28d7ad934b9c5d0975f88e24f1dcad34718915419c4ee7310f5f6d48db5212b3

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b074153c08dac256ff03a8aa07ace630_JaffaCakes118.html
Size

16KB
MD5

b074153c08dac256ff03a8aa07ace630
SHA1

d878f03ee1fa5ea54c6737c0bfe4d3135da558d3
SHA256

28d7ad934b9c5d0975f88e24f1dcad34718915419c4ee7310f5f6d48db5212b3
SHA512

445e0af4ff550b0ae560226c78c166fe09084b0aa89ab47d8bb8e16aaa827f40d3a9b8b63136360199abe3c31160469bff1f1f8460e092601107b892e474f340
SSDEEP

384:X28H4dG3/i123OJ+HSBUSq9HI0/e2BMKDJ+lP0Du3BCa3bS9l:Z4dP639o022CVb353eP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A0FBFF31-2B67-11EF-9966-EA483E0BCDAF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424652823"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1652	iexplore.exe
1652	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 3016	1652	iexplore.exe	28
PID 1652 wrote to memory of 3016	1652	iexplore.exe	28
PID 1652 wrote to memory of 3016	1652	iexplore.exe	28
PID 1652 wrote to memory of 3016	1652	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b074153c08dac256ff03a8aa07ace630_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
691355b72b870a584da0c5f8ae7ddbe8

SHA1
c38a49a7161eda4a3f59c5b2e6cdd24d45ac708e

SHA256
ed8248ee855b66242630ff3c695fe6a3b9be0f74759d6e8a3e4e2ade910784fa

SHA512
58462ab35720bad826452d687f11f5d0f9b7b5a6ec6350052c483d7cff6073afb9ce0e1b8e79c795f88b9c09ef95ba5f7d709c79fdf95ca08745be4b90411719

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c0fdfa121bc361294e6d0936f86f892

SHA1
4a7777b9b3953e428cfc2a3602999120bfc3ac6e

SHA256
c2414d090515b3bdbfbfdc69ed6a3b5d977ba68e493856333faabf6699142335

SHA512
71f7a2419430d1f33f996785566307fa260a64ff5821683f18a52f50546606080216806a6cd40bffbdee646d3e3a239a11d6edc71b4cfe10fa15b4a32a4a1229

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34c3a81ae423b7615034b7a27f96588d

SHA1
50dc210577c2dd619520f69faacd1abbb57e02f1

SHA256
40e2258eaad56254a75a3692c9edf71092a1a921d9c7ba6945c905210c917559

SHA512
2e8cde459b721b1bf12d046d2894842319ed01e0407405dca9229656a0c9e5421928ff859e37df8f591caa74c44cce922c713e9d0f2772d94307e8f68346c36c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3adf6df42696f95cc932563576f7d665

SHA1
d0b2f36c28b878edc46f80775a41ee9ca0bbba7a

SHA256
d74c18562ff141f9196f127d477df643cf81d131619decfc71aa13b484ef25ae

SHA512
4b1f84167847b2577c11aaf3adfc64ae1712f6f59c7e9d3100ecec7ee453a985739dee9b883b8c76ff3064cb75c7db485c8e3c633c18cc6c5a8d9f2fc5aa323a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bab0a7bc1735e1df4cc1deeea1037537

SHA1
66abacc7a8c435afe9119817174a6ca0974b2716

SHA256
1587ab402dc107e95c969998c8f028da9b44423c5e10be5804b33065e9e67776

SHA512
ec06192699ff192f8db50d9d36ff4c36033a6b463414f25db7a6aadb429470bab3f94a1d46ae22066ea9b2e564a23d4302b60c305e5184026b6193c2f53e3175

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5bc091549206e0295a237a799defeef

SHA1
2b4036a2aee29c804689d09c4d534437c92e1412

SHA256
cf7fe61478b03f76def6aadd0b32e2f2d74337ae16eabba5ca37ba251154d2e6

SHA512
f5d2e71add54783db5ff871eaf7a38546e0dae774416ff24bc3059a863ff55801aa1bc43c72b5643fca405fa33a6b3552055026d7e7adef11ea2a3b59efa014a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c31410d503e5c1fb8d1a01e33495b5c4

SHA1
ea2bd8c4dbd38028615cb928dda15fc2fdae0c1c

SHA256
f3ae3cefb70cb6845c9d212f1f169b39a9c1e5e5d144c76832781666bddd5fa4

SHA512
a584ed0886094f67fd19bbb144eb45dd44e8ea486340390b117c35d50e48917813c920dede814fa9724e76577b7f80c79b7e0fbb9a02e0d36180b6f33ba86b4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c25e7f3de8bc5b9ef55166f176bac02

SHA1
1d11d3a739d5f7eb92e8fe7c4e0819bbf014b12c

SHA256
8ab52eb2645393a50c696755659d4bbe3dced558b3c3d9db4d04b31189873d2d

SHA512
bf8a3ef77673bcdeff6d321036e7a87ee1634392f26a8a5e1b4fb6849aca2503d8ea0b389d1d7dddf617330b9e81d30f75a1c83a6898fbd0da614c57671b4f8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56bb0a74c22aed68eace87598801b301

SHA1
9f2db0fb0470f28a371bcc661de662003f394e9e

SHA256
3e43fe71f547b33562195f2db89caeb4d5a5c7f220decbfa164bc3b106f39816

SHA512
8e6e1c197479b8fcbb404bc87fb6fce0c0355a9d51a2737bffdbc971a3133466217c9f9bb969b9ba8ce1a8d65f29f2dfca1568fc5ff90730ca40bbf3d60daac6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2369.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar245B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit