787b9ccc3c2887244b70acd8df69272f384bddefff915060f185f66664212049

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8341fdd7806d9ba222aea6b7bc6042b1_JaffaCakes118.html
Size

18KB
MD5

8341fdd7806d9ba222aea6b7bc6042b1
SHA1

7e1d2d5133d7d820af8f6faf663c5d102c49a7c7
SHA256

787b9ccc3c2887244b70acd8df69272f384bddefff915060f185f66664212049
SHA512

f226ed142a74b7766f098be4c4ec09b614acb9e48bedac636c5a8f5bce5cef1459683541559f1027b1045877a7d2d1511c8d5938be5845464bc5276c963234e2
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI/QEUyO4Am22Mutk7/zUnjBh4/w582qDB8:SIMd0I5nO9H3svclxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423211332"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{654F6811-1E4B-11EF-8E23-7EEA931DE775} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2872	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2872	iexplore.exe
2872	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2796	2872	iexplore.exe	28
PID 2872 wrote to memory of 2796	2872	iexplore.exe	28
PID 2872 wrote to memory of 2796	2872	iexplore.exe	28
PID 2872 wrote to memory of 2796	2872	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8341fdd7806d9ba222aea6b7bc6042b1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b48252878ac0e9e721aa2d73f3bdc6cd

SHA1
16da55fba2bdaca95896467820f0555922d490fb

SHA256
11088ad2e4be75d802eb7886c79a76a78f2c1c8d4ab4dd071790d0a60b131df5

SHA512
7bc2093326607fd71efdc22da3eb75d8e62c3a2005e56c878a735575185ffa38ee94d70ada7cb3d1bd0d00923ab0e572e88984b8e29ede79a271486e99c81983

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2972cf88aa2d2474b4eaa837e934f8b

SHA1
d6961c6ce6d88499ca60318179e641ac45502aa4

SHA256
72d231563276200558f1f22dfe1321c606ab8a90c38a135920ef7689bac22a8b

SHA512
f0023840e0b67813ec6517adff844fb55bc489a1ea2d3d7c9961e6dd10bcb91dddeb779c319dbc5682bbb2ce2187c0fa1338cf6c766893268507f11ed6f20a97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcab936de0aae59b77495dab7d16bd25

SHA1
572e9f71ba5fedd1e8e3c30bc2b5ee812468aa63

SHA256
79cd4490f07a29c9e71e27013a7e4c6d611c5c729fd8ccc27d5e40b16bd6c393

SHA512
c1c91f551a786839a7b2abea11630aa9e3c6033859d28ae45e78926bf63e4f3dee2db5d91a4d3bd1aec5dde2f8ceab143e655b3f7d183c7d5819bb018ffeb9cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae9746d4760a37e77da0adcd97fafab8

SHA1
0112a9604e456d32915a9464c5e83065e8f02763

SHA256
d5b05d36c883cfc394ba029bc639146501d98f6af15b0b662c6405787f08bf25

SHA512
cfb8a1f1623ed8fa2247ff22ab10b5362b73a704cfadfa17f4e89e485001a70b8fe7411f7a112b1a5fca67801e300e768da4a06369250b082d61e8851bf090d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd6c435c375570c45011f59dbc87c623

SHA1
d1aa8a6cd9c9558ab2170de993448c874debd407

SHA256
1c94da5a1eea752e0fad84c55abdc19b3e2a4b791ae9f6ac58ea862f7db4ac88

SHA512
f8683c7ca96c92d5aab8c7e6b2009ce12b9e2fcc71ccce26b3b90e1dd2224cec915a2a2a23940a5977128ea4b7f568819336060c10c46ab8a21c1b85aebfdc4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
042fe08f465b798a54e0fc9b848a4903

SHA1
74d47c3dcc690402ee65beaf27184fa41f27113f

SHA256
e1a91fe99395a0f016caa0e800ff4ded2fa1d5174ad189b174ed19a794c6e745

SHA512
35538360734dc1e84ad1b0b3f5cd2b303bd050292bcfc6bb72c8b9bfbdeffcffd90b5b73c7b2e362b1eadd0483c60ed37ea6b3b55f0bac103d1de7bf9d6f508e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00dd84b280678055533c00be7f416094

SHA1
5192b23b1d6140f8c7e6b5e1f209a0ad8d9ddada

SHA256
59850a11861b12eed50ca9f46fcbf5ef02328865386e0f5249f42ffbe1a510c8

SHA512
73bfc5815d7019483ca8d9f826ceead22e2db62127a1b933bb5d6a98a8955f34147bb694f88816c28b4874db221990f4e665e3aff29c23f67c62339e56bcb384

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38fb57a959c743385b8d1a1f4592369d

SHA1
10608d03103e8f2704d0180cb7e63c18b56a1425

SHA256
f04cfa2d87f52146de696a2b5fecaa8205d74446fb82075ecc3317f361e22610

SHA512
80896ae4771ffed2e201cfb6bfd8276528ca70d52b7527335b8bbc00350484b2f0703c7b4f018792e9db7b0327a1146c413933d2faaa543accd96087fe972aec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c71d10ab8420c5aab6854a840a062aa2

SHA1
5f7fe82b70a72de3d299771dc8aada3e3c1c909b

SHA256
7b70aaf3347a017921b24e7b46dd82ee4e7a5169d43bf2bba15a3333bedfef51

SHA512
e7e86fbec38a28ebda68389230da889d3b0c6b496636e34fd26490aa35772ec8e91edf403155a612471bf1b9551065b73b7b6cf6f32466230c8ce30f106c2c56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1AF0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BE3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit