8976010f0d91b76059e5a620af94876440481358ac50b795ad0226db09ce89e3

Analysis

max time kernel
147s
max time network
142s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 03:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4c927ac02fed984d5c3214348d64f244_JaffaCakes118.html
Size

49KB
MD5

4c927ac02fed984d5c3214348d64f244
SHA1

15b6a71c7c510bf451575a12ac6972dd2b5f206a
SHA256

8976010f0d91b76059e5a620af94876440481358ac50b795ad0226db09ce89e3
SHA512

220c8b6b1a9efe020b6d341ae8d7b97a79b9e6bf67ea36e2b68ac64aea1cdbbf43cc7b2490831e188fa93620610bcd3f7111ca4677ddfe1fd542c132108b7b8f
SSDEEP

1536:WSlUGYp43K43RxKSXurnKt65YRhhArB8bm3JXo:BP0UxBurnKIYRWy0Y

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427261472"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5CE77871-4321-11EF-8E00-526249468C57} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1984	1740	iexplore.exe	30
PID 1740 wrote to memory of 1984	1740	iexplore.exe	30
PID 1740 wrote to memory of 1984	1740	iexplore.exe	30
PID 1740 wrote to memory of 1984	1740	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c927ac02fed984d5c3214348d64f244_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
249942c4dcdcf4154280dc582aaab990

SHA1
a9af138c24ddd0623e8d7a95e6799e5825c54872

SHA256
84013e5100f84c19ecf1b77f4c8bcdc5112612a47607580bafdda108b801f6ea

SHA512
ccc5df4486f4c2ba2b5a7d328eca7953cdc48c4e49b182f78bb908e7100dc257147993886bebc77f050764dd3f044a17aff6983f346c67c85368cd4bd340f10b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
223340ef950c43143fe623e27a0204ea

SHA1
dc949575669c06fd0bf0bd888e36986091c45f30

SHA256
f2e47a67c068ee29d955cc5c494898d3938093e37e59100cdc0154564f1a17e1

SHA512
9458dcd2e23099657230df2ea4466f53e31f9c88970e9e74003f300f946d4ba537ab1415ff4572428ff3612de26b0c471661e99f9a6421df6b75a619165ccd7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b96fbbe2bd0a98200ba4ebe52a6bfbba

SHA1
a278e36e14daf10195f503bd7d2e73cda57bd302

SHA256
d8f9c324b0221520a25460e34dc025e0b48904393fb8ad0c6dff1d6c281f0e42

SHA512
a2330e1b7b484fdef02828ce421127ba1392e5994d412f3f6c70594830e7674451c0445b84b6066e00d13004be45ba0757fc4206cccf61a907809d75394b9eb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b951a0f48fdbd8269e01e02cf65c9a1e

SHA1
d71dd8d40ae48c1f1b9bf2f9c007885ad02b311d

SHA256
147ab90e872d37705fe95554bf883b877cd0b48195f11a97acd9ff2cf103052c

SHA512
4f37b084d5a284ec6bbdc72beed8517123d24d63a1c01fb3855e74259b5df03af010a47627d9e9f22e13aaee0ccb04ada29b266572f4aa443e888ce1d1303a36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1461009dd6dc2c7e1aed07fc428b864d

SHA1
f426eb5ef8eacaf26bd7b212529c330a7dd604d1

SHA256
e48115b427da2f06b91a8e9390c4f88681c5bd466a85aeec91b139f50b1030ff

SHA512
88f93c59c20714d75485ebe06035556bcffe8d0dc24583a2086ac62a9e925592e05e36d31d20c5f4b62b3b1347704d70dbb561db86b76297cc8c3a8a22e679cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c7dc8dcd5b20218d99fb766ee3dfd2d7

SHA1
e8ae8cb11861e8011bc2e7e03bd8423d04e97304

SHA256
acd043f54de7cbcc2156ab9d76c8dd405572589b1abed7df2f2e1d664dee1fa8

SHA512
953f20ca5cb180d60cebde464066e854dd28b72c7eaebbdfcbe1652bf079b3caefbfca2a15108669760d647c8f8ab8fb5a696272aba0a9abbc77e7d72b1e7989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b619234370d06090fb1685ac61b5987c

SHA1
a77feaa94e936a5d752a1923e5e2bfd55eead1eb

SHA256
779efea602cb8fa0aedb224a1cb234abfa4b78acc39d5b08a981be21936e3429

SHA512
dfa2f6a1a01f6bba94cf6160b47e76787cb919e81adf7376ce637d3c1bbbb5d326d370ed765dba710a95ab3bbcf9993eecc0bb60e7acd662f51f8e737bb8582e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ee28fa6a960a5fd71daeb21667840f67

SHA1
556844cef41add67ee4a726fb3543c8f17392890

SHA256
62d8fefc92a02eb17ec29796f920198f060cbd0974516725a7eaa6d4f1569d35

SHA512
5328a8ccc44dff66678e51eaefcf5dfea51dd38f02d3a7b5f6786ac7edb03fec5c8b0b2246cd297f4471c963cc5750a7b97b6a6fb177c0ece2a6c523241ec9ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ce1b2308d28ebbeec109fd3037d375b8

SHA1
95005176bcc93a952d95508b7e35e25c9dae913b

SHA256
e38b3813703ba1180ef8168ff7a0a81c773e561aa910b0d6f48f330f0d20f594

SHA512
ed7aef99b5c6d74e25c4fb66480566eba573bccbaa8d98c1f8568222e0fe3c7643a7c33af0176c858541ae87a1cd608cc151d3f6d5bf1f1067db52389d2be77c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB29F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB35D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit