cf3d25e68a8c9e0e3290eb07f646fe90684ca4a2cb3819d67e90d4acb59709c0

Analysis

max time kernel
128s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

70734eb41b69f5ed95d3ddb30cb2c4ec_JaffaCakes118.html
Size

58KB
MD5

70734eb41b69f5ed95d3ddb30cb2c4ec
SHA1

f53be021bc922d348b70204da6c3c6972d67c9eb
SHA256

cf3d25e68a8c9e0e3290eb07f646fe90684ca4a2cb3819d67e90d4acb59709c0
SHA512

f38e2493d91ce2c8fddf5bbd8b2b2724f2a11c061febef68d7b48f1fc32332a197a0df6f38abba3a03083f8ec5be4d74cd9bdf7fd24ab7707abed9b65300083f
SSDEEP

1536:IUDbYzVEqljI+Z2GrZiXfSLYfMsO8+Wv/jU/UK/UNBY+kaaE3T2vXXL3W7gxCIdE:jYzVEqlbiXfcWMsO8+WvbUsKsNW+kaa2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422762765"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE8ED381-1A36-11EF-8E7B-D20227E6D795} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
1156	IEXPLORE.EXE
1156	IEXPLORE.EXE
1156	IEXPLORE.EXE
1156	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1156	2228	iexplore.exe	28
PID 2228 wrote to memory of 1156	2228	iexplore.exe	28
PID 2228 wrote to memory of 1156	2228	iexplore.exe	28
PID 2228 wrote to memory of 1156	2228	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\70734eb41b69f5ed95d3ddb30cb2c4ec_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f4fea33eec1e431d958a204b107981f

SHA1
6ac5f1c421e8812bd89014f8247b682319328aed

SHA256
3b72e7ece4650cfc16ce74fe74e2b8fc781a95e22a01ef2304b2d963f05f71e2

SHA512
4e8822ae998ea8fdb1bfad12686edf0fea66b13eb26972ea2cb26c7c356e2d70746b79e24f7a042d8081ead437f3e9e88b345eb340c1066f78c29f76e6e33da6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7cff83c7de8d18b13e79cd9f813b443

SHA1
83bce41303869468d4fa7376291ba6411f4d328c

SHA256
7aa9037f80793de3de1368be7cc2c67eba612084291b846e9b38333e60423c26

SHA512
5707fa40b1022add084cf93489e07b550997860aa79bd547b68a771aba31bfa82b965d778f10c9a41e959232a82f9a5221f618cd57e6d0a96e299a00580c82f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76333f9abb7e2aaa1e492024807c3cfe

SHA1
d86403dc73f188395c74e7914c974f865b9ac3ea

SHA256
842aff125927a330d5c027fe1e91a31e2a20d99942efd97ce8269205090c8abf

SHA512
7911d204da482785346e7c7ef04e1265220cfcdfe1e237383d302687be3fca1e79c32576c6e14be44515a8077da9c3b73ad44f70264e797499059f3969058393

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6074886276c92b60798bf888cbc5c6e

SHA1
0c728a8e3cd83b71db314f2e85dcc715711f863a

SHA256
cc5a02615f7f45298f76c6f2398437bb2afab9a9ad724994a541a4b9c2855715

SHA512
cfae3bcb66357fb92eac8d8971cc6b60550a8d7c067e0b8fb2b413fbdcc5201260a0f591c426714fa0cc65149f49e0955f360a6298788cf1fbb0f18787974384

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7995f8d3be59a6de6f4c083cb55e51e0

SHA1
1f39892133929925b2db54987380a67a009adf02

SHA256
5d2402ebbd6b6a9fa5ea68aa9ff6a2dc284baad678c2fc01b34db23513123270

SHA512
3f6437f4872a4888a9a30506f471fc966fdd5c9263f5ea48ce6f88758e90d7a75beb3906ceec8d414d8e62009846f98bc8b87b76310732ab557000f256e6ce82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20f83c669f33d297d4d6e63a3af5b58e

SHA1
9e139571d36d025ec526f22d19e8b6453adbed26

SHA256
125c1f94e6cea4d37bf7797e3b9c82f0ef0cb3068e07631e56c690a46034415e

SHA512
c265de16fd8b45c5cab167ce85398de9ff32b9f618d3465f732584c305d22e1e5792b207fcb7948aa8638dfc6f7091c742b395f427a6764f69618755f435756c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e7e477111d047aea6319b471c6b48e4

SHA1
70bd673a035502d603dbb60faf89f0429d155ae3

SHA256
a7a82bdd36ffd5d6e751f5a520039aefad7e014b2fbbbd5cdac0cd31506fbb7e

SHA512
28785441f02a229cd81f84e697774c7b4418e2be09a9b5aebfe0a69ad8fc01f4d954f306e7d4fe2420606c4fe4d831aee63cba054a593b0050f40cf1fd31199c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6dec451422656220778d1364747f60f

SHA1
7a0f41fa599d1dbd8e18bbe2ebd18a35de16b422

SHA256
66e9e7864aa6c77a1b0c39d9314a295f1cbb32525277b3e1ff6345fa75d0c450

SHA512
2b4a5464245494eedb79932f5185883f6ec311524f036053e2da869f9b6b24351cd4ce38bd1a52016936866e5ee31882cb336149f3bdc25b63309e9f29be666d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5839dee9cdfc31c47029aa45b80cfca0

SHA1
49b09ccfb4b84df917444a6139db1742dd4adc4c

SHA256
568dbf800c65c921ded00cbf22e9509017e667084c01d5a80074e18a39f1c34c

SHA512
ad8a3e6cc60ff3e80b43fe74c9e3cea9e2e1d24ad1455079a2b16b4c4871cd160b5cc4e2b30ed6798637f610a3d07190a31f4e3ed7028344f83b48bcc7448fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1507.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar15EA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit