5a0c6ae7db947809cdb2bf549f5b0dbdeed9bb1bb452148f455265a4b2f29a78

Analysis

max time kernel
99s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41de0489f36ef4e79a628ee3e7b190c1_JaffaCakes118.html
Size

19KB
MD5

41de0489f36ef4e79a628ee3e7b190c1
SHA1

7492e815a4e426e2066f1025dc30e2fbf2277939
SHA256

5a0c6ae7db947809cdb2bf549f5b0dbdeed9bb1bb452148f455265a4b2f29a78
SHA512

3816e9f38889b8033358a9dfe91e4d690e5077059f8166037d3c15a9d328bfc1d12f47b3aae025d77a26595b433b89ff8d7f1a554e82f89e99dab5d9d48f5d86
SSDEEP

384:P4lIcbM3tSX4foe7BGTHj9OVYo6/gb5LOXguLZ:iKowRYglExLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DFB13DC1-411B-11EF-A251-667598992E52} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427039214"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1512	iexplore.exe
1512	iexplore.exe
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2412	1512	iexplore.exe	30
PID 1512 wrote to memory of 2412	1512	iexplore.exe	30
PID 1512 wrote to memory of 2412	1512	iexplore.exe	30
PID 1512 wrote to memory of 2412	1512	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41de0489f36ef4e79a628ee3e7b190c1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e00fb2036889707f1b5354e0ca33f824

SHA1
09f1ea937ee3a5e68125720a1f6d55bef2cb4f04

SHA256
7f472900921093554d416cb7fd9fd4c4ea8d2c5e66ac232ea12de9795f14ffef

SHA512
210ebf2a618070a9abba33dfd4d3ecef3b346e24ae819c35e37231df2740e6c3bd7ff3511031ab61af4fafd0892492e8c696dfea9081559d342e68b492f9ebe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30177947130d7b7af01f9ec50f13bc95

SHA1
90f2352c3d6b5a78efc3f103772c00326bbc834c

SHA256
57e10f7f9bc3670eae677ca60b1cb627741e74559edf81411b7c9eccb3c7df9c

SHA512
05f4fd1c703d7598958dca05f56918668ca410bf1566faf0cb50ab2f7a08d29d6b5e860f0bb05d96a7987f1d83891e428710e8a30513c89b934fa13b5484c230

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92b912e3d5ff7b91f2f9fe34c7c05399

SHA1
5b063632dcaf759ea47366101d5fb73bbdc81c5a

SHA256
47dd1757e7dc8e35ee4460a3876363ada5669a5ebcce9d8c6263e71662745631

SHA512
bb37bb140c3853c0f6ae2f20b0754e49e1bcbcacfa704afb44ab76993deb0ec36ac3f31cf9ea15288eba8114dbe607d47359a2bc58ed65b5ee3b620fedf3bb07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fcba937d71c28af86822494001de5b3

SHA1
35b30dad993e7994843637420baa0da99b81cda3

SHA256
c1597242794495ac2f9e24af5eccc786da582341ca89bf3082ca1862b27253ee

SHA512
247b87e199100c67eca3b7f52b939ba046c2a6a73b8a37dd5a204def17f970b95da3d760836eee82c1667bfbda3f8498085cc4fe96376b6bc105b2809cca6f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c61a9a603adc989bc2bbed1f8b55cbec

SHA1
368567cafbe77f26db4c88dde0c22763d9cbb9c1

SHA256
53ff318f8cad336dec61d166ba92a4b972806c49f16c27c82d5a317e9908de61

SHA512
421db2f2d3419d89fcf9d3f3be861428db5d81cc69e7a00857841b1b370c53d8c17c310dba86c6fff6f3bd52c16bc4d8909bb4c08b0096b60c6382b57f0c9c43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a97b48ef54667cf18441654b5cae7805

SHA1
6c89e3e6dde5e1739d3742d6f0f62b7f950f39db

SHA256
7384b7f94a6a51ae734550f1c13cb1dc22456bdac40fe762f83a4ddd1ea74a4d

SHA512
b1b59a45f06606a035e49f740465fcca7382040af44d1aacbe7742a1cc85b83036541a35bd9f7d000aeec0292fc7c786a6ef5eb2836b5415163d4f1a2c15bdfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9524e28e02139d0d4c36fe4d12abf986

SHA1
529c3502b445d3baf415f347ed4896d77dd64c77

SHA256
95c26e62033e70e5a02e980aaa95e707495c5a432b614c3eec5ced9056267315

SHA512
1cc6d82badc487b1ef7b84c24a0313020ac938d33420b79dae382c6459959f55a1861a94c2efc57779fecb3e1dd95bd759de009f31abed68f2980ac8168020c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ec0f50daaa4082412cf29d46c4d64ca

SHA1
20f78e2552cfdd12ce478437dd79eb8966c58f87

SHA256
669b59864260c7816b902e6a27081c1a5628de96b75347114d53068021d7504a

SHA512
0f2e1977d9a64a9e42bfce596ac133ae5b5970362ce5f91ad1c0c932db5f45bb8a2b8b7f8f76b5dcf627882ed0da94dce4c2ba8c488874e13970a960b5c7dc90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
902927b303819d2837b8c6b243614ce9

SHA1
6052755fa9d813df4940c1939ec24a1b729ee595

SHA256
f87b46bb3b1dda3a84cd961977ee21998e47767cf82efec39102721ad63f1741

SHA512
bc80b0e5e797e3186abe4bc3baf0501081d06301b9f54ba3cc017277036d3a4422eb2d2fcb34b5021bc13d636d2a1b3096b2b94a2a90f4bf59b6c17deec03e37

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB848.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB936.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit