f35ff792ff57da288c866d720303dde1bc6f2c9c94598de4da08cb755f1c5316

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

738e1bc2ee83a9c49c4e3bcce904a376_JaffaCakes118.html
Size

23KB
MD5

738e1bc2ee83a9c49c4e3bcce904a376
SHA1

dc0bf9f5d109915a9285638d463c25af22e1139a
SHA256

f35ff792ff57da288c866d720303dde1bc6f2c9c94598de4da08cb755f1c5316
SHA512

17788c6ab1e858de4c68236a0363c0662b1c853e1386998a3d39a766cf7cad049e3f452b2dddafecf2f76091b8b1d427c9af23fecd521ef6a1c5964a6c94769b
SSDEEP

192:uwv1b5nH2nQjxn5Q/WnQieVNnonQOkEnt28nQTbnpnQtBXRvMB1qnYnQ7tnIYynT:nQ/E+n1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C26C87C1-1AEB-11EF-A7E9-D684AC6A5058} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422840403"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
820	IEXPLORE.EXE
820	IEXPLORE.EXE
820	IEXPLORE.EXE
820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 820	2032	iexplore.exe	28
PID 2032 wrote to memory of 820	2032	iexplore.exe	28
PID 2032 wrote to memory of 820	2032	iexplore.exe	28
PID 2032 wrote to memory of 820	2032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\738e1bc2ee83a9c49c4e3bcce904a376_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c6c30b72911a1fa7c4c7e169a33587d

SHA1
28c1bc86eb9cf2be4a6943ed6fb2bb951b6f0639

SHA256
b7d256807f5df4d21c5aedfc5e32fe0b1f9df954943f8466038bbb0837bc90cd

SHA512
d3ddd3229b1b5ac92b94e5fec25bd8aa5639e3f8ade19217dd4b323a1591267b9f9c999ea2de71f009f8e988be75e075f885613ad8b24c819b958d17728a0c7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24d05bd8a547908341ceef177b408b15

SHA1
7c17fee41391d31dafc09b75f03c917133946612

SHA256
e54ac21b2b3694dfbc11cd7d28237f0fda216d6ec1359ba9884b2b10633a32fd

SHA512
00a548c1f17d82ed558527ce08de72f8ed7236a6505a9ec73ef731add057144ffd99e6e1bc123d1aff7067449c471392fc8f9aff833477d73c54b6a9c7654b28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eb29722c77186db04c648a47d61d2e7

SHA1
11159d2668448610144207790d26768ee68005c1

SHA256
05f727a921495a8d66c1d718f985150c95331a68ce97f58968f1efb2db90c32b

SHA512
95b0fad7720529f36aac9b8fad89a32623be9f98a4ef2b6a66343ad91aa3b82993d4f9f974ea38cf77278bc311bff9eed7550f7073697d114027ecfd73df4f69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffe32e4bb818f73d03712f575c643096

SHA1
2db6294126cb5fd8f21861a3120d63dcc548707b

SHA256
119f3f55f3f27314c321aa37525f06e3535844210079e40ee38b893e4e7f4efe

SHA512
aef2ef9563a73cab6a297406fc6f5b2f782567b8230366994fca0036fa999ec23c82ddcd457785d383387ab6d8b0b12e02f9d82f578f7a5fe996610d2610c975

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
142b12e2aca282e2c8525530c7ada1df

SHA1
d4ce38d7b1c454653cf02c2b91f4f01fb6de07ec

SHA256
dce0311e14c43f8db4414856da2a39a259b028f9fe435cb513f7f5bfe70bc457

SHA512
e8b7379fa20329e26769e911559c63b4fb416d475835ae3580aef18aef61a9335ab4dcf61d0234c169c8c828ded76d4ea5f6af18e0ef0f3940d8470ed9ade262

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0da08f1fe9d38899712abce523c0e69b

SHA1
60bc209cae83d5d5e716fd7aa58265d049738d5f

SHA256
239b25bb9931043435734706a737d690c78e043995a3fd452e85fd7e12241fc4

SHA512
753dbc35650015a3d8cb9c9cb543008e26ea529833545bc6e474f0d5912c293453a34da74234aacef4f5e85f5d027087633216b17b7c1af03bca5f00dcc126a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acfb7a77818bf11ae547617592aff3ba

SHA1
38294ef327ef149e2baacc5c2311831b8c36ca02

SHA256
513e741d1275a257278c1948d8ecb227e33e3d8ec3e8fca4591ee2c290a37bca

SHA512
82229ac71ce3a38503a8bd4a56d0fcd5929fbc5eb983ebc3a2a5b998079950e5f96cb1d824fb352f176d22252d535e554db4eb025bdf60c56b02ac9d571cc9ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c15ace97add6fe26c81d6c43110c055f

SHA1
09732db375d6df39e4746639fc1a3fa53740cd15

SHA256
76553ea5cac8230862bcbb95a9e21e67c3af75a11da472d859c78144a725b1cd

SHA512
52fb64f40d663b691af069f2b542232136557cc0c2e920f84160294ae15fb191d145f877cc2a433b7a74255768801eee42a694346a02a72c626eb780f397e9b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a4e4570af387d189d61e0c4da3c76c1

SHA1
f67b7db0d50c4dd999bf2364a9c330fb02e74666

SHA256
e3d2f81908075c7e3b09b099ff8fe6991f73907f412752750feb30605586f1a3

SHA512
c9cf81481af294690678a79b7e2c82f53f12b431c7be7a6b9905ada37c4c74f6795d19e1ead8826df28fb10e10a9b37a8c54059c059efc39dc98b9bf45c516ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D43.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D94.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit