ce69523c4dfbda86234d73556177a8aa09522e32c8ca8a2562180e28c10fc023

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

15c37de6cf4f8a2f2ead0de2fc0ba634_JaffaCakes118.html
Size

4KB
MD5

15c37de6cf4f8a2f2ead0de2fc0ba634
SHA1

2cc6a1967dafec8e929b085c3652997e58a9d5c1
SHA256

ce69523c4dfbda86234d73556177a8aa09522e32c8ca8a2562180e28c10fc023
SHA512

3d4381c9abd85c3d30ed0eac2a1841e6daf2af309a26670e71f6fcbbe267fa09724f38e5ddfc28893a6e2b72c5e5f6bcc0149b5898117c53890db43abab0e553
SSDEEP

96:tJZMfPWU2AWUuRb/DZ5gqCuJZMfPWU2AWUuRb/DZ5uTAOZ9PuJZMfPWU2AWUuRb7:9IPWU2AWUIrDLguIPWU2AWUIrDLuTAQu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421041299"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4DA6331-0A8E-11EF-9479-523091137F1B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1932	2004	iexplore.exe	28
PID 2004 wrote to memory of 1932	2004	iexplore.exe	28
PID 2004 wrote to memory of 1932	2004	iexplore.exe	28
PID 2004 wrote to memory of 1932	2004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15c37de6cf4f8a2f2ead0de2fc0ba634_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
dc490ca39ad3aeb4edd642f071c50fdf

SHA1
47bc76783d2f0eff6650bf97fb49d03bd149efe9

SHA256
af9d9a23617e7a9fbb40ee3920cdf4dd0385f6d78f69a500c1be21feee3b086d

SHA512
c7b496f38f0a0eb131ae30b510073c153cbae3394cab734793c4a6f5145343ac6cd9f31e2fbd4c9ad523a710ecc7e8087b0c9776541a41e7f200d228a0aeaa1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0865358bb5a9357122db1e08ca7d4b7

SHA1
b0e927c117357f1f4c13f7aed47d83849ff18761

SHA256
f67782d14405174d8f26690b4a3092ab7d2b69eca1ecd692e0349d5bed4ddc98

SHA512
c31784a7afa2fac67d8267d40d697e46a90dba41365402233c3df7ca1090e7332aeeea735f051dab334feea963c173eb8dc566f49bea35c79a72be46d09b7d15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6e9f3840f2f9477d15b3852acb1788a

SHA1
8cb9813a366d9c3a333d62f43e913f7b083d8ef9

SHA256
6362c65d8f5379aecc2346a70dddd3735c616ff982b692e6553372496ff1d88d

SHA512
1b910f1273f95ffb329394278686c3290a0cdb96f86ffeb9572d55a4ffc9e57a8e90432bdc030e9a26255eec1fec718da0ae7ea8abc7372dad79cb382e6b350f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
014e3235dfb39d2aefb2caecae5426e8

SHA1
599cc4fbde588755371669013a5521f347103d75

SHA256
c4775742eebddc938840fa8ec0c89ef9b025f81e696f091a35262886cb31bb5c

SHA512
beda89fa8a061b980e23270435416bcfdc4fbee57c68293a308c28ed4294fdfeadb18cf0d326d7aae62ec157b739ebba3d691e59f77912543a49943c22ec7fdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4508893eeb7d70432de41c754ca425e5

SHA1
495e2de881d6dca81159c5ba465d2cd935c8befb

SHA256
aa07a8f8f1afd807afcdaa1572c109a37bd4f2a83901b8546c009413b92063af

SHA512
ea24a080bf0a5d45bf86d254ccfb83bbae116ecb6f566aa67fef60b4fc870512892d63b5cbc0936abc771d505dcdd21aaef219227f968e1c5294f5832338f2a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9b13fd14d61d9763a3156101879926d

SHA1
e5effdda6fbca47388a2ed895c85fa789535fe80

SHA256
89e69c29b92b244f5dea4e9d36614fb0b890c167724280392c8005588c849b04

SHA512
19443230a11a4a848214c53c48598ddc870f06b29f46fe38ee4ffb926ed7ab48f9e213925ef59b42e71758ff2fee280a48622eb7671d6aaffa9f771cd8e57eae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b39063c5e38c4d6e52077ee5d13a3075

SHA1
269dc099666aa24d5b6264bcbcf1f119dda8e242

SHA256
cd9904cba75699d1745a10b819c708826f5e67ffa36e28fe4d819a00a3146e99

SHA512
08b408f49e6d2922c1c10b8417cc2852396ad8aee5483eb66a9c8daab498fa753c8688566140a0b2572c08670be34809a660d8ebc380903b8def685a15468059

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eed9d359d32b16027860ae54c77fefd9

SHA1
d9ef481a8589e32db9accf335bd2e11abdf1dfba

SHA256
bd63801d162edbaa3f1f8c6fef3f696a8a08a4870e0a86251046cbf77d1d0c52

SHA512
95e7bfc4ed8aac2fecb7009bc3dd5e2b147df5718ed7d1c2dfbffe04a6fe262c17d55389b6e7adeb773414c7e3890c26992c1b04354480483d75dbb154004371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe2649bb5c708d5078753feae1807ee7

SHA1
4a2fb2561a388bc8796a9464e4b5f5da92050cb7

SHA256
e1f1391ad70f0dea92e9ceebb23d284460fa7b160c00a54920fa9981a17929f7

SHA512
c83efac3bb09fc203c41f7f12e13df43aac840547c75ddc365913d5fcc6a267ccd32acf761256ee98c47f1b94ce029cb55292302c8082961b9bbf20f1e83ffa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67348f6eae97d51b2ca10de81d4f8a96

SHA1
9fe4241708c2f25b9a2021a038e69c17eb990992

SHA256
8b1f9123c75df3c0c41505d50a5cc6c3f7aca7f8240eebfda83b850e5670943f

SHA512
d37d7ca79b57a6629fdd1d68f751ba28f005980c35b59b675f22e511453af72c677095a86264b78cdc511937722f168079ff7e41340e7a44403f4e29de1a0cbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d7c1838a0d4ea4e2c71a53d47ed756d8

SHA1
9024628aa6f48d1f43905819a73de207395fca2f

SHA256
216af2a0064d0049565ba24f1642d2fe72f0a64ff9527e978f34f1de0c1b65c7

SHA512
6888e6ead6e2556edff0093def4de39df9cfba7909072638d0550b8d982892193f79cb0c1a7095317f52216b4f982a4e95ecc8e2a73c9f17b0dd29d8a98c502a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1412.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit