23503fd63bbecbfb18efe9804d827b1a8276c6b7934b56004477eec57775cec3

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

958c1b90039212d843a50ffc7029c5c2_JaffaCakes118.html
Size

19KB
MD5

958c1b90039212d843a50ffc7029c5c2
SHA1

a52a9fe25ad07fcc6927accd517840215178f163
SHA256

23503fd63bbecbfb18efe9804d827b1a8276c6b7934b56004477eec57775cec3
SHA512

b3b5213b62bed121dfdfdb78f4df1f3d932195b743816536a6d5a02c4fbac965f573d636126c8cb2c29dd1cdd3370b546acaca6fa2247b48648cd4e2987e0831
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIH4RzUnjBhzV82qDB8:SIMd0I5nvHFsvzuxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423680941"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA1FF631-2290-11EF-A233-7678A7DAE141} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1216	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1216	iexplore.exe
1216	iexplore.exe
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 2020	1216	iexplore.exe	28
PID 1216 wrote to memory of 2020	1216	iexplore.exe	28
PID 1216 wrote to memory of 2020	1216	iexplore.exe	28
PID 1216 wrote to memory of 2020	1216	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\958c1b90039212d843a50ffc7029c5c2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1216 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
537b875f132fa62ab9747c04bc1b23d0

SHA1
0281c1c319516fbd0f52e6d6a20aeb23568e433f

SHA256
aca4d4dd8cfe249f8ec7343e27e1b9caae01bd7e8a12b2499d14850a17c4ad24

SHA512
dfa693d5de07643ab2373d76d48785f690964c40afd67f9b440b6658f8d55b84afbf0a2ad67b4ec4b1bb2dcc3bd2464ac99f56009f610a2823cfd9a859455ee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9fa4e8aaf00214b23f83ac9b617d968

SHA1
65fac9cfb033c3fe942b624faabd3e81edfabc77

SHA256
5e011950d279c30947f377533f1df48ac609c4441eb1377e5b3db9187b34aa31

SHA512
a610ebe0c2b9407a9ab9eae6fb4f51a9d14cdff1cc9a9db893bb1bb5ef126d4c7e81a58e5d7ee2ba4b827eff8d8aa6a1c74ea82a45ea1ba3746c038f36db2f85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16ec89ff4fd2370576cad7f27e85ed10

SHA1
f8b1de2b9a5b7f5449f2241039ce382cf0a4bc37

SHA256
a250b8411f24298289195cdb0a7aad9b04fe1ad0347543196d22c02248bb053d

SHA512
e9afc222c2be3779e3bf99ee97752060d548b55e34c791f38619506708c7b5cceb6c09c583561992db5386586024bd244ab82083447477058a419b3a5c5d3577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf7a4f0a7bd47b065c81c30a85a41fce

SHA1
355d71c1a63ae4e898eef19e32f018954753d703

SHA256
90df35ea970b888a70fcb9e30fe09e4414c7559ff50462d68a7c20a9b7dae757

SHA512
c2f9d5ba0b948590658cb45f2eea05e6af2d5a4e5a8082c2921406bb76db6c0bfba997b2555ad7906ff6fa3a70a9f806b9defaffcc30823e1321e7f807c7ea09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
feecd246cbfbaab77b80bb6c880f0caa

SHA1
eaba80d70b53ae28466c854ee9a6c77633b50bcd

SHA256
94e447d9bfa5cafffdf6927ddf9143425b4ddde45873b9fb39d35fbfd65d3da6

SHA512
bd432a3674d3ccabf8d23742066a06c22a73d791f01da15888e9e7d66467a12459b63a35fdad059f01aef31cedd7380f6fd340ff9f8f87857f86800b041f7aed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4d8ed0dba67bded18a7d070ea390c12

SHA1
774e8b23d48378080d7275e31b4d938712eeae67

SHA256
cd9c60e9d3e86743053f126797ac1d5fbfca28f5db7bfe02c10bbeb6e2b2797f

SHA512
a6dde7aa037f54f2274731738e2a39914bb594e9ec05d9c43771433c8838d10146c6550370c52bded8cea8f099163d614c48ccb814f639280b0bd6ff5059284c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
279aebca36de552308f44a8a75cf04c6

SHA1
a3340c865c06d9328759a7a097a7d310429e6e29

SHA256
14293cffca859f016201a2870294bb2599c4e2b859f4e662d55ea6e2f66c8466

SHA512
9d964ecf092cb60fe19a113c43aad0efa737da75dabd3ccca5fca2e9cf65a86ce4b482ed7125d3744cdc2df7a86dbb7503a410dd3b36082ccce37b2f25478c05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b32214e8b840e360d4610c21992f01e

SHA1
aed36c08ef1ba85ce3b7658590200bcf66bf6f2a

SHA256
a6cba8b3950df6137438beeb607b41df019b5f7e99695c2c854d4af43c7cd0a2

SHA512
7fd675293177273af3534141c20ba725dda1b3aa24519b6f4e0530ce8b0e41680d4837b813c867e352321beef5c4112aef8b11bf7aa9ad04e752550516e86f8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08757954bb0a5fba46177482e0070df0

SHA1
f65c0614462f9fbd5b9451ea7b0b79a1d772457a

SHA256
8bfaf6382d27b7e7ef050e82753a663c5e5efb5b46fba346a53a8d79ef1b7050

SHA512
655c216a78acbf1ca758ca32fa5bcdade940296b7ed1a7dd5b493ccda9d126f747ab40e1153f347b3fa773cb04831f9a90a2eaef3b8035c367a51d71601c9054

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab313F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar31E3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit