cbe9a469b8ac7e6b659c57ee68eba6a80475ef598e226c071598eafd72a96149

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 11:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a990a508e4e32bd26c166b4bfe0e31ed_JaffaCakes118.html
Size

18KB
MD5

a990a508e4e32bd26c166b4bfe0e31ed
SHA1

ce81c1c8583085bbd8e0976741e6e7fe031c375d
SHA256

cbe9a469b8ac7e6b659c57ee68eba6a80475ef598e226c071598eafd72a96149
SHA512

49e42b52a346eba4f03957cede2a2688d5b9381981fe2658a28f73cb2c0dff6610d23342058cbe032414133e60d0f92dc0a1e8f9a8d81c26e94de36931da7388
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI84qzUnjBh2o82qDB8:SIMd0I5nvHLsv27xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{929DBDC1-2A45-11EF-8132-FE0070C7CB2B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424528245"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1716	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1716	iexplore.exe
1716	iexplore.exe
1144	IEXPLORE.EXE
1144	IEXPLORE.EXE
1144	IEXPLORE.EXE
1144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1144	1716	iexplore.exe	28
PID 1716 wrote to memory of 1144	1716	iexplore.exe	28
PID 1716 wrote to memory of 1144	1716	iexplore.exe	28
PID 1716 wrote to memory of 1144	1716	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a990a508e4e32bd26c166b4bfe0e31ed_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50297390bf6494e6c9d595b80c1f87da

SHA1
cca3a199ce4944094b49495fe3c7836700f65787

SHA256
bbcc1629bcfd470e059d85dbaf0b016981664b7357a501e5801c6ce069559b02

SHA512
64a8fd4a698046434bf1727716827b73ff87f11f3a4c91ad74c1f690cb93f8e29b65614a5f59e4843b032009e93f1a0d92ae7742361e798711fd1c6bb44c942c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5640f9cf36fa44582950b58b1998094d

SHA1
df28f6f07fe7288470629bf5d98dab85ae01bc8b

SHA256
81e1a19d4e3dea6069c9ed9612937c2eaefa1876a39409e23fb3c0c95752078f

SHA512
89539e96c7395fb60ee83bbf7e8786ca5ac95f1d7231e55e9a7cdb246085bcfdd71497ef82eb2e39dcdbe3a3670e1732a017963c1dcc5a7e21bb5a42502f255c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bae64fd61529b178e48c79c5e7eebffc

SHA1
6f65e47981169b3cf7afc3433ddf2b2861628390

SHA256
a406109ab9d2f8e107d3d7e12455aecb2cbcc00160c820d16866312c9a7ff39e

SHA512
afc7a38f94c0417d1e520f7766ff7098123efee413a6689e28ad096852d578059db0e0dcb6527c2f5a0b557c5e71eb9dca45687a5de942af0e61c06e8e11c98e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1d4436abeeecc8c4d571e14b8789fd8

SHA1
f94a45f23e7eac43c0e12c50eff465476934c94f

SHA256
70b6a522c46190f1e126c3f899d75a3f5b5e93a6ab879da4429f10f614383b5d

SHA512
1f78efaf86b9bb3095ac98b3686576c53809763181de1ced634ab3759411cacc94f24b1c643ca5083930ccffeb1c59dc147b1bebb56a29f2d349a1ee50cad246

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7dab48b42d6e5fa6e143e9517040f38

SHA1
8e125a96df41dd32ba0a5a8a91bcfc4fd3917065

SHA256
209d8377073c9d24ac0caab8b56be9001b7f8aaad14e404e324684abccd36c8d

SHA512
719db7012ec85a02fd2de33eea7ba524bb2ee145e79e8376fe61c6098298a948e62d031a66def0de0eee19a2a9eeed783e71a0fcd39856b24ae152355ced6085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e65d9f61cdc4449a81e8407e539c3912

SHA1
8b82fcb2834344f164f1d025526bf2dc03ee98e9

SHA256
7d69c9ac96543642b0f136c5a2946bea51afe32e44420418f3d6056496c055eb

SHA512
7ebb643abb56bb835b9483c6bc6684c3186d1b2fd1e51221d625308f1b51e661a520157c1101eb7f1a0a8bb7bfa5fe4e91c9071427b1602f4f0f2fbb1231d2e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cc53ed6d94113ec409dbce85711b182

SHA1
b2ddca54215772890202ff3a478b7ccc5b605ceb

SHA256
599e6782496238ca8c4a2e09e2944ac783de17fbcf07f792a6172a07f70c2d34

SHA512
8201e5a141c6df8b230c81130c225bc52d5aa3e1751ffb2a24f2cb911f4713467839b93ef31d68cf74f7bb637505d9e5354e137b11ec147e679ce78e26fc2bb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a074d102e74d2f692cd1eebf63d5e9a8

SHA1
35f4576e16cfa917683191d219c6d24032aaa007

SHA256
024273661f195e6f06823c288553e75f6d5cfd54dfffacd469fc5cef9d0aedf9

SHA512
59c4b5fd2ba59c86e07d838585ca49e2abd11436fac3eba3a7cccd9085806fb945905e7968b5439da8dbe9b63269aefd65b21989b3eaf6ec07156b2e3f900784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8d0281b4694d4956880e837993e7cec

SHA1
c6204ba6038042ee3951017c7d377aca964833ef

SHA256
6530cdbd83dcfcebad3eb08ed09433d76a32303af77779000c47eb90e03b349d

SHA512
8c8af8b4df6889aa90ff1fc07bc49ff3ba8fe20591576808bdd934e683e04952c5bdcb2edecb5de13984e349761443b9865dc149bbbbe3a4ea30223a46de4781

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C7F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CFF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit