3020d95d03569091269a702e9763b6b4426c62f7cf038be59f1fb7c1b972ac7b

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3bf8df72cddb9eaf81ecfdd423d1564_JaffaCakes118.html
Size

19KB
MD5

a3bf8df72cddb9eaf81ecfdd423d1564
SHA1

46865d5893db2ed5ba4896791e860c8a16585913
SHA256

3020d95d03569091269a702e9763b6b4426c62f7cf038be59f1fb7c1b972ac7b
SHA512

5e41d0ce9592ceef674dd635a56d6faac8502f89df0fa3dc058be3c5a6b3674ee2e74adffaa8a6d2f23d6f5c953d1812c7efbe27b27abf44357f40ebeed3b5a0
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIg4AzUnjBh8282qDB8:SIMd0I5nO9HJsv81xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA7BFF31-2938-11EF-A965-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424412804"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2872	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2872	iexplore.exe
2872	iexplore.exe
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2096	2872	iexplore.exe	28
PID 2872 wrote to memory of 2096	2872	iexplore.exe	28
PID 2872 wrote to memory of 2096	2872	iexplore.exe	28
PID 2872 wrote to memory of 2096	2872	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3bf8df72cddb9eaf81ecfdd423d1564_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
779b1676d6316d16f154ae7cb06a966d

SHA1
25d1690b570315b9dcb0e34c10baf81d279119db

SHA256
59cb92507a93dbde64c12fd9ebcb49ebfc07eda8299d9871676add13b0db0a1e

SHA512
52fce49646e653745f9d658442c2f1fe378c851a347717b8667721b9769b18ef169c5d2159ccb2c29bac9e39633d6e76112387b490188794022a739d4ff6438f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4daf79fdfec3534765bb4abb3e5b1bfb

SHA1
575c62afb68a96812b73b1da4938b34ec8e80672

SHA256
629ad2d47d4683b771c47bd573f310f2a68240c96f0ad24b6acf2b315fb5bc8d

SHA512
0aba4c2fcbe81c3f18fb3b0ffccdeb1c598614f61037808578e27107dbb3eb3880ac51b85edd7c36b3a065597eb3b6fafca58313b8cdc61fb39761fbf4de7ee5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24e3a9a9afc0ffe04777054c21420173

SHA1
a2f168cb0ea947959f379cedafac134390c2b65a

SHA256
a84bea28833de836b246fef4073d9360c89fd1e4ed6942b3d0efc4bcf00bbfb2

SHA512
95443060be4f767570eaa0020e07bdb28c32bca2a9b14c17ace7ff1b85294324aa65b87d05e2eec47514e8b708d90ac60aae9ae29a66f0da72960c2d6b51bf32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a971d91564fcaf0686fd6f00f583e433

SHA1
86b8dae87ad09b6e10d9c6fe032e77b80fcbf40e

SHA256
62da487211267fb4b25624c2479991e486e9db63f27dceb4d9605aea45cf3141

SHA512
f3a9c94d584bbbbcd7ec6c12c8952a81597d6f23fefa0245622e117d3453555540703dfaf2de7487fbb345984b2bc213c0ea1f07a28f98c39bb8dda29d699241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa9be542c6a5f4c3e83ef779666d43cc

SHA1
4615a8aef73ca5c876baa62556db45cad1f9a75b

SHA256
baaa6784a06504f7ba53b04351cc7937d920c9342ac3856ba2a7d422ba298925

SHA512
db89f950886af154401e772625ae77258c97db5f25512e54e14a5157a16b9789bd2d5af440d02c62db17a2594dbc27e2d11c5a59e35b7fb5ee07b789c20bdf56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a2391554c901b298a27bf54625846f9

SHA1
2c73df6dd07125c9c5e5bbe32fadb6558f20782a

SHA256
0fd94aa3dcac288bd0fac3bf9f6aeeed8a8bafc79565af8d8379b404d77a25c8

SHA512
fb794486df7be075b6685a0ed8f24a45fd05304c386bf553648104f3fe670e1393370f35fc5d3d4662cd3b4d1cb7ab05ec6400d1259ae285afe1163d57d0c768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8e7dd66dc2f5d43613f1f2d7f4177b6

SHA1
c971838730b3dbee45e12154105cf15f54ad1166

SHA256
bd8e312093752b39229fb9bb180ead38b783ae47ad576fdc4d91d5c4d1b20e6b

SHA512
690565ef2ca8e23282958516c126300cb69134cdfea6e32d5c73f1fb1ee69732fdce50680cca8eca877b9ec04d7f1d80f2faf26c44a2de3299d33740fb69cfc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af55383b7f4b04b4ead83b92e4afd986

SHA1
c9db41bf5ddc7efe47abcb7b166a4029d3cc2b03

SHA256
fe73ba7014ee58e83c94df8195a1bd8563d69b41ea3da49368326edb44eea595

SHA512
d7be0c38b72aa36012777607ba03c8ceca9f20c2b34906f9c70c0ea5ede85ba890f9f3cb6daad2dbd61ffda4188dbc4eae23e26c1f1d19d828ec6f6a550c7c32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b7e1a54fce8ba2c12ae31f20e2b7dd6

SHA1
c882aadf2f3e52fb87fff11a214912fa3f1bd4ca

SHA256
7a88bea0e5935a1f7cf0ad4aedcc284486d82121289114ce378b257773a07b63

SHA512
044b0b77a031bf7a2b85ef29e3ea4c7b8c66c35032579fc5c1d84bc6b48139ee734c320f8f01a5a5c994df451b05ec271f531b074fcdc6fe32cb7d7201ca6548

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1769.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar184B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit