c6920ed2182faffa9dc552cbb97314e25e93414d70e812047094a169f2a24c89

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c686750abb94c6179555833b06188eb_JaffaCakes118.html
Size

19KB
MD5

0c686750abb94c6179555833b06188eb
SHA1

edbdf1b9e77cb20e07e593e4d11b2b200fa225eb
SHA256

c6920ed2182faffa9dc552cbb97314e25e93414d70e812047094a169f2a24c89
SHA512

cfb39df2c83ca68edd2d67f55f5556b96b16dd93b24d5f94d926546c60ae42b5d202f2ab30f87f6d35119099f312f4376390cf9f419489ea0ab986beb9de624c
SSDEEP

384:SIMd0I5nvHa8E8qYyii8CFcvXsv4XgKxDB8:SEB8E8qYyii8CFcvX7QKA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8DB89E11-07E0-11EF-AB95-422D877631E1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420746517"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 3024	2188	iexplore.exe	28
PID 2188 wrote to memory of 3024	2188	iexplore.exe	28
PID 2188 wrote to memory of 3024	2188	iexplore.exe	28
PID 2188 wrote to memory of 3024	2188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c686750abb94c6179555833b06188eb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4372a3459fc64dd21b88a8e6ef225408

SHA1
be2b0aa8d49483e12a76ae162350b32fa7a11c15

SHA256
e968ef0f7c8074a17fdb7b296b6e98c7bd43fd1bf9358b47a5b849c1181b1900

SHA512
ac7e53192c1a5b96cafef048c1887209b88cea14742e1a7d01e4cde864222f1e965e35d5da791764330d3db22067e37713a2df2bb02b022fb2246355f08f05e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e0d9a8f9d30ee2f4df8bef964e93521

SHA1
0f7081d8148026e1cc710fe84b9fac636cc36bb8

SHA256
96fb58d944dd6b96b5de76d7344bf4ce62aec41b4eb102cd651dec4b3d42c211

SHA512
080903e4e4cd565e69dc2d5b05130f0ccaf9e08fc98163b93a81b45e058744659a31ffb00fb3e8907a4e6c7ab0686b1cf4bca967075de3e872c6da420fe0414c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
017c9100e9f10e4fd154b2b4cf799daf

SHA1
1c5405056db0212d47885b35b18846e3c0d02517

SHA256
20a808d8bba2a2d687f5e7946702cfeb79deea4f179685705636f2b8dc99f189

SHA512
9c1001ca632e42e39946c4f5d8562e713094c440624bbfc827c58f50ef19b0696903b00cc9baf67a25bd558dac50d6518eb5702c5187206c881dad95e28e8e25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91a1c3d289ba0f3ad64021dceaaea4e7

SHA1
44ebba49d75bdf9723bcaa65b14604e09df06dfc

SHA256
f2e03500b0dc5c4bd7975f7de5fb271a63072e0d7ff604b18e818added952758

SHA512
58578508787f048fefedf166ba41b0b5b4425713a9965eed24c7667684310fa906de07a0fb51f3882331252171c098b3b586f5dbe2030b62756591f84a4eadc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54670153b32fcdf2b62655d155baa47f

SHA1
cff26a195afa75c0208dbfea991dc6b569d11657

SHA256
669becebc1908dfde1d1f01d7ca11f1c3f8521b82e41aa39706dd857e482f397

SHA512
54b0bfe50200af17ba4e363a3334415ec7928a33bb72cb0e95f13d4674b9e4da6444bcd050c3faca38fe36a46e7d8a8008db34087e2c992494fb80e9084fb29f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b3fffdc04fb4f62772148d24ebd8452

SHA1
f8121cfaab6b77d05f7281499afdb2da5e71ae09

SHA256
9aef559de46e815007a050f7f58d27b3d841688f5a4f497f6cb513d83ca5a14b

SHA512
868a118c9571d3e56fafea5257b410f152824bba4973405610dda78ffce72fc6e03be2ef4918209a2aa810392813d665ffb2097bf60cca7ebd17ddb74bc8fe30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce7a9e055380ae4de646e28212fc4ea4

SHA1
5ef1cc42face63918f4e1ecfd697d253b0c08238

SHA256
c414f0cc5d784b97fdb7a572dd7e34ebb2b2f7fa1ce5187caea94aa403e5ab8b

SHA512
0e6be99bc8e549795c75f6fbb7cc650aa1d372fc9a085d9873e9944fb72fb7db195cd2f3180ed27f0c8cfdcea6617684d36579e65ef829123a0d2705ddfd4408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcb2b40ffbaf1dcf6f49bb2496dddb3d

SHA1
acffe660d62fa68ec82f255fdcd780c710c2c1c8

SHA256
29c0f46454b422a3d7b33442e66913046ba68a6e32fba34d667f65ccd79ef9c0

SHA512
b118cef27ee910bda319dee9072923a01de6e655b8c28a45a8e793feadfbc621c6db00b0644c15b03997759b25d7f7ea1bb9ee34c356abbaa7018f7d774f9f5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab688.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6E9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit