6b055d9a8c4a1dc49df401bf22377b8d24db06865825bec14d4feba9a6350543

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

747966cc2e1b4cec1111559ac3c08314_JaffaCakes118.html
Size

23KB
MD5

747966cc2e1b4cec1111559ac3c08314
SHA1

31d10ad232568295ce504357ad09989b0b102127
SHA256

6b055d9a8c4a1dc49df401bf22377b8d24db06865825bec14d4feba9a6350543
SHA512

9fcce9da09ed283078230e9fdbfb694c58d8e7502a811567736ff3b5bddf5025c7a435dbdd803492d05934832524a9d91b0dd6c3bbd404041a091a6ac045e3b9
SSDEEP

192:NMLoJycb5nPnQjLntQ/YnQieancnQOkrnt+5nQTbnonQpanQtvMenFnQ7Xn+nQT3:qLoM3Q/JR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B714F71-1B21-11EF-A538-5630532AF2EE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422863425"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 3060	2148	iexplore.exe	28
PID 2148 wrote to memory of 3060	2148	iexplore.exe	28
PID 2148 wrote to memory of 3060	2148	iexplore.exe	28
PID 2148 wrote to memory of 3060	2148	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\747966cc2e1b4cec1111559ac3c08314_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2c84c26bc8644d9ae7cb7eabd7072b3

SHA1
bc384ee5a9b8cc28b04f5f5efb90a73dff3fd3c5

SHA256
91708220faf89c9c722782e65c6bd96caf88a52304ce11034ad9486393ab9eb0

SHA512
7e1b350c2b8835330553599fbae5c6638cdc99b9e2959b54c33eaa997b1bbb30d466fbdfc0a61f505bb84ed92cdcee746016b5f454a29a62e7da36557175abc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c68a52a775d72308f8b7c2b4d9f1827

SHA1
08dad10da17d435c57c1ae517b61735f6f3a2560

SHA256
53f76ca757deea3786d8b1d9bda0a06a89da9830b337e861f130943207491843

SHA512
bc7b564e5572baa9911663e72095915b953dafbff88b43e1b2c9e5a138c7a25efa8f9e635dd32c8d013d8483b6e2618b15575fb11216f62b898b862004987660

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00997beccd26c6eca32c130e7ff6ae00

SHA1
de7113184be68d2add50b71252da673af3aa8cf3

SHA256
fba0a78392dd6b11f54156181fbdb7f9dfb9a9f5fda0844c2514e679900c5d24

SHA512
7ee34ba6c493056b850c6c8f0082c9afd1e335c3392dce39834b41c9f3225f9fceea2098f065d8ad0c57be1ffb88ab41e4b0243dbb3ca979ed2e7f7cfc448023

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e643fd4a0eba4d1d2a1ea002cb28e3be

SHA1
46757472325291c29ba4aff5286ebb60c2765531

SHA256
40dcfeb54d9086ea52fcd8415a9c5157596b47aefa6335b81e523be38c575b05

SHA512
71076c9e17fc1b1553cc133304191b78948ff3aec606da5e2826bb5cd36ca4725c2825e9554bb95c455498bc71fe007cea59392b9aeb69e1d716bc40e0c1eaa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1527657bf89000f5dbeb921ab685a30

SHA1
ffc6e522fea2a6cb0f160754505b3cdbce13f2ec

SHA256
9c5a69d1474bb2cf056f7e44031ab63516b068cac9629f7266e5dfc5361ef1e9

SHA512
97d47d4592218f4b6057c0d1bdc7423e5b2505948f0be1d906e793020503d92e89bbcf066b03404b38ddfa93b6bab09678b8817305950c31eaf48611ea85e742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2c7d2d60a619729622723caef27d5f7

SHA1
2f5e6e7ace94562650873caba9e1f54f9ba87739

SHA256
099ff1a64655187e3bfcc7a9c967b95dbfff0d9137d4d42b48a027ab627441bb

SHA512
820a4010813e76ecc6a7a092d93216554c7ceea2dbd4fc9df08e76b70a2220be14f6304d5596c328c50351a7020c0ae8a86fa23915d997326a1d5ce7bad3d4bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cbea81b993359373045c60a5260da4f

SHA1
33424fca56a6695c1630dbd3c82dc9c10ebcca21

SHA256
ab66d4b56d756ebffb9f3b38f503ae39e9a78f311d15cb72d7ec35a7b573ae41

SHA512
8093fe7bd2e152189002b4a66912bf45e1822024321371bbe527e808e1c09b106582114e594f87dc3116eb9f1ff4cb50294c83c10b80988d8632551045677e29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7da05957cc3b6b65e3b337fadf72f4b

SHA1
b8fb9c5636d947dd2d72536e72c03a08b11436af

SHA256
9639238704e87a806fc32068041c8127bf3d1ac9f157c53aa1c92c0637f8bd27

SHA512
37af09f5fb65acfb9a3944b3e0c234550e60d68c65ec86934ebbcffb54fce59e3db5466e676262f013ae6d26afcd75e2de28181685dd2f6ee35600e49634d0f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e53097677777ce024b90a937122a8a79

SHA1
e5791e058ef66dfc999b04625a4603d44a914670

SHA256
d791bcfd9c92f84c1c5aec6b9df307c723dc9ff6a738bdcd08f82401b2330891

SHA512
1a4ee63be5fd22b0c0b5b9be16c4228b498d4ffa9461dc88d8f0b36577b226fb610cd16b57d51dde16990c2d7d64e9ce7bd1461ef898c7707dd64d70f9d0cc8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE45.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEA6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit