2e449f3821a08de0109a1ccd77d2c53d431c2ce73cdea4288997d8735c273d49

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d6a0c69a3c67d34b3fb16ee542bb4cb_JaffaCakes118.html
Size

19KB
MD5

0d6a0c69a3c67d34b3fb16ee542bb4cb
SHA1

706b3ca84beaf825b210125db01b7a50ad0b461c
SHA256

2e449f3821a08de0109a1ccd77d2c53d431c2ce73cdea4288997d8735c273d49
SHA512

faa9647a343f9eca4a69dd44ef5f83423acf2f14660a00bffd8545a0e2d7ff6ad4b5a67745316c744f56791d5be191861e7274636166997c71d2acb7b2dab10e
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIv43zUnjBht382qDB8:SIMd0I5nvH5svtMxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6AFB8A21-0837-11EF-9066-F6F8CE09FCD4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420783826"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2368	iexplore.exe
2368	iexplore.exe
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1860	2368	iexplore.exe	28
PID 2368 wrote to memory of 1860	2368	iexplore.exe	28
PID 2368 wrote to memory of 1860	2368	iexplore.exe	28
PID 2368 wrote to memory of 1860	2368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d6a0c69a3c67d34b3fb16ee542bb4cb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
6d7dd1a0a7e713b66f44bcf5e484c93e

SHA1
adf8f7dcc111f6ee00e1067fc0a3569bee8d2782

SHA256
9ff2f728058259fea7158036862858caeb99aefd56bce527652f452e8c52d384

SHA512
237e5c85529ba80e60cde670d6c8f970cdb68edfe70d00491622627b746b000da71ae6e3d3cc17192592fa44bff01f7f473a5e93001c959c91b3fa9ca6608dde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b3e19e627c7587d21d62820c4ef5987

SHA1
326d156672fd68a9a2286cf1a9a00a6db5a935b8

SHA256
0461b6f6718c9c0766c80477c304ab97428c78203a3b61ec7df2a74ffe9815f9

SHA512
515c1dc769841e878764e219ca71b2a1aa2c1731b89dfe50a78216a6ea510280f65e35db5f1ca04a905716b79094970e728ad417adabb0a42d6f657c4b85d53a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61c3f42393a84ecaccd24503bb5520b4

SHA1
4a02164259ca54f07887c97271da700441cb9447

SHA256
f9a13fe2665013172cdcf7bdcc579456606338bfa36b5243903dea4b5139e25b

SHA512
5c65b507f9053c6b2cf3624be5ec835686042e3bd02f10ff8558d4865e2a27fcaa0c32d988591345f26f83d9492688a0b354a681658843706bb0e8798c8627ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ee57dd641c41445824b0b2b425cbb89

SHA1
6cba00c3cee05ec4f17a178b56a4b868c7a592f8

SHA256
35a14a22ffa6e4e67b868f10e78242db99a22b22ea41f2cdb30c0f5f0891631f

SHA512
4a730c9a4c71fa924fd81fdc1cd05590678ed50bec658ada7d3cc863ad4f0f27c4d91f8d372b143b6ebb4ab9c3be976f1163425d4aa1c72899e1063bb570c8f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5c1e8d3a8c1ff6621e25c6791dbce01

SHA1
e35f11f5b7e80535433e7c9dbc4076dc04337e49

SHA256
ae0fa3540e533557f8b4da14ef68e303b590b93312694aa27badd97b2c3f5244

SHA512
b5feb68086094c18f9f235f5d36dd3ffd5a4cff405626496137f2213cfbf5e3c426708396ae7f670867b7ffe5637c934c403c1c30fbbe4c9fa3df10d7a912a0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16500236914e747a8bc3a13f25a26074

SHA1
be7abfbd3224c71b7c3804f3a6c353ae6125fc4f

SHA256
4b7ffaecda3e339a70d6665658e662efda469a4dba9d3e0f183730177430b1c1

SHA512
f7d3371286ac76fd729c5757b0660aae4b80693d37e8a0c99ff7117335e1fa3a7f88c08d1ebf9bcee882681203ec683908723797a793bece7611f1a9883f58b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a4c65bbf13119252b2ada074e151fbe

SHA1
c26133eb53effdf49c69287f7d3f0b22af6d34bb

SHA256
a9b39a8afdd2f7ac07e78923a61f40528a53b315140aceecbb49aec51df08a66

SHA512
eaa199802125a22b7428fb102db58ce0d0565aad47de4fc8b2285a0660d416e30ce46dbea93916d1c3cc4903dcc587b04ccba4f8a5182621b4c0d9bb3dcd9623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fa6aaec710bfa736b1b84bf83b5569f

SHA1
624ac7f2667d5d2c3d5f7f9ad2fc8dbd7b10fe95

SHA256
240ee93d60249b4cb2489e84b7f5a32617c4c3d45150802876f721f0fd97973a

SHA512
c0f7182016669a57f008d05586000769063750f351f69b28837f2bd6b705da8e56a49f42933388973b410b368fa7c525cc6391d3dab6273cce450bbcba45cb75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1704c2e4cc9b0813d12693a1915fea2d

SHA1
8944abf01eae8725ea926091576a29405f36a029

SHA256
f7054f2e5a8b8983a3f3766daf7ed54dedb8b16156693588661914e1bf7e4ce6

SHA512
a285133694f8d433d23111bd2f17f4ba448fedc07e80558b6c3f18174cbdea5d302182011836608ecd4008278a34561a670fe10ded4daae2fd31820873993f5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ead297f557f2ec2328065799bbcbaf5

SHA1
bd06af057c971bf7f4c776c1ca183b68a6bd285d

SHA256
453873a25b06a7c355adb99ee40f0d5e0d30ee2a6828014330ae826f1c9ed690

SHA512
15b815890ebb25efef2fcb6946a68bee824ea60a142d101e55ec4657aafa333207fd149e873ae81966d79101b85a9683feb556dcb16095528f05278ad778a935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ddff096cd07971fc5e95e0be3154e8e7

SHA1
396c81a2bbaaa656159e322cc1d39e8c0ea25007

SHA256
e9edefad9e04c81e68a338a992f69dbfdc83602d1fc6f38224c6d8d16464bc19

SHA512
776e8702038982f0466114e726878d80588ad5b1a599b87589979dbdf048211be408688984ac20d4edd722c07e5a0df2aef02541374883237185740c00028fe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarED5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit