49161ce5309bf702ba60d932d6ca4c88b1e6b9eb55edc5812e3b4592f209edb8

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 07:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1a81edcb125b80b2bb727e64ebbff4ca_JaffaCakes118.html
Size

11KB
MD5

1a81edcb125b80b2bb727e64ebbff4ca
SHA1

2481d23b5bd70a5cd2f712c07d3c262f94e0cda5
SHA256

49161ce5309bf702ba60d932d6ca4c88b1e6b9eb55edc5812e3b4592f209edb8
SHA512

32d6341928cedc12bcf9a9618b6b462bfaefce17165208beff573cdee0cf371049874ff293b2581362c24fd207b1e1d93b2406afa12be52dd1876356fd7989cd
SSDEEP

192:2ValIsr0r57M4nxauT8Ix/w1wvqVkt1kHauBuLbdU8d:salIcIQ4nxaAx/g8WaguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{13BAE361-377F-11EF-B2C4-6A55B5C6A64E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425982308"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2648	1952	iexplore.exe	28
PID 1952 wrote to memory of 2648	1952	iexplore.exe	28
PID 1952 wrote to memory of 2648	1952	iexplore.exe	28
PID 1952 wrote to memory of 2648	1952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1a81edcb125b80b2bb727e64ebbff4ca_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
044206b7f18a8209f5e724149102e502

SHA1
dee993a1fecd40033a70de2c2a68e012aeb5ab9e

SHA256
b011ad679954a61cead3ddf81e2672650f5c2eb5aef1921151ff51ce1871d3c7

SHA512
239584a575c3dcb01cd42badd62e41220aec5c19cacc21ae55483803dfc2f4926e6f2fdf2e824a6382c418a8bf46c6325b5013e698d01273d0625c6b2b81cfea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebe2c0ae0c0d65fccb2cf64b94f5b40c

SHA1
55bf12476daf449b07a41635c5034d05028ca30c

SHA256
1344e9d6beb80018b4b088a4e6bf042c46ae01fb1403433a223b73acdf45d6a2

SHA512
d74a25518bcab4aa3f50fb775c48714766fd8c01a9fea2e51b8ee75ddb0b6013ae12181f928ee70e36ed90eca1471ac06d46e060318bac36976c51ef52d8766f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adefcea9e0c2e5e30a102ae39a403326

SHA1
b6457cb756719b997f636b0423d3f2424b6f35a6

SHA256
416f1b1c06263fd6ba87f2b627e37a666b6dceea7d2d32c9399d6d51039996c4

SHA512
4e5684c78caf210e57fdf438707e17bce0e70db4aa00162da6be02aeac08caa192ac23ca9ee28c8c3cdf30a4bdc55229eda12f5009c9d7c37531b2603e8cce81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd8558aa875ed6e5c5835b8c5e11d430

SHA1
831cf9ff377d67ea3fd01cb450f2d248917a6e75

SHA256
7227c9c121a098a6fe3eebab9007452741d82cd456cc089ad0d0eecf0d823bc6

SHA512
cb5dbc3af48fff003d1859ac536a1a9a1746efbf67a18fe85e9ef082af7a36a63710635a6e9dc988a0b413a2a388b3908ee6632bc4fa2655b9a2cfc2f0bf4336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bf06e1f4349d5d9f4ffe5ac94b1bda7

SHA1
16c1eab86b3c177866a87eb12362e73f0ffbfb04

SHA256
7acd9f91469932d2763f612bf92226ba799712fe47842b5e73e26f57e473cd76

SHA512
e7f622c7e97183208c94dcad32b0e76495860d659bf92d4644d50fadadf333cb511a9c0c456cbfa9edd7e54437f53e48903bd4cb207fa201fd3c17dcc6ee9bba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3676279e7cbd6c3cc82a23d8e4322969

SHA1
5e542510b8bb799191c1bccbb3e6725a2a818c97

SHA256
96052e4915cae8a9ed23063d52d6695053e18f9d08bb228c08ac7e7aef9909cf

SHA512
ff6ad9a0501516b6ecf9be4bb6d53cb42c99f169fd8461d3d691998438c744f5f16202e3fe801d30c9ae206cdd009456f0101e63553df3565e5976b0cb1237ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab5a9d25c488e850ae6555eb7fd9d31a

SHA1
b9ccf8eaf252ca54bfd116906f48fb2e8adc9cc0

SHA256
87f1080224a498fc680d0d8e61c990b8dbe3f8eded7b3fc8ee68618c9abcb803

SHA512
8e92d012fbc3be190431b1cf9521f82f2c899c4129426280cdc84739d17d4650e2d5057a8c3b51b4513d04a73cbe5b61b5ab15d3c6ba0732771b4370d27856b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec0fc1d96e6ea8f549c133fdac7ea429

SHA1
c0a4015d0e5798f8e2a103e2458410ac804e19f7

SHA256
047d2b4d481514261064b9159ad524c58f90dcfb6e5d218ab98dd54f8f2c75e8

SHA512
7e95fc880d01e5206b12aeafd9771a8c5164d2efb4d5454b1da903b7d82ec4293c7ea4aa5d7f22a9c85080494d6e30916f7262b2e4434e7fd9e78f5009ccd75d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2868.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar294B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit