fe9c9c2c02288cf67d6ca00bfafc4fd4887265236d960893b92326e3bd23afad

Analysis

max time kernel
148s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0172c4a21b28189cb2bc260a28be4d4c_JaffaCakes118.html
Size

18KB
MD5

0172c4a21b28189cb2bc260a28be4d4c
SHA1

127b2789e5c57ec6798e492e27d32a1554195054
SHA256

fe9c9c2c02288cf67d6ca00bfafc4fd4887265236d960893b92326e3bd23afad
SHA512

3cf3f29a4f8dece7735ae70fedea91c15333f5bd4d0c3ea9e8a757f46592dc03436673af728cbace4906bfe1d2a4cb3e66779be6a98ac5bb2e3e5eed309cdfd1
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAwm4bzUnjBhJj82qDB8:SIMd0I5nvHWsvJYxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420320049"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A5E3601-03FF-11EF-B937-729E5AF85804} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1720	iexplore.exe
1720	iexplore.exe
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2976	1720	iexplore.exe	28
PID 1720 wrote to memory of 2976	1720	iexplore.exe	28
PID 1720 wrote to memory of 2976	1720	iexplore.exe	28
PID 1720 wrote to memory of 2976	1720	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0172c4a21b28189cb2bc260a28be4d4c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03858d97eee38de09f2f9a8d05a8a893

SHA1
8075647bcb31871a5a8dcf2673d3231c639d5d57

SHA256
da64f02a87f5ad42375fea9afcbe545b9e0fe83a5f0029a0d88bc9626ae5017c

SHA512
e267b6edb591154d88d7f2d91dd5d7b692267c6bb2be7fc2b0834e72b45832e41c79c704bc7e94e9329eac36b2da435061f162dbfd83621005d3941df19119de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83408a2e927e9029af6b57690cdd9d53

SHA1
2c57a673142b3301b823817957e5e405be6dfcad

SHA256
650014bbd9c2239d21acd70e0c5b51f6afcf42476fa2be54454e591b751a6160

SHA512
582b602591048dbc4d37b003e29f9f624b01b858134ed91b9a6786829584713579185eccde282610dca6f2f7b0802a84441c10dbaea81d45612f35f258d9d06d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
306a2118ed72ab18b7223608b74c7815

SHA1
af11620c808a93908d53f9f73c9a9e65976b1605

SHA256
65f08b127ae2f701012b6926ee6b9b46e7dd11b4175ad3746c04830766bbab2b

SHA512
af9cee3c0e09bd4d45123d32bbfddc88201e0ba1bffa0679d6e9e9685d63434a4bc228e0a958fdfc86fa362e0a06678dedc74020a96b701ae2559257e05b4e9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e560c6a087be16f6c26cb1686d91c5d1

SHA1
607185c64af80b9386fb076289cc4f6c6b2c374e

SHA256
41108612d938be49dc5713c3d9b574d4118c21babddec01ba7ab92252ee70d50

SHA512
611f739f31057b5ce108ad646675bc9e0c186c62cd5bd88696823d60ead0c063645bacf2ab75ba121a85e8faca783ae1b17d4244512c12c11645b499a2546f68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b551acef0550cd17f8c673bf92bb3e3b

SHA1
41668c2bc1479e871e48f4d83e83de43cdcc098d

SHA256
95baaaafcf64baad7d5ffdeeb17454c125d50013268131cbf39539e659b17ec1

SHA512
c2e3ced95a6edd5a014777d7c47361f3182ab94220e0653778f90a7359cd365a47150328cf81b662fc58ce2fdaec754258d4dbc4fc6f2108338e8f9482f4c4bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bfb0feed314b8d0e353ea9e2a3846a8

SHA1
e4128e4caa7ac6b64eb703e2dc4461f7e4785576

SHA256
97375debe484d55856b15b1873a825762f8051c5d196cebb1ebd5d5943ed8ebd

SHA512
98b99639a28c3087a536e2510c168e883f28b814d671af729b90adb385f00959efa68531b1f053eb884b5442d8dea9251f285aef587f80d154858265d2b1a909

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb3a2667d0306eea6c9351808d3d757f

SHA1
d1364f03d7144734c7097c28ab6bfeb9cc2056ee

SHA256
efc179cfe073aa185f0e8f54aec56c61c1ef08a454c0e2f7ddc02c96d7d9339a

SHA512
f77d67e081a1a4cc055b3b7d90594cb281560fbfbd96c0d45e6bd68fcff1ea3c6e70ab6a5b3c6deace9d588bfe8c1dd27d1cf400611e8f2c436d79b829316296

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64cec34b5f335bae57311f12aaecfa52

SHA1
44d5cf1ab5f158115b2d5b22dd72778679fe77ce

SHA256
20e374c988671518ad94172a525cdffc5dd8f52ebdb4cdd249e2939b43a0e912

SHA512
4c5b62a4439e60eca318009e97695f18df084833313f4bfed7966fd33330f564bee1f11015b092097fa7f7eaf28301444fcebb68e1ad9ef525544e04945744e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c235a87e8caac9f56574859903763dd6

SHA1
7e8a002da6fe094da3a827ed74d03ea1e1c0f51c

SHA256
18ff0ad11d644090de42309bb5ab6e5d9df50a30f76c1eaf9aa1356fc81c7425

SHA512
6c7d6cd6b2704d07cbca5ba606ee22d8ed98fa0fb71ca95061755a9c8b16523e86a234fdcb54c511c380eecba511e4b5cc97f1b17841a046c85560952819cbf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB78.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC35.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC49.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit