b3c52ec0e05520_JaffaCakes118.html
Size

53KB
MD5

65e9f8291c570eb102b3c52ec0e05520
SHA1

28129886f009b396b2c48b479694425a5605a8ea
SHA256

0d4a2a2d7b2710859616eeeba3b4b66b0c7e632cf4b0d0145eab54c80a4b2231
SHA512

432c1aefc0dcfc62a0838963efcafbaff0424a54df46d1cd0945700e51cc15554ca9841b6e388f480b6940621f24d5052725462cdd45d3ff957b5c125119fa5a
SSDEEP

1536:SuGrK7epnCcFcHRqrejfQK00ChAqMpSrEad1wUfoesjvJ:SuGrK7epnCcmNvJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D14499E1-17EE-11EF-9F3E-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1544	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1544	iexplore.exe
1544	iexplore.exe
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 2856	1544	iexplore.exe	28
PID 1544 wrote to memory of 2856	1544	iexplore.exe	28
PID 1544 wrote to memory of 2856	1544	iexplore.exe	28
PID 1544 wrote to memory of 2856	1544	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65e9f8291c570eb102b3c52ec0e05520_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1544 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eec9c9d81ac60b179ad3403b6d615a79

SHA1
da0af07bc9cbd659de9037c63fc1f12c17a6c5a9

SHA256
09b7f2c5dadac3d87f6dd606be3c4b3da801a88c8a9003648809427720ae223b

SHA512
829ca2e6a809fbab2536abf2adbd1a64ec42d2e0ccde951cda9fcb380791de479e68390c5728a87e6fb61002450bbc887922abdb1d7708a446d32caee9e2043c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f87b8783f8d6562441c3d7e779b86015

SHA1
06dd90e136adc846f6810d5186d7cf9601dee1b8

SHA256
ab1873790f00da62f71b23ed4b28610493276838d15edddc983ac86fb12172da

SHA512
3acbb6bfda3b9c247d0493ed61c9a8d774eac61a62ff0dd2fae793a07f4b58c58c96dd0f5a8bf165fd2e79c848b15705423e4106e3f5349142d312414ed5d109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78ecb004155b3a85744b4fa3f56dda08

SHA1
c914fc0cc88e6fcd9144da09216efb61d60e2498

SHA256
b68d8629f7b7ffb61d69671940bf7015d74273153e30e589c2d616bb91a173ea

SHA512
9af3574adbf4534695505ae042446418f7254f8d824a56f20abba46fb50a702e6af89f8fc14e660bc640eea4d9a2cbb65f83dc2dd41aaa74c13d603d0a156358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5c0865b85a00bd2c5825603282264e3

SHA1
ca5597cb19092165d67faae60b751102e24affef

SHA256
cbb7611712a25e0722e72202025d0995d0748479a9cf4dfdb198463640b63ca0

SHA512
563e914674470df6fe8181a6445c4a7564f583ff3a98c48ac340b920dc2ddeab841dac7b976c7934a2c87dc502dfedf2744a210427749f73ce35eea9ab45d2a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11047f292e9ae2aab6cb99e622b07e9e

SHA1
9102628aa546862cc8bbfa42a0bace6d91db1a97

SHA256
0845a15f2496641758f788c65d9385c198bb40fcbd1f418072bbde05a0f88742

SHA512
f515e861275c6f1a5262167a0134f2cbd4e21f1934d61c86d678e1f1e0d038d5538da236157cd3a7538522160ba445dd3feab0dbdda0db3d98dd18665bf242c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6fa3ea77395789be24d080830af18d5

SHA1
3dbb31b3ce9de09317716531fbe816451f46ca02

SHA256
771e66f8fa7ae6620083bf7abcf847f22f3a130cadfca5be34567121a6bd93a6

SHA512
d8aba8e856b99a393778b9bdf0c08feb25da832f1759e91de4ec7ac024cdbc72ed60ec9177c0fe02a7f14baea255785a12f9a1c8c64bc02b0ce37973bba3c91b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ed1595224cb9767a2afe31a80973df7

SHA1
41241abd6bad7b45f43cc3ee7d54c5491ad97cef

SHA256
561cced49dfcf0f9b7749f5184f6067c508fa8dd6c9bca64aba52b4f3f0786c8

SHA512
dc8910c58618b7a725072435f35f80c294210b943a5e4244dca519724930640e0e9f41f01e7c3add0dae07177971b1325620531d57518b539be89043995d4900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fcb0942f26ab4bc38a4651cd5bc91a7

SHA1
d9c08c79bba2505190656a99864b5585fca60fd5

SHA256
36bd2aa0e6ab220568e4dd731fb6826cdef73dc3b170e03ee11e047b5be4a425

SHA512
17a8753aac3b73c316f659b1c5d68e0f78c2296b70bbe76fc7c9edb1f805158b4e7abe3c79e3fc0f6b5164ba6c16df1acb71c4ee96789ea7165ca78d0db43b8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
409264593c91145d944e9c7dea2972f7

SHA1
71241fb882313c9a75b1fd10f4a2441bee940b6d

SHA256
46a48e802c1d2e1df141ab155522a24b4e9aec414972fffc0ab3043357d41540

SHA512
6a80a374ca319e7c37f4dcf7b6785134178aad0177d22c80f3b2a33467a295ff3a4e168db06b23db06f27ed9f475977ed764f2bc257effa5e2c5be45a75096bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8A18.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8B05.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8B2B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit