dcbab50820f338717c415f3a559964cb60b4bab84b945df39b19758ef343892e

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 14:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

67a4ac1d11f83d9fa064c6bfab42e8bc_JaffaCakes118.html
Size

89KB
MD5

67a4ac1d11f83d9fa064c6bfab42e8bc
SHA1

e47cc5b1e93d0238203150d4bbf47052ac3b126d
SHA256

dcbab50820f338717c415f3a559964cb60b4bab84b945df39b19758ef343892e
SHA512

3731db517c941ca799a9abc01d5ab22410a70ce621734fdbc53c54e8318c61d0bbb9e79a702328ed52b5a2b33ff4cccbc1cc5f7ac81f822d12c06b3eaa12aeb0
SSDEEP

1536:FpbxVwRjfChrO6m2IOGSCJsDuoyBGSCJV9FnQwJxOiXokZflem/VgIsaaFGRl+r:jbxVwR2diiDuoYiDQwJxOWokZfle6VgT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422551438"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F676AD51-184A-11EF-8E9F-FAB46556C0ED} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
1284	IEXPLORE.EXE
1284	IEXPLORE.EXE
1284	IEXPLORE.EXE
1284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1284	2972	iexplore.exe	28
PID 2972 wrote to memory of 1284	2972	iexplore.exe	28
PID 2972 wrote to memory of 1284	2972	iexplore.exe	28
PID 2972 wrote to memory of 1284	2972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67a4ac1d11f83d9fa064c6bfab42e8bc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d7242b1ee9f041b2258e5c3c2a0d56c

SHA1
f069719da3c5e52822d25991513b1d87860f4ca3

SHA256
444d393122d613ea116fdc923a22abaa1280091c1d55fd8ef85dea0fb3ea8034

SHA512
323d96528c1c2f78080ed2959ff6ea7428020b7c57c079e353c466da1b6b02e5fa68c7f5acab34be4215f8933dd37bda0cb4565c3fa10e47b0e99f20604d05c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ceafdc0269fc7952a720d344a4f3920

SHA1
d70f7f61d95d7eda90b9df45bbf85a691c0d7a78

SHA256
3e4383350185f6cca49fdf3796b74dfcf3c3c043384855fd7d795b4c53f4d8ef

SHA512
a6c501d7f79ec0a41ae06baee674352d91103ba8f128443b1d0ff06df072cd2ae33afbb8ae083f837a8c9a38fabc08057449fd8a97a1d92ed3995261b0b38381

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd445b4ebbd719455dbd8a589006e3d3

SHA1
22bd83a8167077675f1d4bfdc763293e74ad49b8

SHA256
326d63312f52554121220e5e529ef9e268afb15a867673b38018d3c0a87c30de

SHA512
775381e1e42a131e676d3e0e5b387d0587904085489c55b1992110d95d17c752eba16465f21b67d9f5aa955e190db948db20d341dd2d961ddd85f5f211f070dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a58f6e70567b3051c65473f25beb7dc

SHA1
d12396de5d790e35d51e871df0d78a94eb4dfebb

SHA256
ad1bb6ad5784afdce68ea2aee5a49dbfa5d2d89b03fdba4321986d6cb0ff91a5

SHA512
ef62b11caa7ec34c13c7de4964f234a5e4b5b1a30e534ef3a7ba8eaf4b39f6406a624b3ae349e7351f47c706d83c6d05991f5aa2118a262357a98998e6e9d98b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8eba805853691a66db413a40a6f54c9

SHA1
b7b98167450f4fb8dee81377ae6b3f58574d3fba

SHA256
bbdab62b864a47b7dd1e6902e5fbb1a8b2733852b05684d13bebfedbb9afe7f9

SHA512
c24536387ca8a520fa720cdfe928651233bd820c09cacfdbc0926980a64d30bf998c45871da3bc8c869b7f8c0f98ee288eed50677d0e5e5f13193cc8593b0fbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c04a784c849a7952d842edbb00ffc117

SHA1
e5dec5cfd113516453df5f2228744b345dde7778

SHA256
fab5efb7ff00c959065defb7dd6ca7c69c5c7d0148bff21d6b95f1e34e55dae2

SHA512
6c418499c39b00330f213b85a8cc9ea0875425fb2153bb65f451ed1c8bb0943ad8fadf03d15017b2447d96d95e722f45149ced2f50fe06f10ef6dfdab5051b05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f22123d9000ee6fac7c54392bc1b1bd

SHA1
ac520aadd31b94d6c98bfbd2442d070ee6d74fce

SHA256
3cf8fc760dc1f2e224d88dd8ab327ce26bfeae6874c367793a0e7f699fa0544f

SHA512
d6951c5168ac100e6afce30a1f9b8dc6c6067973efcc76abdcff8b8f4cf0d498a9509b609bb11dabe290dedac55762775ed1fbd02991d547268191c3c2186f80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2442f9c34bde8a19394e4e5b1e05e058

SHA1
7597adb46198002fb6c744667ee6a702781fc150

SHA256
1f4ff5a84f71a8aae2e2ccdc54e1f632eb0d701bba164b19f0cabb6480ffcf2c

SHA512
a90ca259b63380bbb025b1177bcda562013e3e85d9c59c644f7e96dd71ee6580f175dfa5be805eb2ce24b8fc23878122323450937ce08a0b67f4eed917c4a972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e791b6879901df863e90dff82ea452d

SHA1
cd2592104077be7b0926493422d699120a69fb61

SHA256
322178ef300516378812002618088b9228d0c590f86a8865995daf2775b7a51d

SHA512
b1f10ad407baf754b70e4edb103d7ce769e965b37d3a629f1d200b82f7e29a269ae5bd21289b01fefe9395a7dca9c70f6d119e8a8cc10f2ee6367c0d7f62e12a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab127A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12DA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit