420740b87a2177ad69263f7d3f7adbe4cdda9b187e70ba5bd324790013a59ee5

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

708fdb2b34f5be0ad9ca5e00bb5eebfa_JaffaCakes118.html
Size

27KB
MD5

708fdb2b34f5be0ad9ca5e00bb5eebfa
SHA1

be5a24512e9b547fce958b416838f39eeeb7cff6
SHA256

420740b87a2177ad69263f7d3f7adbe4cdda9b187e70ba5bd324790013a59ee5
SHA512

17e6a22360c3ccb5ce550e0028ec7e6dbdecd37518386f169f924060bbee0e8ed63a0c58bfbca132e24c50b5409ffd0067e49edbaca201f7067739b845390e11
SSDEEP

192:uwTsb5nH6nQjxn5Q/HunQielNnOnQOkEntRYInQTbndnQ9edFm607nBQl7MBFqno:+Q/sEfAnoSbkc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D7510F1-1A3D-11EF-B671-4AE872E97954} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422765556"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2460	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2460	iexplore.exe
2460	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2984	2460	iexplore.exe	28
PID 2460 wrote to memory of 2984	2460	iexplore.exe	28
PID 2460 wrote to memory of 2984	2460	iexplore.exe	28
PID 2460 wrote to memory of 2984	2460	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\708fdb2b34f5be0ad9ca5e00bb5eebfa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1740ce63d5fc6aa30c6947b529a37398

SHA1
03337deb2ffca696964997fa2b9bcf39b62d665d

SHA256
36e5d98df6f43a46c1aa44bb223115eb5096c1b71abe319cf9e4334fe726a771

SHA512
2ffdc8b8f3a73270cede5e9e2cb64b0ad9a2ee057374c9bd5c56aaff385570a300cf1ddc1e405653b869f0fd124e8c866a57e96ee755d52afe7f4fd16b1d9a11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00e04bc96e4b215f1b4bd6c7fdae3243

SHA1
3638ac6359382574596d4a4ec2167cc12633a996

SHA256
2f67b5075dd8c04941fe9dda476fda8480720d3a5790a43f04693f16eb5abba7

SHA512
e31f03a1b467f3387ec8343da1cb8e34bc2e0e3902de90e505d7a69941fe6114971b4300db441db701090047f616b71874925b57db824a8ff495b05e35e2bc3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61dc1a80fcde0636000afed1ed6cfc0c

SHA1
afd5788758b2f7d6831820bae3aaffb0f9302508

SHA256
9507f658753151c2c72160b951d2afdff7f4614659147295872414173d8e6342

SHA512
8026b7da72e1ce4f07d726f9d63f65bd9283fc6377b9e59f814ea362beb90f5fff5922c16188edf31424f8e6abb443f75c7faa2e1643489cf472e7eae1f7cb18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7b02937dd5fa50624be29d85b04ee72

SHA1
677427173af9e868f37cfd2454f8ac0e1245f211

SHA256
4f7836a08c6a6f39349bcbd5444ad0ab1d18cc2a129baaf6f575d4ee4b3ad507

SHA512
f1e50481c88fe8203dee72a93ba3f3028f6bcf3cbb3bbb25c3655b03fb4a0707a27d7dc4491b49471f03f0ae3e23e3b4b9b6a8896d8f9e10cddd7c8c7785fa56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd43f33b30a1cbbbc1c7ce4493c4c037

SHA1
98d8352d1aa3abb544a60462c4253d63663d2864

SHA256
66e62a49ec7413d32098bef90aa02332b018fc45f299f40757aaa5dff79499c4

SHA512
eafc8e4775c82192677576e33c177ede691dc0e61bd9a3eb517fe802c5ae39ed62dcd325c7f2866ddce6d9451f94a31b8e1d99d543a676b3810166b2faacc8cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9f02e3521d8d8ffbb661125a11533e4

SHA1
1e6444e9dd7a8fa965516fad280de597fbd7959b

SHA256
7a242156274b690cd8731c10c6cd78c84aee572164c9332b5c5be851e59c4ab7

SHA512
1d5260ec50119522aa9588373b696e2a322378c5ebcd082853002ae91833272b17e2b6f1eb31e17b77e30ab968a1a41f48410a8b94844dfc025146969b5c9453

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60c2dcdc4e06cafa6b3696d5fd5232e7

SHA1
512768474bcbd949482131117d26e2f52b029774

SHA256
12c803eb2a37e413a55377ca3de5e7aaf43b73d2c5636a545ddf21c158f657b5

SHA512
657fa6031a89891ba5b5a80bb9686cfb01d692e3881d83c6a8a2372e5a79b3e934664cca46c91ec5c946fbed8d7b8f0ed4805c32e93788fc764820743ec52b71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
866dc3964bb0ef4f4e6a1ea74f417018

SHA1
6a709c8d49ad5df9204fed047548567dfdf64957

SHA256
9ff45ff7579e01cf7e876545d87bd61a63dbc993146b6fff7e01194d4a32ea55

SHA512
21374926407dd25db8dbc75463851c394a69d0d6a22df583c25e42a47ae8ac7fd46940a9a3ecb528c5633d830671ca6677e462fdc22d3c882cedd6ec8a90221b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e319cfae2bca7409fa02891d11f4164

SHA1
600a44223d7091f2bf46d1561346101704d051cc

SHA256
5c11826ee6543764d7bbf042a9371e189a54d9fcd5b4337f0fb92bc496bf5785

SHA512
bbccd0d3ccc10e5672e51f1cc4923fd4d4807aadcdf6162124c590a87e726501496f6c2107d86427dd9d30869a792f339562c089111889d16df6f6330f0e32de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab90CC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab91C8.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar91FC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit