39a3f6284cb326dd7901dc3766faa44b79088ad74f451e544d5321b332622de0

Analysis

max time kernel
148s
max time network
137s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

825930a901828d4743b00a407c505887_JaffaCakes118.html
Size

18KB
MD5

825930a901828d4743b00a407c505887
SHA1

f9ee297a015b19cb98ff074f37b3e1a74b824b9c
SHA256

39a3f6284cb326dd7901dc3766faa44b79088ad74f451e544d5321b332622de0
SHA512

b1c7fd65a207c07ffa4431dd8df0f70f60da4b211adae20d95b038b001383475ba5fe7d8dec30b77549110ba650896695ed8cdc3278cca089d1ab3ee65539f2d
SSDEEP

384:SIMd0I5nvH5SOyKKQAAoSRmnssvP0XVxDB8:SEIRA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423187457"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CEB98F71-1E13-11EF-8004-DAAF2542C58D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2096	2256	iexplore.exe	28
PID 2256 wrote to memory of 2096	2256	iexplore.exe	28
PID 2256 wrote to memory of 2096	2256	iexplore.exe	28
PID 2256 wrote to memory of 2096	2256	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\825930a901828d4743b00a407c505887_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
883282d5d6bbb3888c6bb67fb9beaded

SHA1
f6c708ab35377273a7dfe67ddb92f27aef3db036

SHA256
fe50a154ec785751a349d617b22cfe275c90c078ed8aca559fce9b3e015b6125

SHA512
46d82e6c6c4d963411c65ddf1742a0b609ef82a8ba94f713e4ca57864c30428855acbfee41ff0c36ba9d44fe5a203cfddee5795683647280c8735dda3e650912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e69af74330909b4f65facff807a8daa

SHA1
373527f85691d631f3456eb8c1a61fac266199f2

SHA256
d267b99b395b2bd30efb166bc588f67c9c12fe02f3855abb2723c6c68b3ee7c7

SHA512
445a9800a2bbf70219271a4936665ae9571612529050c7a0b93dbd2ece10bf14713d59959c2b71c4777940bc5cda4e6fa66b4cffffa70051028ae7e992402999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4087bf9c570eb0f665f188e69ecc55d

SHA1
26037cc25b2b9ef57f7b51919ccddd4d43392215

SHA256
dad096a841af3ffbb47ea2eb65417d502a93b1132c73021c5dc291c0f0645ae6

SHA512
e7ebc35ab64cdfd6bd059cfb3e2f38732e14b977429bb5b02bbbe3af1b784c76f5dc494e09e98d3e8e524cfea3232a83350ca32e4e10fbfb7763f735c4f2fd68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b34055ea41c8efefc00a11e06d5303f0

SHA1
a7241c07e24e984bd6f7e14bcd86ee85f1c6e0bf

SHA256
5f8c7388e7403e030707f3de168359fd848e5df28fc9959bd5c91cade4c6bf0d

SHA512
59c003d07c081b47b253df1392a9343d8a55b9999a9ff3796c592c4c0a6ea61ff1403f054717231da2b32adc9fc81b2cde8437e0c9716b95c7ff5ed2fb7a0a15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4309d94e0c29d6b3bc49bd69b57f41d9

SHA1
2128960b3cdae2552cc81aa735df25267bad0de4

SHA256
408a2824f7e36ff431d63accf7bc0966c4e4ec97e100f37651df8425b03abf38

SHA512
aaeb14bccf072c043a6a3051ad8bf18ebef68b15f6e7671a8a9db684877eda1acdd18464e40b25e35e5558d302b17ad2d76c497ff0db3aaca29eb018258717d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91d2906ba98a61cff3828275670dcad6

SHA1
a5bd32b61b18b24e088ac52c4bb7d0a26348da23

SHA256
f71cefea13b5d69191052508467d60eee4f49cef6ac397c3ed1323f34e11d1b6

SHA512
bb17c3fa927bda2af8089965026ba294679ae0f1b68e7ffbf1ec1833e7aa6afa8350a158e64d622b9f3780fc09b92a753824c405d81fe74e9c78d348e8907e39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5b5d4041b27ff1e337356dc651dff27

SHA1
d640e85a43784645a95b50a77a2207d9dbecad8f

SHA256
906a511ce79d8a19b27f5cb8d7f1e62ceb2d0a8fdf1f3838347602dda43a51fc

SHA512
e9402eb376e3b453b8fa34479cf5e32d1b0303a717e12fcdc450990966e79b43993f8c3bc362922b1fd3f8fbf093dc0deaa48105088fa49aceff2400e0b70b3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e25a044a77eff4c6ba3df50b2a5d044

SHA1
8ce21fc3a2f8dd8391dd6e8cc51c5ecf3622602f

SHA256
b071e2263086a78c08b244fcd07f86a34e5fb7ac28882ee848e5a3500ca0cd71

SHA512
7b988d452542a619df44b3e8da0dfec038f946993b39d9dc3f73cdfcafc0e948c09c4b37b4e7d825e35fc176084f65acc27baa5bc6cbfae53b263f302786d084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8fac59476994fc5adfbcd3327afda72

SHA1
a3788e90e3310fde81b3bd279bea67c728ba8d0b

SHA256
3b5a80206fd135bd42c67b45410e4827c48b868245db05f7d3c5670385ee975f

SHA512
59e75903fd10dfbfb7fb50f0c779977796195b3eacf6fea44595c0a62eba5177b4f85b46c97598ed4b03bf8782cbe842a315f5af32382325b9718abbbeded53c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
888d4b7183e15affd359330948edcc48

SHA1
e7d0b361b26c48c7b228e4f9e4307317197d4e2a

SHA256
417b463e8f45e7df8768cf899474a503193c040416f83022f2efcdaeaea477b1

SHA512
6a6e1549507c41fc71ac59cb99030a1c3613b00896077459a4153ffffc98f9ad2134c7b6012469b37570ad3f558927624f996ff2bcccbb0893258888fc1a075f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCFE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDB0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit