beaadebb0c2b85a81d6fbf755ec4934585613c48c32e94e241e27e28667071ea

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 06:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

748922eab9ad15305e587fcd24ebae11_JaffaCakes118.html
Size

71KB
MD5

748922eab9ad15305e587fcd24ebae11
SHA1

55dd2e148753786f4a54b911407e048066d0155f
SHA256

beaadebb0c2b85a81d6fbf755ec4934585613c48c32e94e241e27e28667071ea
SHA512

bd3b65051f869b84e92318975e84bd3c4749409fba7ffba538d6e3be5350c59dc67f69bbec51615a4846a3d8cb3910f71c83adc31f25b495a518bc9ec8573c2e
SSDEEP

1536:WLbvGfC1A/rGrpAJ9DxtlxJoybmvtNYtyOyZVO+rP/Hv7nj7pGmAhiBtbvDgJiDL:WLbvGfC1A/rGrpAJ9DxtlxJoybmvtNYi

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A68700A1-1B25-11EF-8F47-7A4B76010719} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422865267"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1744	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1744	iexplore.exe
1744	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2996	1744	iexplore.exe	28
PID 1744 wrote to memory of 2996	1744	iexplore.exe	28
PID 1744 wrote to memory of 2996	1744	iexplore.exe	28
PID 1744 wrote to memory of 2996	1744	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\748922eab9ad15305e587fcd24ebae11_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2024d440e6d289a0916b6f6be7c4347

SHA1
fc4203b827332daabc115f5dc2597efc2f7cf084

SHA256
0053dbb3c97cb4642efbf1858f57f088eea15b76c61cb5ee3bfee2334dc82233

SHA512
a9e4e99195fba6419c78b3599015cdd9fa17358ef43422ee98157d826394cd6c11857f7713cef47873ae980b145bba445933343b7bc9377f7d47eab4b9654d2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b386b9f3214bfe82cc8e364a0780366c

SHA1
315828e51fda58e167c51bf500493a783e9441be

SHA256
a0354952c2a1e82bf30b241d1f29333d2055ff666cdb3da63c13b6f201030a6a

SHA512
02d053a3ee69e83d57c59ce20f64601189d84f070ea63fc40fe4988db83b80f469d7fc52012d6742976705370b642ecb11810bfddbb1f2d6f9d54f4da9809b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac3369e65bd8a01ed8f0ae049c869162

SHA1
7e694a679b7754b171006e24d16b5d6b2574594c

SHA256
1aee8bd9b4f3b0297357059aeff4cf461f37f3b65b50b182ad53c87bbdec322a

SHA512
c63babb8c7ceabbc2296cc6202dd777dee73a0a63ed7fa1a241b216ac66994f9573f1ea098d3447bf51011e3ad3d638eac049ec157b8be0c448bc693181dc895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
322688b45189afd1a5a174e38eb1dbc8

SHA1
8fc26838e8120446d0c1ce3e8ce98c72c4b50e4a

SHA256
155da1142348248aded00dbb93fe6d8d61416896bc0f466eef06ddc85cb30847

SHA512
e597a0e5c79aa392b04f77493c68085dd3ac4f01db281317b00dc253658fc0c7a10c42d84c2cf5ffcf9d9470c4d2f8b84331d7a8fb6bb99928d3f9e674de5806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2923a7ad2cdcd29c338e40cc85be44a9

SHA1
e62bad743963ce340a5d1977dc8ee1ec02eb01a9

SHA256
cc9afc1c09713716e3ed7a3a3f1a69901a70f9403be949987dec4f2b1c63be9e

SHA512
aa8e6b4770ff67a5388a304ed8b16ba11f77a1b7ed28458c267eea8604edebc44330b06e8c6351e2e7a52fc66f0c5ce545b52575a64650aa1a77cfb4ab5e9ee4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb702420004ee20f4009eb623d4cd989

SHA1
50ff5b76930aa5603739c44e14872c9db42dc18a

SHA256
05f47e18e9b267c36852f451038fa4506f61e0ae638065c76b3202bab4069a5d

SHA512
7d672c46183c8aeefc0590fad8a1740de6cfe95ea93393ce7605100dc9469e52a0add8e1a874ae5231abc2265d0747445ec90a359785f650ac54c7ec00e1333b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
759c35db8602ecacc0056d89794d14d4

SHA1
8e9891c5cb450ca459df3c1e5e56d092c4fd906b

SHA256
3ad2a40338ffaa6f8b2e490c194b48e765da7387b74f58f1d704b7c0441cb31e

SHA512
7315593ea450e1f7fb0dee0d2d8162ac3ffff2c54e36d9ccca7bf4b1790d84e0f213d4f2ee3f52d52f7364f3a2aa6b41662aec4d775389376ef32153114ad12a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47d83856d7dc9436b499feae848f62b0

SHA1
e4c3c3b0c6d3150d7652b54a48fc61eb5b83512d

SHA256
918b7481b36376a58d37d88909135215572c7f722044e59b88b77c19501e381c

SHA512
7cea6a23f8163c0d7a969d499fbf0adb0d7d8938b0c13e4932eeba60fd0218fef458406cb244429c1aac85308590e7f7ee07a9aca9a1642433606da3a8cbe1fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A85.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1AD6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit