13c21903272dc2e56a0f520b40b69cae72267a5553063a757b39a5aa078964d6

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0603d980131ccc6c0782422330229d61_JaffaCakes118.html
Size

61KB
MD5

0603d980131ccc6c0782422330229d61
SHA1

0770a091ad911b841884e398837637e694064bc5
SHA256

13c21903272dc2e56a0f520b40b69cae72267a5553063a757b39a5aa078964d6
SHA512

692344c0ac005b7b069c6b431c9abf1b7355a72e0d0a09ba0786108263bb0d051416a1171842b5ce0017bf708bd0dce14b8f4bbf98947fd1e7727531bb6854ff
SSDEEP

1536:OiIunIUXElvPf1Ca6jI2bZgivjzUbJguPv3L3Fd1ngtM48tRJ/qud5ea9hLtMchQ:OWnIUXElvPf1Ca6rHkdFd1gtM48tRhqr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420498304"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A29DB981-059E-11EF-97AC-52C7B7C5B073} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
280	IEXPLORE.EXE
280	IEXPLORE.EXE
280	IEXPLORE.EXE
280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 280	2032	iexplore.exe	28
PID 2032 wrote to memory of 280	2032	iexplore.exe	28
PID 2032 wrote to memory of 280	2032	iexplore.exe	28
PID 2032 wrote to memory of 280	2032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0603d980131ccc6c0782422330229d61_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
392e47b6d1116a716b2397790eb3bd30

SHA1
b9a8706e2f1924bf9273fa86d113482f3fa6b419

SHA256
5976b5b35df66e50800fc595ba9632938051ba848ad1a9dda09bd784df3fadef

SHA512
a47b9c5f495e7b1fed2b3971cdc59bd9b528c021e21b5bb7527ea94aab75543c7b92d13d1af679056d5b76ed906bc7691c7efa1e16dd6d7a1e197d7c4944ce54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e14ce6b566a1d95a34cfa904ee12b52

SHA1
c8966f0453dd97b418d93a464937752684a55b15

SHA256
3e628adf731e1ec0ec236bd713657279e1c232ec07e82bdf74ffe00d73f52b0c

SHA512
64eebd0b850622f11b8be605d0dc60a55ebe077c4ec3b93e0477b5d37c4f302732fdbed930133c9e2a8e4a582ae9f60ccc5c82a75568e1d16325de8842163583

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45003387ed68cc2399402a6759564c69

SHA1
a06625a0aae9eccd87054a321dffef9a27bfdc3e

SHA256
a19152a8899f72cd127cc9a8b72dec5e734451489228ab08604dae7b68fc4f84

SHA512
99f54371efb115b35b8bf58ea115ecc84252547b2c86bfc0892806c66d1df1f329bb16bdf8ad8f6f2469e1134139fc1f74411989085639723d2c3dad3cb6aca0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
794a6e2e0ecea0a638a228095a53e942

SHA1
27cd5759fd07908ac4b7d4b47132b69b26de5529

SHA256
21d57c11ff4f62798668ab66f4260afacec60aab59d2288d7bc727498bb08a81

SHA512
3cc07cf0c421c602f53921a1dec07e08299386e061aef5f2604f755417ca7ae523c821523115c239f2f81765c5a5b8f5ea344c31887d022a431c458c1b5085a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e8a21b00620672ff440726c66216822

SHA1
b8d7b5d8925bc1bef6a1ea1518653604bfad866d

SHA256
d06d8adf1b336cbc2d338458119bd1fda65f0b97e903341efba816558b509ab8

SHA512
21b00592b3d3ad7295336b882e396abae8c80b062dc1b905870d8b593b6f44646e4457c696dbe89c6a2773d10fb74d9b864120c3bc1c2dcb0d186ed12bde4ff1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20be44495f89c797c5dcbbfa1725fc88

SHA1
bf3e7a971e7235ab74420790aa4946ca7e8ce39e

SHA256
051e90452e737e5d443c44f642344d020d71971434d9ec44325d93f62b4a92da

SHA512
f6e9e353d1dd33727c73624b16992c922d318223f3bc2bb1fb0db54c9285c6f1a3fa3ed61ac1adfa5747fe0702ccc17bb3cb8a0b4a3cd695a6177bbf0c1a4e6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ea7ec5c5dd40360469ce8af807f4ea5

SHA1
d2551a61a7b170286f7b8ed910e4b605098eb95b

SHA256
74d21e573694ec7465675a218c4cb21cd28313000a3be7d252a75bc1aa0c3277

SHA512
54006e40d2833ab8c8915c1ba428ab626b65795c61aafbbd6360325c4dd60f0782aced2e41766669f534719fc60c9c781f604b90b15d71d00b17fdff337923bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf2c14b7d922058f34dedd26ffe6291b

SHA1
76575c5eec2dd4cba5aeceed16fedee844fe0cd0

SHA256
86559f73c813167497d2e431ef08f1abd29e58251b7476b08d632799681d1e22

SHA512
4bd3c42bd1398b42e88a2a2e6db50e2529de24891176890f0e83d9efba5c8d200a9a24a1a74cfc8b12e0757e0a7d28a6e2027d8c613a1b2ff8874d111f2f014a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11BE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12A0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit