31a60ed5c06f13a817b911afec8745a6940fe4247e1e1374a1a997460f499068

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

413ce3a81d3a1c56d9e084ae280a3619_JaffaCakes118.html
Size

126KB
MD5

413ce3a81d3a1c56d9e084ae280a3619
SHA1

59ca89a05313881b1d6607f214329b471806a519
SHA256

31a60ed5c06f13a817b911afec8745a6940fe4247e1e1374a1a997460f499068
SHA512

74f49e558c2657488fd40e86d5e70578c0dc93f10855416902f6013ea5226eba53f3a1544a55954d83e723d20e4c2ed4ddaf2e1f199902438a0977ee56b05938
SSDEEP

1536:SIgtQ4oB45P5lGyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:SjQ4oB4kyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427027216"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F16ECF81-40FF-11EF-AB2E-FEF21B3B37D6} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2640	iexplore.exe
2640	iexplore.exe
1668	IEXPLORE.EXE
1668	IEXPLORE.EXE
1668	IEXPLORE.EXE
1668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 1668	2640	iexplore.exe	30
PID 2640 wrote to memory of 1668	2640	iexplore.exe	30
PID 2640 wrote to memory of 1668	2640	iexplore.exe	30
PID 2640 wrote to memory of 1668	2640	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\413ce3a81d3a1c56d9e084ae280a3619_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b26bdfc5f1084812cd1678c94f88642a

SHA1
92f44f5a83be5e9b939cabaf267779069c618808

SHA256
1e2b427073b6a8e50ae1766eca04835ec2bf5a201bcbcd319e0cff048b01b9c9

SHA512
39b250d22e5ada4c892cc33a478ac06d5a16cee11b8a07fb5ac8e64f85d08c4676321f3222250a709d016f993e4973e176a569c6b79acd4f718e61c4f650c866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45e43aabe110b8402c55111ae33794c3

SHA1
c735e15e3e4c86f8299c7a7af6d4b46aaf17a9c2

SHA256
459e9fc577834e09e67a5cf00a0f1aaf8da68aa42e0dbfaa135b232afbe4cf90

SHA512
4af34377bf5f613d6c999d4313e578548b2c6f0589bfca5d66e5e055b3dc5af90c24a66f6e8efd5000bafaa8de49e92a168c58bd49263252ef17acb35c9ed415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d213bff3bb71685155fdaa051a8a228f

SHA1
b13dfc97107485fb96530c3580fc5dd438a8f349

SHA256
5dc7e69ca39ca1114b552d18d54680e15a5e2e4aa1d5a5a201fb051e55d63949

SHA512
e4e46d9a96d03125fab0718eb316ee29b05f3291a314a342b120d527e4ae3be5eaa11cba1f1271de6b70f7cc1fc739bb54bd3d451a9e3440265a9e243c5e3eed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e95e5980e1ce191ebc9305cb3c3a75a

SHA1
13cc6c9b616e3c735730070be4d79809315f7313

SHA256
3a41232625c5f27730a2d6d7662de35a8a8fadc90458c2865f443d903ad5c882

SHA512
0ac9a231c94c3a347964b72a6c57f0bf129857d64d1b800bcedc2922b8b9b79b01bdcdd026dba4d7afbdc829f240b3ceab4b29186f7a5962c6f25f72d0c1fc68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
969c3bf6fa32d4ba74d4e07573b19838

SHA1
9b11798317ba5d6b6ad00e28833f8e513b71b59a

SHA256
a9ee5c6d1d83594fc03cf813a414e2451a6dfb577660974b51b99d082710c03e

SHA512
911305faebb780b150057affbb03699d8a7a83791e938bff0e6ad5e50c775451a7e73ac4846a72378db41620b7dde8622a0628e4383dea94e84fae96d2943b0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
596c9f19f15d82630af5caf909910b34

SHA1
8f715ceaf3a177ab980e3da19a2239677f520959

SHA256
ddf4fa269a06d22c9ea6117077850bec477175dba609a7317834b224bbf8e137

SHA512
0f1ef563efaeeb9911f990e120cafd75ed6e7bd6aaa86625e0ee389a328fbf17a0a04f9392780f85e9fcb1db762d30ee1f5b42b5947a6a37def8d44e0750459f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c8d10bba46e11ac121e92aabf5b1bfb

SHA1
95c7b6849fdf90a0a18a80d318bf69f57952c1ef

SHA256
b2c4b5400e061c4f4413bce8f77b7afe0eb71cc919f9d3d837f50cd4f229df09

SHA512
3595a2c8ec231cf2c882e9d0424ae52ed461a12c4224ed01729133033d350b6e957fe7931887c86bf94088b67c87da67263a484fef83fc7bf99062b1a8d05df1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
156e1765f0302fb68439624260896cd5

SHA1
701d7ebfab696d624a95d8fc4fcb0c347c9fcb0d

SHA256
22d4ca56d2156f729cab84a6bad07de6c63c10f7c6dc6f68abbabf11db044f24

SHA512
0c0345804b21defab4603ec96856e8ee3e0e972a2f0f07b27c9df380cc511c48e76b7c4eaba341c51f0c236af0d8d14dfba6a299730e45c64c1ff8492231a67b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4d861122183a5d48711ecb3451fd4fc

SHA1
b0a1daa4695070409b90e426346f9161decd33a4

SHA256
0d0ae0fa3e897fad9c72c7152be2eb2de3eab35de5d2d7b05bb5dc97f3128195

SHA512
26b4ef6d03d1e0a3bcabc75dde5471be574ac414368e575ca5e93b1355a252da99bf5c828f4d4ff01fe8d7259f1d8fda5cc186bbd4c8f54f64c6e1ad9ee1638a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9935.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9A04.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit