68dda83f15afda66e5ab2f8f0049e9cfb0b85de3e7947fc707842598393a38c0

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28c7d4cc718473950c3dbea20a6e2f7f_JaffaCakes118.html
Size

32KB
MD5

28c7d4cc718473950c3dbea20a6e2f7f
SHA1

30450b1db157cb47fa0795ca46349e3885eb61f5
SHA256

68dda83f15afda66e5ab2f8f0049e9cfb0b85de3e7947fc707842598393a38c0
SHA512

baf621d6ace937f21f40073a23b54dc8571b57aba345e72513cd3c8d7520b3b143fc3854325a9760db3b38229aa8a4bb9c30dffd3be6012a2305dca0f27cbe37
SSDEEP

384:zXzawbfl/LqH0CViXyCwKGoDdhkyh6t0NdgBShZdtJbwr+HOanJH/M5QrBtZHt8F:awbBLtiFoDbHfsr+/Ht8dPz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426450149"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A7E3191-3BC0-11EF-A69A-C2666C5B6023} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1980	2080	iexplore.exe	30
PID 2080 wrote to memory of 1980	2080	iexplore.exe	30
PID 2080 wrote to memory of 1980	2080	iexplore.exe	30
PID 2080 wrote to memory of 1980	2080	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28c7d4cc718473950c3dbea20a6e2f7f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29001e6127a112ac4ab0ec3b726bf997

SHA1
4d67dfba818ef718e29a9a087750ad22d56b552f

SHA256
397f337fdc8b656103959190c4b066c171bcfd9f576ddc1147fd4969d8ac9fc5

SHA512
6d3c5198f57d8807d7a5119eeeaf9898dbb02200244cc414a7769c14a86e3328508e4bf2580974e620017688594d721eb85ec357b140015a49e6881ab90ef802

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51c9981642f9ca29eec54935fb72a582

SHA1
9f503332bed435787c4f60ebf16b0c3e262c95fb

SHA256
a6655310dbe3a79c80a983d47167be08e67d9929c508d3f635e5312f1a849a94

SHA512
bb6de6f042fa1e23c7d26412a6438305739badd8481900ceb968e6c10fa06b26742899934241de3840f3b4551d22e3ee690747600474a88a54029f39ce2ccbb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66bec9defaefb0df27b4179607345ea3

SHA1
8a03b6859c89bcb8ab4ef657addab51f00a5e69f

SHA256
be9fdf88ef0f91efefa657e42507016f5888e2707e40d74eb97fc4cfa1ac3be2

SHA512
99246300aebba68d84b97a104d062cf78ac2b55033c1b934ca1a500a0b85a40def5af9008cda2d4bf62919fe2f9b4803bb72a714a7070f020eaafefe591ee7b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
628d1a93c3d7c2149b201bd967ee666c

SHA1
96f175b89b8b4c27fd41b98c0acf9dd2a67bdd3c

SHA256
89fbe5c9ad84c467444d701ec797f9d552f52740bf0343cbfd59612889259fa3

SHA512
d2790e58c8478b467829c0edf18ce3cc5985ef277384a4d2e3d1c1b2b5753c39658e76c59cb0c731f478edacee5d1236f95d674688abf05d09a18c8e91f2a901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
945352da6df660be7408712271c1e5c2

SHA1
6f31d1bc8ee173c7446000c77068bccc28dd6760

SHA256
3058dd44d49eebb6e195f59ec73c89bbb6f5d800b49252c33730ee9ccdce2edf

SHA512
a2338faa913a38bf7fabf94c4e8f2c3f3b8e68bfc9892d69010408a99d724659b138df441dee1b9fce639003245e9d46f24f7742d014aaed9cfb5b866e125be2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80f6af69f739940082e8b666d44a7567

SHA1
fb3c8b36eb8f9014971da4a487d3a07915a9e4e8

SHA256
1a38980c56136b06bb8bbfd63ccd6b6d8593459bc230d925df4cee0dc30513af

SHA512
03d49863b546fe96a0dacd8e401e008ad61c7bf6ebdfaa52d02060fd90489a71ebc12ab760df3b601ff18556acacd5bab9ef30bc5341aca6db77db4d7b99577d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ca0349905a0015c8244f3d5c1a84f29

SHA1
756b101e3eaee0d6f2c0cd65a48dc5172b0a7ddd

SHA256
46171b6b5d6af81a274a536fcee2ed7140704cd9aba60a150e5e1919218191ee

SHA512
17d9e8d3d8b928335b500ee8b1b516a8a7a5901d080c3e8c9cbe4b817c2722d238baa36ee6abe29582b512682046fd526ce2451906a0597e65678ab19cd9e263

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a423e7246c73ac88fd2bad61b373ece

SHA1
e9006733b0d8e6cfa3726c1bd6ec1f4777205f5f

SHA256
502aa0775ede2fbe79ea8bf6dc3bcf478d857fbbc3d9623a6cb0a9bf08209f48

SHA512
46f4cb23ef5a6a92264c0525e511a012223f768b885f5ba6335b7dcf79bbdae071605eedc257e59d08d479fed7814e10a4dc83444fccac771fdd305dd87be7e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f275e9dcea524988204403ea5001c007

SHA1
259f374bf802b3122816a837722ea2a4e4b1f1f1

SHA256
628c9732efea89776ad3524e71e7f872a50b45a266d8b9c2c4077833121f8d6f

SHA512
c73808fe1287caf59fc6e0dd8866880d0cddf0f8199fca2deb7929d4eaeea3b81c3de8cdb39bc4b874c836adc63115561c97717bd09430b64199847d2be4069c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8769.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8828.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit