c5d5bc52e9511c74dfe62e101e97d2202ba3ebcf02df6cc827f1288861fd084c

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 03:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0253ff7d1ab8c4ce7d4d0200ccb57819_JaffaCakes118.html
Size

18KB
MD5

0253ff7d1ab8c4ce7d4d0200ccb57819
SHA1

0113f34b17e2535867c04abb89ada94ea9f38040
SHA256

c5d5bc52e9511c74dfe62e101e97d2202ba3ebcf02df6cc827f1288861fd084c
SHA512

429c7f75272f214831f9745a90ff1fd19bad7887750885e8f79048bacc2dc8985bb59a2ef7ca9aa1788ff0acfc07f16b7d14d52a9179d4e2ee4b050cb468d7fc
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIF4nzUnjBhxr82qDB8:SIMd0I5nvHFsvxQxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420350787"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B9DD5C1-0447-11EF-BEA9-FE29290FA5F9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1540	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1540	iexplore.exe
1540	iexplore.exe
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1944	1540	iexplore.exe	28
PID 1540 wrote to memory of 1944	1540	iexplore.exe	28
PID 1540 wrote to memory of 1944	1540	iexplore.exe	28
PID 1540 wrote to memory of 1944	1540	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0253ff7d1ab8c4ce7d4d0200ccb57819_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1540 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a92060b7d207edb2a17f5bd92e3cd5e0

SHA1
2105fe6378b87c09a6db5e9e80f7851a72ec3c4f

SHA256
4b17184a093d17c64d7ed94ddcd196fd3d17e7c753fc99156b04905719e56f9a

SHA512
819db6efb06723681be56a131e5e274ed53e496ab506be76cb2ece9e413177e40b7a352dd817674c20bcd4ccf09e35b9909c640e464c49e391eb4f55a96f3dda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3054f30aa8c101bb918effad9742a6b3

SHA1
a1cf650295300226ea159cb287e223fe27c7c15b

SHA256
9a01b007c4f094def1bed2021022f66f909d1f90f3e594cd8d7d176d1c4c2936

SHA512
af513da9e7cd5f47b9f623110131c87e9f469e2070eb7150231e969c772cd78b1188d7a215dc088360af3ca329c2c55e4cc2937ed8b92ab81e37fd0ef700c566

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5a987a18aa0d55539415dfde4818fd9

SHA1
37005f7f02ab83cc4ade8246ec731a8cb9128fab

SHA256
4f04a0ea12e037988441a9a0b4445228873f14a64abfe1acd6ee6405e74d6704

SHA512
71e3f9086a32d04cef50ad2801c7a5511d7a1905a7cb36365274322fa49bb582da91c45525d2d1ea4fc6e85a23449c8118a0e5789a9cbb368cabd68e29db654a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
736118d8deff44094d6da1636d22855f

SHA1
d9d05bddb1f601cec7274341a0fba575e732b69e

SHA256
412f719f984341d29f3ded62cf05155b3700f7be30fb9891be2edfb041e1f29d

SHA512
38ccdef5ab381e7e7bad201f0b0868199c7f81c5c07740fbee5d3bccc354d810b4358c11a3e53539f4af0df4e789bc3d56aa0ed1402d34eef2034413c56e52ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6a5c5bbf6d57f9ba7b37e8d7636440f

SHA1
f0ae2efb220bd8bf0c992057ef6faaf6c7b72d99

SHA256
0d28c70c746892f6074b6760cd0c27d03c54832feaf5656788e24bea1cf2e876

SHA512
dd236c8ce86dd9ad686125f213736cab9cc6ebdaa6f9e1884c1d45866d135652961cf2742ee6d06e255292430b82a80d6e308ed897a4799758298ba502a4076e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf251f3c147ed63b949df2fc39f5eb1f

SHA1
5ce3a31d149fbda923d9818f5ddfb96592bce9e9

SHA256
810f4a607bd2c65cfe222ac15ed31f6717bd31bd5597001fd343e4be04258b0b

SHA512
e2737e6c5cf7d5080b64260402977fd07b907d77b410d3e3efbcac3cb96721a9787faf32340467bc9f43035952a45bfc537413ffe5793327a960cf929a4b7cfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d197668edc421420ad70247b78925c86

SHA1
01d579f94c573de568cdf344aa10c3bda2364892

SHA256
af86473b5bdb99b1fb321aa9219244ad9c3f11dcba0b93bfec0e664fc2eebbf9

SHA512
365210e4eb041a209cea5eb65a7e35b8a1b2d6a0323a0eff8c159fa4f9ad536e9b873013a955bc54490c34903c49a1801a7b665357b2b159943e2b0e6df9d8f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80dc0665de0b7a3953ea85d30f444160

SHA1
7ae9aeac29545f4071953abb48c5edf55c5006ed

SHA256
a76613a2827077cb517b6945cf5c7565f543e7292a16e8bf56f4a0362e18d9a5

SHA512
b085adaafa4b3f9acdeab60264c0df5da89748e4219793a5eab8ed4c56ae8c8af9ff68f155586050b33aee645ade51819b8e1755db1ff15bbcc97023adae6393

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e38cfb80c34643839c0ea0ae849f5404

SHA1
b28f8e81221a111ab371c501b804a9b943db2e57

SHA256
20e40831eb0bb69f534836540c9962a3666c06e42b95eecf7736b66cc7d7156a

SHA512
ff419c2e30c0c7e9b6b60e413570c5d76fb0fe7eef9caf3264b299078f96d52e700628396343b06dffc01ff39e3ada3fdd9fb42a0d715b63caef5dede7b855b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
539e7149e5643bc970850e642a307575

SHA1
15c356399810a4d30761079929f386ba17600c55

SHA256
7de895b2ae0dc98c183f8ff92ba553079cb91fbe807030e57e61f17320dbefb7

SHA512
ec68a4878e67a3bb13d1f9ec9a8e6738bd2f8c4ea212da3c4d1585cc35bd614f88f68cf2c8038a7205a499046a8aaaa38d406846dae34d37f22acc731ffb80b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
0c491eec96211ec18ca0753fcb373aa5

SHA1
be5ca7ea3427339d8222b5ed491e4b03f679be65

SHA256
0fadea155c10ea7393036e7e6e2fa68b6d34cebd303565de069dfec25c761a69

SHA512
b64f93428a49cc335a21767bc3cb9ec57a185416732f647206ce256432148f0e4479e7ab17a8a222e68a4d6b96038754cd6c8b6dcda6ca131d6eac6398298a59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7BE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar90B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit