4329f9041a9628d1363eb785f295eef02a2b127bec01e8153d041a20e6ccca35

Analysis

max time kernel
131s
max time network
144s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38560ce3250b6a3a2d87af70cfa76a39_JaffaCakes118.html
Size

26KB
MD5

38560ce3250b6a3a2d87af70cfa76a39
SHA1

6f91f0db46b4b3357f315854260071941d6859db
SHA256

4329f9041a9628d1363eb785f295eef02a2b127bec01e8153d041a20e6ccca35
SHA512

77e1af86d5b17704db39fcfa3b292e726c112419550a7b103fd6906f8e543616f38b00854fb9f4ce02731761aff229dbc73e38d70714ae9b2a9e34d54e021776
SSDEEP

384:N5lIcItG48ZaGTHkm9RRIRZt1E9cyGbTGJjoAuQ9ht/gbBLOXguLZ:nZwTJzyG+9hlglExLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426847293"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06198961-3F5D-11EF-AF97-4E18907FF899} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2608	2320	iexplore.exe	30
PID 2320 wrote to memory of 2608	2320	iexplore.exe	30
PID 2320 wrote to memory of 2608	2320	iexplore.exe	30
PID 2320 wrote to memory of 2608	2320	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38560ce3250b6a3a2d87af70cfa76a39_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d01797c0d7f5dfbe9ea62a2280e796fa

SHA1
83873db773479579a78958c834898379867cbe5e

SHA256
1cf323ecf20a39460bfaaf881dda96237149b83ef0abf74cafea485dc3111383

SHA512
f059407bde2d6be20c68a521b3bb1139bebf7c149797172346b4fed86a4429fb506c00b3e3bad7e303a550e179931dff75a9c7e4a931eb611f8cd8f022ba5ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be48c8339bd3d23be6fbe4b363bec3ab

SHA1
5c004025d829500d658f5f497ebbe681f8c21a5d

SHA256
c80dec95694ff75fd9b395244175f00f9aeab59d4062b5256d5e18240e5cf892

SHA512
597e0485aa070effe5cdca369caed1ba816e5f765353eefabe3da391799848f98835b7c833184f8c36527ac8fb0d8050a4e3ba606160298c63d6ae806e6645a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c6c15f31e4037891ece84828d423975

SHA1
6c3cfdd083d0e5aa2ca3c12d8368328c4d419736

SHA256
11215dc0212cf9ea63c3613cc8f1b10ead147085fa2c3adbde0d12ee0f83dcb1

SHA512
b89414464cf397d1b7d741391f10d6efdbc8e91bb8cd61c9402934ede9b836be80298b3e2fc797a15ed50290b01383ada625a27ebb9a8df32b84982235473e1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff8ef708b970bed46575a32cb0394a9f

SHA1
ee990c37d4beabf72ae9e8374eadf0553b8d3000

SHA256
6a08b56cf3da6535233d1b234d26c77e95339a8babe67d8ff4010151e7b39404

SHA512
ac754124a9f87928a94a60617aa45467ee5f3c5284c85568141b694ff53d39f8cf5f7898b9a19125caedb62d1a367c098016ece03f3f7dee6eda642e61676f59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5ded56a30e6b8a58b09adf34cc854d0

SHA1
dc4feda6645365e5e3152bd08909d5dc3c639016

SHA256
69b5a249cd6bcad2bc54bac548e3c207065cc7d56caa9ac3918ff04013c0cce2

SHA512
1c3778d73ce570afcc8b97f807cdf4d34945a35a7f88ec3be93ee6c7bba4db6bba755c7209639d872e727a19efa1136b83a352aeb5bf8835360d688421e1d4ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b4dcd387e8576435f1fe4e84bd337a3

SHA1
c9816c5ac4be361f65078bb6084bd9ac5f3f603d

SHA256
be68cbaf94452bf15fc10fbbaac4f2995a1fe18dcd3e1941ae25e38693db361c

SHA512
db21003dfac195012bfeaa86efabe8d555a279b517779ec4a6e1f59b6a7fcd851fbce6c24bc1a34dff715eb5035a56f65afd8353215e674779bb7ceaab3fb37e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec04045c2e7f20ea2bce0525e32fd468

SHA1
8bff61140f08cc5c2a8efdf651735a985292c911

SHA256
d3410fdc954512dafce194fc750e2e155150d6b4f4bb8aa0bfadc533e063804b

SHA512
9227216b5bd05c64149ec723c281a80bd5a4261a9198972d6093a8b5765a175c5f9b72255cb553a99e4438a2ed71e36f537647a489f7d756cba73d5ac04a1947

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab19BA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A69.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit