9fdf5bb5949194d125a16e6d8921173dc22dd8f303b14a7cf06eea5ef8b44b94

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

718087267753bd70f0f4b7d2904961d0_JaffaCakes118.html
Size

25KB
MD5

718087267753bd70f0f4b7d2904961d0
SHA1

6f140a27bb516583548dd2568988075cf5120b84
SHA256

9fdf5bb5949194d125a16e6d8921173dc22dd8f303b14a7cf06eea5ef8b44b94
SHA512

22af915539cc97bcfca37dbc9d967259a7547126b6d469a75516ae4dd8e5067aa1e225d9de140eeaec25bdf9c99a49ae49e37a23ced6db453528d127b9dc679f
SSDEEP

192:Notofxmb5n8lnQjLntQ/6nQieMnAnQOkrnt0rnQTbnQnQlMCMA0pdEOwuXMonFn9:Wto5rqQ/DMaJxz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B620FE1-1A77-11EF-8C93-DEECE6B0C1A4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422790327"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 3024	2976	iexplore.exe	28
PID 2976 wrote to memory of 3024	2976	iexplore.exe	28
PID 2976 wrote to memory of 3024	2976	iexplore.exe	28
PID 2976 wrote to memory of 3024	2976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\718087267753bd70f0f4b7d2904961d0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f40ef6098e36c0946e959f8e3b4d42a3

SHA1
378e9cf9e8f55ca92e3ed64ce9558a554cf519a2

SHA256
f58521fda1edac9002fb9ec336aa38d6dbb9ddb1113668fc9903989fa36606a5

SHA512
d265250f7b4981eed02c12bc39fa3a5462c19ed5a17b6626c22c0518088cfb09c6cb31b150dd840d6cd5080964498a9a02f8c3fb8df935464bcadca5e60e546f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6843b0b51b7297412d6761b68dcbe274

SHA1
5c2487fa23ce9e78d5ecd9b3a1632b3256449f71

SHA256
6b1afed7b0954b49a608b860a20f4a9cbcac869cbfb9cd5a22ebc3d6471357be

SHA512
60b6dc6a2fb3f916338329e4c7c56deed941adb6c70c8a6de0a6b989fd95f9a092643072d4457f2a339005093e1d7db5b7788608dd85de3b183fd66b50e86b29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc3175655838034fd42a4292da561075

SHA1
7005f770627a6a389305e0af7d9b82f2b43d7ef5

SHA256
aabad6594132d4ab5152f279ff6db87f568b4764cb8214cb5fb0ca1cf502307c

SHA512
662cf8c672d12970b2e464fae0e8a32dfde9dcd55abd9ca99049fb1cd4bddd7fa68479a418900f8dbff6bd2c38847098295f336b31fbf90393141fb136fe5c8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6425236791a4fcc825660ad5accbff63

SHA1
e5f475f53e60986147198619a2953f395fb10e7c

SHA256
815ef4205d25665be0229943a495865a7403ed61855de365ac73e1b649db5142

SHA512
5020c43f791bf9161564d3268275cf8f8b11b0cde5c4e920ccea5382877d8e309bcb5150ac5443b6f3f15eeab5d04977e9ef395e8a094d12bd0e6aa18fb7cc4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e87b32474fe22dcf4173c5d06fd3f64

SHA1
43173a958218a1fd5b119e2028db84518959ff2d

SHA256
ca03c191d6fc57cfae74ca06638897f7e3212a0a665a3fd447ed9b1fc5e562f0

SHA512
06db5b2993401902ac9517e869956ee9a617fb8770177384f34e0e869082177947b6aaf9f425a10c8c076637973a511450de9797b4be12bcfdba4cca0c35b89a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b417f4e7787533548ccf04907c341aa0

SHA1
97903ea5100642aa34d98dcdc94d8139a76a94ad

SHA256
3b7737012366cc976d7c3806d841c30fb237289e891b7d460c6eac69083ff8c5

SHA512
8790c78f96376360134a1a0af0e87504eeda903238a63eac4fe3fe3562afba45736aa8d3a96482a3231b045e6d2df9555d91e1ac59ba25ce550677a96fa3d21b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fd34f568d135a9050d4919e57440271

SHA1
9642499fec53b04c4c29d01ee0ff92b397b5697d

SHA256
a9a69749cb5b515af2d875bbdff4f024e3db1131d517284f2902322a910b7b87

SHA512
19f51282996537683ac6b69e05112561f1ea39af7ef53decde7df5f25869b7259962338edb455d72a44c00d890f58aa1c5c37d1510100a443497445cd0f483e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1de7294e4d3530d5f3f84405a60e174f

SHA1
3f1121bc05dc60d8bfcc5f5db36cbce8840ca377

SHA256
eead7a4f70f0e280a9c4f33a327b498ac7147a6ed34d83f199abc0b245941dee

SHA512
8981bff839bc990863e6fe055ae1d152fdf8b7bb686a799d0d5c0b850d98923b190a711e843abd9bf74314b2dd0b783a490126092f33ea5882269923ee965478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0229a9cf70a52716b302df435c27bed

SHA1
674327609620786615bfe289b3b99ef765d9861a

SHA256
e0e9ec0d998aa04c2eb96361c6915bfe0db6ad92151fe99618c4c4ec2dd832e0

SHA512
816974da94625dd7f384b8b1d39e4e81dd872451a0270dcaeb7c585c98c873899d67f0e35158b936a2bfb66de3cabc35533cbad94109a82bf165d3dbe699846b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24D1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2532.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit