ee233d7d4ecb80cd4aef64204d0d6b1eb870be109b3ff8b388eee4a8886ecd33

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 04:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a3e274f23a18b5fe3874f1efc5b8e54c_JaffaCakes118.html
Size

23KB
MD5

a3e274f23a18b5fe3874f1efc5b8e54c
SHA1

105b6f5f7cb4a7245a6737df684a32e75d724e87
SHA256

ee233d7d4ecb80cd4aef64204d0d6b1eb870be109b3ff8b388eee4a8886ecd33
SHA512

ee542d3c85de2b6df9261286d13ffa728feed965e03df4614aebee0d8e24f2fda39ce39602b8e947a768f2846961dadb57b4ac32b6d11c9ba71618991612d10d
SSDEEP

384:9FlhpbqtHfNtVuVfpUpEJpdJzO6pGR21TZ0FWFB/3VllEuILby1M:9Flhpbc2gFWFB9llEbLbF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD20DD91-2940-11EF-91CF-DA79F2D4D836} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424416325"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1440	iexplore.exe
1440	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2888	1440	iexplore.exe	28
PID 1440 wrote to memory of 2888	1440	iexplore.exe	28
PID 1440 wrote to memory of 2888	1440	iexplore.exe	28
PID 1440 wrote to memory of 2888	1440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3e274f23a18b5fe3874f1efc5b8e54c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc4a03bfff5fb6b3e64db2d760802327

SHA1
323c75e3e00c852f94465b0cd48ba3e52ec8ddb7

SHA256
9974ee8a929aba83082a421d6ffa6f490827426ebb30c49a90dd68db3f3acc93

SHA512
97b0bc9d6f8c0c05c1df7b9f94493db115b99529c0c0177cd49141bb6850a307723818976e17ba0f68040aec6cbd857e4705a9b962f62ef8dd1cef7b83ee7470

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
640053edd9a630d4b49517f24efa6b42

SHA1
fa96befbd487f5c112c9826584a23641bf6c51da

SHA256
91bee341d0e0cf24f7d4421f8d61a8bc6dfddf07db57395d8abb7c753a8064eb

SHA512
b6c9e618f9768fe8ca2068b46b89f4da37e0ffc0cbf3a90a012454d2a5f40aba844ed80b33e01e256af5ec3030ef8e28dc5ae7a8c6974a1220583d1cc47e1c4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d3efd508c25fb9b1ebdcce48c49ad76

SHA1
b17b6689adde06d643c9a881a38fed45c9dc09c8

SHA256
aa361f99d71f67befe266769df28ea87074aead131ba65ba4332ff4cd5a789c0

SHA512
c92c295b726d1831210de4e3f83419d8f582bcdf12b6cc32d15ca18547d8d2d680000b192ae2970c3114c4eb4357dc7dd6c45b44d2b9616089aa88ad18a888c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1853c7f768d6f1250ccde2e9166ba608

SHA1
b6d774b5e4737f50ff19463e3255e668637a0b36

SHA256
8f17c669b5e3ca126e26912e00ed68dc54f78773c6ea4ae85d67f9efcb906c01

SHA512
4cdc3880f018eff64fed70c51d632f6d5f0bcdf5d0d16335f4c6653de44a882f10c8fbda1c2993d2c8ae1e198adc9fcc5671998384ab977c3dc685a6be9b6ca5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8a5393759537df0674d5d2e7c85086f

SHA1
5fe11fa352aea00a637f322e6763643591b3bea0

SHA256
f6717fde149571684c933e165bbd383a8545af0862e0c31f750e4893a2ceab2c

SHA512
186edc103ec84ed9f5963474ab3b85cc0c1eb22b7938e863454131105b3df93c71b124750132b3512e16a0bccd0dbaa20e2b44d3d5f616554348052dc70b5449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9958fbd2f47c6a4f6d6a902ea99b247

SHA1
6fc438f40063d639afc523effbc7cd1543aa956b

SHA256
6f4f8496362302c680685864da3a84a333e6b2b9192514094df63be0c85113f6

SHA512
50f10bd417ca93580a3e925d563cbac0f822c941d65a0e0842bdd383de5d619cd87960e8fa449a927f2f67617a22b9fc19c4d5a33be81205a0cfbca99d4bc70b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0be4b8a98e6a953e01370ab3b85efa12

SHA1
c125a87c65cc6877956c819a1d4396ec3829af2b

SHA256
0c97c9b0fcbb553ec9d54f265de438200785a7fe8a4ef9367e143ba7f573972b

SHA512
096447a8f66746f2a5a6c5b541f874bfb28f6086024726a1805e99883693d3f0fe129aca74dc43a6fc877f5da5a019d68277b4b5612be60d1bd88dd48002e218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e7604647d083d9eaf83e4094bc3aff0

SHA1
faf8746ac79a86e7d6bba02296dada6c0729f0c9

SHA256
db61fda0c366f6af658f45951082293dc517cbb87079743aa42c7f58e1bff318

SHA512
333722fe6c4b08fc30e3363096d37565749adccc48ef30b9cdf68a3378bff00ec83d3294745a4953ac2f6651058ffb29f7fc272b5c25b0991a85139db9bd383c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1652a3b438e4fbaf80f3ed742bdaf03c

SHA1
358b8af34c448048f283d0bfd8427860dbccbac2

SHA256
dbee5b76abc0d82d49a8abb0583f744d222de4404db4ccf875994f33717668c7

SHA512
51d47c139deb81ba46e2f2c20fb683bf5a2c7b87873086d3e0888e7621f2fe763a9302ce29badd8f0583f0ef218ec80f295bd7ab9b6fd67e4dc568aca0953474

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13A2.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1445.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit