41b6e27ab32b46fcaae7c8a0c293e2c1c754e012ab7dc0536253bd009c678d9d

Analysis

max time kernel
135s
max time network
141s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33af7b090c11f8a208dfaeefd1dd4845_JaffaCakes118.html
Size

11KB
MD5

33af7b090c11f8a208dfaeefd1dd4845
SHA1

799f71618fa317cee1e798aa4be35dc2fc84eb43
SHA256

41b6e27ab32b46fcaae7c8a0c293e2c1c754e012ab7dc0536253bd009c678d9d
SHA512

8751b382c7447b4026bf74a964a7122b4d458e0e6ad9446844ae895ef8588c35ee0746741123f4f6a815ad3b76cd502e65c69823c37b107727b927eb9d2cf618
SSDEEP

192:2VnlIsr03TQ8k/w1wvqLkZGBelnDGqKf401OmvLuBuLbdU8d:snlIcuTw/guGBelnDGqKf40OmzguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D770871-3E87-11EF-BD32-F6C828CC4EA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426755419"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2324	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2324	iexplore.exe
2324	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2236	2324	iexplore.exe	30
PID 2324 wrote to memory of 2236	2324	iexplore.exe	30
PID 2324 wrote to memory of 2236	2324	iexplore.exe	30
PID 2324 wrote to memory of 2236	2324	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\33af7b090c11f8a208dfaeefd1dd4845_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8abc770e7e7038636159d02a8d0ff8db

SHA1
08033ee13d1be1540957a395c09e139bbe8de765

SHA256
f47f895cc7d97d3f083c7d93efd55126594af2d432c3fff937524a8f754f72a8

SHA512
8faba3f5c01abb3b1b2269a1afc324f01d1f77e8155d7c94aac6a561f07a7b34db7b780a3762e9e1fb829265c0b57b929ef1773e30b66c14f30d2e1737f8f6e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51828d0cecb57465f3e21f38ed4e4f5f

SHA1
1c39785d194ea6a4e56194b1daf92c78f2aca2b1

SHA256
a4dc5bf6fcea1b314be8f0350b326fb5e085e9aaadbb6cbc352b186555ef46f0

SHA512
a070589fad37858ce70c7900378e097db8cdd76cf648f72e2918b95359a7dd165ff067ea2a4a382a2040ab2ffea7045dc1bf5f3120f3289d96c121404b6d2f77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77447e31c478416afc120001a656e649

SHA1
86bc2e7e28bf7f8490794d6d0be00112a32c3624

SHA256
38382f5eea23892f6af412772ada632c48506609895ce45d714bff9bae73a947

SHA512
ad012120e34f127f78acc0253ac6addec3ab800ed437da69ee37cc6e642abed39071e12356f4ecf65814ab1a701cfbe5904d07adf7d433742dd1fbd893130f80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae88b40a6b0473d1de510f92c78c4454

SHA1
d1dae34499cb584ca5f7f797dbad4f2029bf7467

SHA256
b3b6b6fbcf03b07c28fb555c941662b4e3c4d272f2fba6d350a9df2b88795296

SHA512
992cbe611764d75c1463c1ae7ccb8e46fed149fb1aa69d0d55ebdd4e953973cf50eac03f1a846cb385ff4d603bcae867c867cb0c5d0be1a11685d7f2c1bc9003

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bf74d16a79b221b2a7e97dfdf12d378

SHA1
1059e2c0e6b7b56988f8a3af82c61341c16b7655

SHA256
987035737d025819292e7b65689ea7897d1eaf3893c00e988646b78002e202d5

SHA512
6838c8bf75f28ec6cb2a75766898969159bb0c89b95c0c601ca8708f121ea1f2b826d1880428e86083b7fbe48ffe1f585b750625c8ca349f0a0044706c64ceb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0d176e7de2453d36c060a464e1f2899

SHA1
184fbd9e923fb988ad5dbe42d9cf324dccdd34ef

SHA256
0889ebbccad8f52814b5a8722591df93c02a8e4d16af8ab95a83fa0796be3107

SHA512
df268a44c7f420abae53e20a009b3f8f8a107637fa39d582516c7d88ff3e5fb63d9d0977169feb5ba9b65bbb466f125032e110a191de5d156e731a33817f6364

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
902fd8a87484f541c8f7fc73137cde46

SHA1
3954bfb34af67fc136385a37c19124aa924c1ae4

SHA256
dbfa52a794451d607737d3fa34e59ab46808f8bb0a758fe0e77ac4b466e2e417

SHA512
ad9d07ee6eb75f944be42c420eaf15e5f7796f8378603b743cb19a096b4a54490fb264a1c02bc6318ba0ab2d8b3bcecca2992ac785d66fd938df1bdc5212e290

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fd0056f9d84864b8e54c1c60f351393

SHA1
15fa101f81a654db42927403e55e9e9649e7be21

SHA256
7b99374d6ee0f5634e0933c98cd2b72a2d9eb0b7fd81bb6ff8823f9eaaa54c64

SHA512
9cb86c4887b72f9b9b8e0c93de4c057b01ca7a651c3402525965a778c3215e2757305841198d364166bfa1ea240537b1620bf049ec36779e6a9bc2214a9280ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12c6b506f70a7bc96109a3255e47e277

SHA1
d7058ddc602348da6f0e945945064407ea75d747

SHA256
0fe64bad857fff3c50142fb160ce9587c0787f5743d320fbe7ae6d640f5c9f09

SHA512
10a832d12f96a4d38a78bf5750db3f84e22b8ee00c16886b7beeee6188467a05c651315c11db0d11c13e2194d989d57deb60012d9e629c724b80f06fbf99ce5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9FE8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA0A9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit