1ad553bdeba1fde8a9aae61b407e6f444912f4f2eabfee2a01009e754347900b

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2ff702026e28821e560ac84d4d2093e_JaffaCakes118.html
Size 25KB
Sample240612-3teckawblh
SHA256 1ad553bdeba1fde8a9aae61b407e6f444912f4f2eabfee2a01009e754347900b
MD5 a2ff702026e28821e560ac84d4d2093e
SHA1 e232ace6dac17c047178985625d3b0a0a29e0465
SHA512 7bf64b136974ed49dae82d3efeede40dc5466f33213f7d8c25cd4229b1c159ae915044d8a59b4c96af387bc75ccee1f1248c772c4fec3beee726858efbfceb89
SSDEEP 192:NAXoRssZWQSKXb5nQnQjLntQ/knQieunYnQOkrnt+hnQTbnYnQsMCTACpdEywuXA:WXo+sZWQSKZQ/NLNHg
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424397951"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{355BF8F1-2916-11EF-B7D6-72515687562C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2328	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2328	iexplore.exe
2328	iexplore.exe
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 1692	2328	iexplore.exe	28
PID 2328 wrote to memory of 1692	2328	iexplore.exe	28
PID 2328 wrote to memory of 1692	2328	iexplore.exe	28
PID 2328 wrote to memory of 1692	2328	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2ff702026e28821e560ac84d4d2093e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3C428B1A3E5F57D887EC4B864FAC5DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Size 914B
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Size 1KB
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
MD5 SHA1 SHA512

Submit Download

3C428B1A3E5F57D887EC4B864FAC5DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Size 252B
SHA256 9493cf8927b4798ab9247b023865f502db496ddac982be502fef6f30592034a5
MD5 8b49b7609052677be5734dae6b49d2e9
SHA1 525c29be45617af6bfe0768302825c29f4615ffc
SHA512 cd586c5737e9da0c90ec86f70f0e8b54a2bff42e82cddfa800da94d0a3d13f36f6c9fe86b73bcb8aa0b5f29fdd0f7255d334607328f1e21e7d24d612d00cb43a
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 844566ac228c8ba442a7571174e620abafabf1f1121a46c48b3ed43ec4aaad64
MD5 19baa419c3ae4adbb90a7d4f966a898b
SHA1 5c700a1ad41de9aff0018c917648e38e6ce11692
SHA512 399017578ecd55ffc300b36fe35acc88e76ea4e634f29e6ca54c9a4785661ecfc9c6ac322914488342194a2c852110851d77106b465fcc5b6dc14891cb851154
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 63fa8fc9d787512482627a64c152ba54099ffc67bbb100be220311450790a1a5
MD5 be4866a96cb413c7c01c22044461c913
SHA1 b34691275c123bd89ab3ba1c4bb3e413d3685467
SHA512 d41305e972d76583cbeca380c1c3abeda263b2ed2135587cb64221f088abea1ca8a3c931f45baf51b64a6edc44cd8c1b631f538e9a8250f4800ffc2f08a0c738
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 485fce69056b257510b16ee574eeeb1a3a569d1e97869e51551b0a718ea43bb5
MD5 9983ba1930d9e16f39e880f48409219a
SHA1 3fdedd63799145243bf824e27a3174033e4e4bf9
SHA512 ddba94c9e4bc727302c4c16df08c7cfda605cc4dd1dcd9af22df2575c0bf810046f68b86b32a54bbfb281820f6a88859bbec68a106a28f6466c92dd087164275
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 5e7d199cc98bb9723fbaaed833ee9d92ccce109b3c016f00142a36efd99e2638
MD5 db0cae448deb4aacca7ebdd246cbc54e
SHA1 d12b0fa45d47cb809e45286844fde97e555e155c
SHA512 e0da94e42a142ee5aab9927a0ee6bc5455b1415edfb49b6ce08a97e635504279d8e9731a660950ae74e87a605ed9a4cf4381a979462adddb5af6e98feb3090c4
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 d7b21a5a0d1990704ab0279ff190aed6bf676aaddaed163ce485b3acddcff302
MD5 428a4f5400133466844084ef55cb7545
SHA1 266bff8ca1004cd458f64980c1fd17334765bcbf
SHA512 fd37e511e5db347b37299df64967d7274a831586d2862d04a727aebe5717fd0ab0b2f0f8e9d042a45055daf2647789d8a6c8ef0cad5f6faeaca28ef7103dfaca
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 72a1b0c1b46b80c7cb86500c58cb7c23560ac3bdb8861efd88dab8d20e0c9471
MD5 9f2f685236d4c64c0bb9ce2d41741cf7
SHA1 cda2a1985a6cca501e891e2c74eede1a12ae4f86
SHA512 ed45368bcdb4112a565f3512f00f0ea6334cb77ff51a304a792248c24ca5cffe52095f3bbd545920198bf6bf9618b3fea66ade7230c916f6c1bd9584bfa8287b
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 5c798d69d72d12891cf073205bc498a9eae1f865fa075a020719a989d600a024
MD5 12165a49d2f8e8e64994bf10dd0ea09f
SHA1 8e02dddff121cd69ef24872386873a828114ad64
SHA512 c99c31a251ca74fdc3c2b4a02c7a66ef170067b633f99be08887127190e6545eee08ecdccdd6d2ed77b68c84cda484ad311abfbd17039e0a25eff3be1e2b1247
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 283e57214a0556f9b1f96d0595b436292f3abd8ecc40c70a3011a7bc7ebfcc8e
MD5 4d34eb219f5521ea68144e91d2673b14
SHA1 d5828936a13dc8f59f3cf7ab4e28ed6c7e0fab16
SHA512 b016ee5a3ee97dc26e09bbdb2c6b12ac08cd9f1698508cf3bbd26d8a4c065514f4ca08bf5bad965992206487ab939dd69d0bd82b045b177f4cfffae85c12d564
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 882e7d916f0f3c6d6964141368b2c626fd02d776d2e682ca1262f1a6a7adf7e5
MD5 07e4ff86e4ab1d31ff267cabafef7c73
SHA1 001e8e2b2160b0a8b73d07d0a655267aacbc694b
SHA512 b6fe88fed25e823af5dc057ec3b42f40e1ea400613ea9f1144505beb61d58ff63056fd1e708f84aeb7b3567a292a7a7feae4f96fd8e76f8030acfc1ec8fa1637
MD5 SHA1 SHA512

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Size 242B
SHA256 204d38a6cfe73fcc71d8350332270b158386a5ed9fe3b6fc04e78d4783317092
MD5 e4b25c84612ddadc96a1a28ddc0286d0
SHA1 79a0fd18421b9744863446f233274a9748b1bdd2
SHA512 95cfc4ada102190b622f1230f10bbb06a9141cf43311977bb2f79559de0b7a8355ac83b6b422c83046645e8117ca861c03e5b4c1e788ca18aa31e5449f73614d
MD5 SHA1 SHA512

Submit Download

Tar794.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar794.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads