43944255d57ed3cbf21e498263303dba0c38c583d51b05a912575a7e90797524

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ade5d9e1208e37c393cac0f4ed5ae9c4_JaffaCakes118.html
Size

27KB
MD5

ade5d9e1208e37c393cac0f4ed5ae9c4
SHA1

50adc34ea43f456f56cd2400c6ee1c86f7e67a69
SHA256

43944255d57ed3cbf21e498263303dba0c38c583d51b05a912575a7e90797524
SHA512

4ae5854c4ecbc9e7354816d1ccd68fc04229b3811f5ef300b00823efcfa00a77abb8c92a50aab6047d46907c6523eb223fad90a6b8b9e68d11f166ac056de9d3
SSDEEP

192:uwTgb5nfqnQjxn5Q/mnQieVNnRnQOkEntKMnQTbnFnQ9ethm60H/xQl7MB1qnYnX:iQ/tQLQ/YST3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F60BB71-2AFE-11EF-9680-DA96D1126947} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424607589"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2604	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2604	iexplore.exe
2604	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2540	2604	iexplore.exe	28
PID 2604 wrote to memory of 2540	2604	iexplore.exe	28
PID 2604 wrote to memory of 2540	2604	iexplore.exe	28
PID 2604 wrote to memory of 2540	2604	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ade5d9e1208e37c393cac0f4ed5ae9c4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8675b8b93e2eb4af7970a8db8c4020f2

SHA1
910b76723ae8f7626dcd258c3da9751f62e3c045

SHA256
c44fea02a40d8d45a1761010943ac36d2f7875e789611281a4602830b025db7c

SHA512
c861808640651a96ee25d2f294ac73c7aafff97be7db3da0dce50e2ab6f843ad5c71b30ce4ab7f78b9896110b16751858232ba29c14dc4b65d7b6597dd8963a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ced83728b2e12d55608dcbc07090a9fd

SHA1
ee3b953d0253ca62e95f82a398a0f4dfcd7b7215

SHA256
9633a63cc61ac4db47cc8a801f00be99d5fe8a466cc2deebdcad05595f1552a7

SHA512
3d0a339cd71e0e7f99ae4c0717d6c0af1cbe1295e33276d0c1ee1d71fc42331ca12f5f6584d231c7950986b5ee0c6ab261b468661f91eccfefa6b8e4cbd25069

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b66d29511300e61a3015726d9adad4eb

SHA1
14ffbe8138ca86c1b317b6af4021a45d37b0664b

SHA256
65ad26bba01a764fc85fff7baa7adac55ab47941f2fed4755fdc22995291b112

SHA512
1b58c0f95e38d8349830e3b3ab273fd9db94a9c259f6e652039ac5e7254b85b8a10bff98c0c3aa747201c0a3da6ca700f9e4662913b7e0350af6017c2c59d1eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7b7c5d6eda40b2c6ad0328f867b29d5

SHA1
d1835d4e3895f9db3100128bc4b99bfbe53cc0d2

SHA256
7819ad78d9ed4053b013aed0d837d98dee3a5ca87955cff7ed737f67657a6d63

SHA512
d90a3a061d6344cf033aed5790fd27440f862a0e313610e786276bee82f645d4733c9f156c2db404a398317e0db0653bb07046474f4fb424e480156e798aa330

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af51eee57e4b1743f54a430720f5b37c

SHA1
192675825d7a82812c6ecd929a94986abd3e2c2b

SHA256
c169771c6f5288e2e9252481ecc6ea9c018de3dc34eeee15b713ff1db277c786

SHA512
42374518ca4a5579b10f1e66f72ba9c92222d2ce56dea672176248114707f64eac435db113b82bba292184285adcc392d526ed54aac20d35d9d3b33e46a354bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54f063af21cab1553fb31507451fe1df

SHA1
22b7fe85c4cad8e9e80350cead597f1031b77b8a

SHA256
000a9f53dc126e621a7fae0847ac8fdeb4a17b30a4e54148563e8df796fb0101

SHA512
5ab27a9a660b4dfba2be7f4a050701bce774171d016fb9a06d7b24df6ecc9146447d4558ba06a61580abe027080664f2582aa29642324e00ce3cf8afa6035b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21240207b967fc49ebd165e2a32e8ea5

SHA1
3c64af5515ef738fca552da4fbbd4faa0afecf58

SHA256
bf8bb1c25442162fcdf93bc6fd7fe234358546ab1203d5f4d12a7dbeda8a9e82

SHA512
faf1bff0d758af5cc07105a27f38fc27231276b139ecd01afeff93e6a6d755e2941d8c4686cb5388136effe01ad48e8994363242bfbdf71d09ee061abdf83f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d26b860f2b9f27db92fe3df04f3321da

SHA1
7248e6cdb44a2339798133f46fd4dd68f2315b75

SHA256
29dfbfaab591e026a9fe8d99edaa8498f86e1b9f2e3124c6f052ba15714b1a57

SHA512
4e3e75508e312ac110cddb45c57b0cbc4b978c5030ed4e31bdc700fe64d3d9c5824a58682d7bd4cecfdf044899c10ef59754ad44d6d387a132b6825a5d6b56bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
412ada72d2a6e1ee1da5fd450fa2a4f8

SHA1
4cce53b24b540fecbfe9a38b777edd60a49ab7f4

SHA256
846d96195d0485020380863511bd34afc130aa228671c4f80a5f9a90ab3da6b2

SHA512
78791680afbe2105c2012325bc7c2b3df7d11db6db9327377ec0990f0ac857c72154086a4137db483e30a0b5fba11070c4d82cdb3c5c108151cfbc9f88a9f95e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab279F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2890.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit