1812a1adf16a286a6031f1366a58b16c3bedcb2d42af06807074e71685644266

Analysis

max time kernel
67s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 06:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c5f507c81527ce0c30fdc8b6cb3a7d9_JaffaCakes118.html
Size

11KB
MD5

3c5f507c81527ce0c30fdc8b6cb3a7d9
SHA1

55cf3fd3670bd95daa4a155d93c9a03502a8fee3
SHA256

1812a1adf16a286a6031f1366a58b16c3bedcb2d42af06807074e71685644266
SHA512

9086a12c8c84a6519d9fe61bf65dac4c0ac8b85787cdff2d3eba8c1ba51778b5ef672d6598f69ed344bfe0c8bd772bf21d267f25bcbb524c55e89264bf7490bc
SSDEEP

192:2ValIsr0r57MSxtT8K/w1wvqLkt1e6uBuLbdU8d:salIcIQSxt/gqe6guLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426928993"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3FF5E161-401B-11EF-B58C-DA960850E1DF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2456	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2456	iexplore.exe
2456	iexplore.exe
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2852	2456	iexplore.exe	29
PID 2456 wrote to memory of 2852	2456	iexplore.exe	29
PID 2456 wrote to memory of 2852	2456	iexplore.exe	29
PID 2456 wrote to memory of 2852	2456	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c5f507c81527ce0c30fdc8b6cb3a7d9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
189275a8dd5af6b39e67a4d7cb109be4

SHA1
f8ecd976c4a42907e362b0730ac0bb2fd2442ef8

SHA256
e108f7802bbe743786dbb29ce32aaea6fa6457ecb89fe464c4c539a194375644

SHA512
31444a19b01ac5df8b5fd6ac4210a3b10523f00f273286f141bc2b8377308aa9f72c11690111434d0f4ae9f8e64d3343c0923aefad76fe22b31bba5f9a86bd62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e5f630b38e24c940d17ce1a7806e753

SHA1
100c5bab4068b640da3552994b923103af8849a7

SHA256
2816d624ee2cef52ebe2e9e31761a28cfb4f3f38a84a85bb098ea1011eb4c0ed

SHA512
1501310b1fbf5d497d82da60d18b3c52047089082bd77d256c96a661c25cf9390dec01215108df903731e54f6a5d47891b8eabe7beffb52330b94bf40dd77545

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a85f638d293267aa98ca687871bd13c3

SHA1
aa39fb95971ace4d3b8c20a6c199515227742428

SHA256
b5c2d47f9169e722eea7cdf3d1a842692397eae098e6aca2e797e13b9840d162

SHA512
bf0a2e8efc1a9c50530466169d79d90f9ef54dec492a7c48c495b2ef3513d846d514134c073941e65cd440fc778fa1de4a7dde4039f02c155bdfee56720a30d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44b6ad9b60a172deb99be93d4fe54d1c

SHA1
5d752c17c5d13060a95bc14c29a8aca2bf985d38

SHA256
c67bef29fd2781caedd37b8dd73b7a07dc5a85485a8f8fa740a36f6b4ebb1a32

SHA512
27e8de02bdac113321c572d594a5c0f0ed21acc3ea02fbab23526f95156128533277fe30f12ba6caaf3a0c6bbf14ba854ed3d374e65aeb174f7ce4c9f9557df9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6b55162be0a3e46cab5fdde57eeabf6

SHA1
3e96a7e265935b0043b5a724d9da9569454b2af9

SHA256
7610881231088f4b7492b1721cc17b8ac174708092c044820c316a1ee65cc22b

SHA512
f1c8fda54625d7880026375d7d1001874220a2e0ebc4edfa326d0a3a442dd9e5461f737c17e4da0e2432866ff062ae17b29323740ae5c5dfaefe9ea9b6b3477b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37aa0b19d3f02c74a189b5e404234480

SHA1
d6845de884ffc004873668dd25e7db762aa088f3

SHA256
50e696c91535d3293b4b08b835f34c5101d80faeaa15324c6ad14a5bd0fa46d4

SHA512
8511cf2a9b7887477c85242ca0c2e2ddafab0d0e75fad4f7f919f51e201a3898cbaa148fa59e02ac43957595961afaf971ba13641d52550ed96048d0b93f0a56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4901c19f73b9444145d3fd0348ada897

SHA1
ae77af5c32694f6a1754a36cdadac0258a85509e

SHA256
c9f3d53d5c561d7e13f13704eadec420187a7cda7bc599dda3a2594a88a36b43

SHA512
57c325fb65d141246c3b1d8730a117a8c0fdcf14a2f37907d2b08aada2c3f103ab2296699965435c119eb9a6e8cb9c92273ae647ed86d63752ebcd5130f9cdf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
863d4455ea20e51a84bb658e53ac9276

SHA1
c746d692c8cb2f4e80a294cf825292d8a7625bf9

SHA256
54588a70228c9435c0ee404374a700460345a9ac85d433f31ccee55dfccd82e2

SHA512
a8e188172610db7c0725416dc12b05aac61eec07b2b7b9b4032d897d89439254008d3d793202fcfecb9d1c38aeb4b9359688b84f359f88c32fad95cc27782b66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebcd854c0f82a23532ab605248e0b169

SHA1
f6e8d14e262518ac09bca3e743029fac3e7b4f8f

SHA256
cab155c95c4ec31af42b61e7904a67dd5e58f5cbf1ad9ffeace92189aa886eee

SHA512
ce561819557fc69c0b764ec503fafd1a6b3ab14730b73dcf156aa61716b9ecbe23b499ca87e8c2af837ea7b93dc25b0b1bfd6b953eef288e669328468e5b14be

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDCCA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDD69.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit