95e221f6ecb59e092fe0983c984ce401e97ef593441d79526363732cd34e1eaa

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9b5ac23b1dadd9c2becc1067a24b2c4_JaffaCakes118.html
Size

19KB
MD5

a9b5ac23b1dadd9c2becc1067a24b2c4
SHA1

9616169ad840f289d0537d1da80e5fa537fd7907
SHA256

95e221f6ecb59e092fe0983c984ce401e97ef593441d79526363732cd34e1eaa
SHA512

bb03a9136110b17f595d32797f7b1cc3c060993e71063a94ab8a24a8f4f9fff9fe35c097422fc613aa6affb7bd562dbfda2548cc7e4b58823869d63ed8964dcb
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIB4HzUnjBhh782qDB8:SIMd0I5nvHpsvhgxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4F73CF1-2A4A-11EF-9E46-6ACBDECABE1A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424530506"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
840	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
840	iexplore.exe
840	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 3016	840	iexplore.exe	28
PID 840 wrote to memory of 3016	840	iexplore.exe	28
PID 840 wrote to memory of 3016	840	iexplore.exe	28
PID 840 wrote to memory of 3016	840	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a9b5ac23b1dadd9c2becc1067a24b2c4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5e4e6892b003d712f9dd5dfb1510737

SHA1
ab00e34a9085584083716bc796db94b8e40b1d8e

SHA256
4dee529c6802047df6dc91d87f31df430c62586c753d8875724180e6f2fae349

SHA512
df2d6fa3de0c9b78d78e0cf9276f38e6ef6d89d44ff96fc2a39693777b2fcd33c4458ed3b2621000c0fd63cf741e3ead343877c3700d86c2c64b15dc49dbd205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68a094211dc3c3f5a17db4a92497b26f

SHA1
bed31567bf1aee8bdd9c0f4149f459b85718e0ad

SHA256
04610344aebc4aec90ca2fe018f13a9b451616573762b300f21adbd66925feae

SHA512
536ca4a580843f534ce97c1c086dfd5ea3d7afa1445e9a7cfc7d673d65a109247cf8485c4145b4b3ec1cf7f564b63d3fce49e83d33d283f2d3256248582c1ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1adea0aa91ab2f94a051399ab1d0338d

SHA1
8de4c6783b5f1237cb841ab74852be261d439ad8

SHA256
39b42bf5d8a3711590388b92c2e1e38ac2da6c9b3baa94a4500e91b0d75ee3c4

SHA512
22c2b71016090990af8c56c15f87c627634e29e28343673806c5b968a1f4dbec85ae6c9272dafdf1c703c12f80a3f1adb67e406bb2295989ebe8cf35e6fd90ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
656033080ab6fc3c0100f2ad999427d0

SHA1
a8ea609baae16eb95f5a5fa99bc4f8e0cf8c38a4

SHA256
05c61b6ba5a99b5ff4367f68253c74bf969195f65871dabb8c9f5f7570adc66a

SHA512
2c91becc5aeb9c99b4bc152856d8f1c642a00a47f91f28e989befc84c757aea384330064dc03fc37f30fb6e3ecf37ef93bfd9fc4838c2ce5523e4455391a3ece

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3952b40584a668415d55ccb139341f86

SHA1
8a901815c4c3cd4032147c7f2352559e8e90e514

SHA256
0311ec496465ca5848fd85930b43c2dedd62093f3df732af0dd0370619856657

SHA512
41c4eceaa7496500255c07d2abe456a86c6a81a55e052beeb64aa5bd554e1f4555479ba148e245239a34acc9ebc40a59d6d744b91ac216d25cca37744aff742c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8bb0a069a383bdb90a3d09f3e0c5248

SHA1
103af30bcddf3e0e92fc78b1f9279e80929012d2

SHA256
f54e13c3bbd3e5c96db727ec5b807ded638c77c63c6c1a46ef5cac5799075a19

SHA512
292e8bbbf38fdae41844a09c56994cdab41f7fea86cf079c9e2e9ec233af5a6f85c744ef4b390ac8fe666f46da538f2dc7098e5586f7ff6240cf0c0bc9a2f981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d91e251978ad2917dbba58327457cea

SHA1
54f94acc7a58614aaf080a48828293dde1ec7d9a

SHA256
4568f25110e53412ac71b036e744d0bd92d9dbd803e4cd4e7a90a8b694eb9af2

SHA512
4b88996d339ba5f5ed6af1564800fad134f6162d597ea40152320b9417eb903e3cadafcec39d50d86f87fac76e1a25af2f926f9eaa33bf054d0baa83ec3e752a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82f8bdc4435f7e2580937e79da733d5d

SHA1
90c2ce623d00d1baef4f6a81efea3850cfa9656f

SHA256
5883a5daaedcd4ef16ba3ef411926fdecc07eb728968aace3b57b94030ba9e11

SHA512
93806723217162ad7a14b5a6285d29699fb442cc05d9391db1a26cb0717797b4a508b4083103ce6eef67184ad6bd36d30953771b781c616cdb816c4b39b15b30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5EA6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F54.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit