1190456dee4d9711923a2121cf341f7d93052a435afb101dccff31dc8ca38723

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6915ab9eb8f249d5bdf46d3400d5e347_JaffaCakes118.html
Size

97KB
MD5

6915ab9eb8f249d5bdf46d3400d5e347
SHA1

27ab97ae35360ca67f6b28a7fc4d4fabf2d4d154
SHA256

1190456dee4d9711923a2121cf341f7d93052a435afb101dccff31dc8ca38723
SHA512

35a91877c8f3c33f70244dfb1cb5c7373dcc12d38ef98d7229c03a91a84eb1a6006c177550839580b6601cb77c31214afab861659b54f573fbaa4fc40df82a00
SSDEEP

1536:Dc01baD+uotmrj0/2nR9rWka2B1ReS08fInV1t81wFQ1GafbEueeeegexdueeeex:Q/DBZs8ak1Z1Tc5V

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{096469F1-1898-11EF-BA8B-4EB079F7C2BA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422584542"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2236 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2236 iexplore.exe
2236 iexplore.exe
2240 IEXPLORE.EXE
2240 IEXPLORE.EXE
2240 IEXPLORE.EXE
2240 IEXPLORE.EXE

pid	process
2236	iexplore.exe

pid	process
2236	iexplore.exe
2236	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2236 wrote to memory of 2240	2236	iexplore.exe	IEXPLORE.EXE
PID 2236 wrote to memory of 2240	2236	iexplore.exe	IEXPLORE.EXE
PID 2236 wrote to memory of 2240	2236	iexplore.exe	IEXPLORE.EXE
PID 2236 wrote to memory of 2240	2236	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6915ab9eb8f249d5bdf46d3400d5e347_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2240

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5b812de63a3b4d0eecc0b1249052c3fc

SHA1
2dd5169f61cfdc7e39019acbf04beafde8050e87

SHA256
1bcf30754e9b35675707738fbba08952b23f0084f18429c63d008e46acde59ce

SHA512
40e3f065319d7a1531ce744d3cf8f376bc2404dc34c3d21f3d5dab19f23df23909386554d12262db076c5d20d4bf293e7a55e026412a1c466e16562958f70e21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9dabbbbf37e0328b44576788c0d1668b

SHA1
afac4998a1a952d07ce9c2bf86827207c5a98072

SHA256
97fa999beedf8c1f0df10ccedfe6cd4e1c8e089284ed3104ef79c9866c6a8b93

SHA512
16326bee12b851fe7149bf0f01457777a72213cc49f30d75a4d109583fae5509e76854208489ca8dc1c766b1fa41b0d076c54ae0772f0610e934662aeedd5701

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
318cd46fa324a0d6b9c88367fc3790dc

SHA1
5e41a2ad9240699e24e855c6ca186034707be2eb

SHA256
14b22e86baa5760386d18cf4c670b705e184ea0c1bfea5bfa1db4b04148c9e2d

SHA512
c68111ef7891aab4f12bd8d62035d3294bfac616e15209ac6410d6249ebca4c075b2d69eab353b616fa7f77612175a9a71ee8fec08d971e8690ff67615548682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
57f62829fd4173777723d0236df2ccfa

SHA1
124f241950fe40aa752bb9f64c589df8522a30df

SHA256
4c982e485dc87b02cdc44cc33518e8ad0c02780dc900ab724bb5a28785e57e09

SHA512
31ad1b19991a97862017ec330c355758b99d3a899acb2d3c1cba1fbb1b010d734b2b0251bbcada2c3910c41baa3e001a18f396ad71bfc8dd34d55025f055b8a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
669e4f81f448bf80dc37fd7c3dcfa96c

SHA1
315de1cc02a00d47dc6ddb68b7993f9c902dba44

SHA256
4c4f6fba6fc235782b9d71ff03b6aae45bdc20b8a314632d31347bba17559d45

SHA512
d2acc96d24ab20aaed4d09735a118db8c06f5c8c1c29362906039cb571a869106d4a225f27dcbbc9b5ddb93ffe264449af745ada11d0dfa8eb39e307ac6f2cdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
667ab0a19eb296496386fae482ed27d7

SHA1
a902be017bf3143230776e818552be37ad0b35dc

SHA256
c869368322a58e96212ff48889080cd280f6fa986735428d91cfa0e191f0b285

SHA512
fb8446a185f178b4671b3569a01cb2364dbd9f3f2cb1b324c58b9ad6e7c8b0f4ccd95c6bd1dbff78e5fbfcab55143ef6be5b2faf2658cac078c7dfcd46deeabd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
874ffa2917b0bc2cb585f239c866fbc5

SHA1
27b5cfb0794bb88ab0d6ea387bb81ca2d8b0dd42

SHA256
25db5421550ddc657eae553ff769a20b31bdf8cfe266b6ec1a99994f4fd81cf9

SHA512
abf5a4e6851fad396acf5e2ee518534b90ea06f45ecb9d9db4db57f32fc7f92bc2272849d9bf0687b71d58f820af86f098549f6950c026afdb28dbe2563104c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F44.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F56.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit