d09e20155e3aca4ae7d1d04e1154d2d99efb2ad7e32a9f7ba0b69f1843ad1acb

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17ead75f6aafb900bc77ca41d3a9ae3f_JaffaCakes118.html
Size

18KB
MD5

17ead75f6aafb900bc77ca41d3a9ae3f
SHA1

92314ccbcea18f4da70bcb98d6474f93e7a1ec28
SHA256

d09e20155e3aca4ae7d1d04e1154d2d99efb2ad7e32a9f7ba0b69f1843ad1acb
SHA512

699780cb364c88c854913d6d05d474a42657b25f7ed202ce484d96e88ac4b2598b96e18f966180519eb99ac16e87416ab31736017f53a9e197dd96d13f58108b
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIQ4azUnjBhuw82qDB8:SIMd0I5nvHXsvuzxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421078030"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A485FE1-0AE4-11EF-9DC0-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2676	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2676	iexplore.exe
2676	iexplore.exe
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 1988	2676	iexplore.exe	28
PID 2676 wrote to memory of 1988	2676	iexplore.exe	28
PID 2676 wrote to memory of 1988	2676	iexplore.exe	28
PID 2676 wrote to memory of 1988	2676	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17ead75f6aafb900bc77ca41d3a9ae3f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49d0c77b022d9478053f06466ceea5e1

SHA1
6ca4cbcd7388959cdf07036404fa0ee960f18043

SHA256
93d1d0d00378a0d4455284cae659725a257a54f87583e9846383e16276ef654a

SHA512
717aecaaec7d2b0c9f9bd70400b3e40dcdb12eff159c3b9fdde5fae688bcaf8bbf56dfecdfbe82ac21ad50a163f99f9e8203c7a99151ed22984ccb47bca6a5bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9148375abddf400a2b5fedab36aed87b

SHA1
4f6c8a18eecc33cdedb64549ce6e0d2a62e926de

SHA256
7f35aef361c8d77232a673ed54d2244a81bb678f464528f1e763bba6c0a074a1

SHA512
6f6931b0c3005e6c1f6deb1d7624eef3aaf29d681fe2da94c36be21a68b2a5b7cc9543f595324c21d72d80e5b94e5f3bc68d7c98406961ab3dd340ee61b1f855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98d6c0b4d9f1130d7722e2ad3274b854

SHA1
bd7c4d1c19562a4d89e86bc3a1a42e463893c5b8

SHA256
8c4b406f8d6fc68cb50d15d4d46774eb9feeb3f6fd76d435e6adc075bc403c6d

SHA512
8827861ec9e5a572dabaaf472c210261e115d4bc51617580b336e6d74f57b9ae4b7736f8cf55915a0c583d70ea4d6463e949c844315c18115bb65877842ec20b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a8320c0e5a06a5be24a7aacaa3b93ba

SHA1
953ac47313913c61234f995c3c065db78e8794ea

SHA256
7a9aa4fab020d41d6d9287a8f6cfa689e0dde5ba3f5b8c1910041c5067e37d74

SHA512
324cd10985c130b0146083a7b24b45fa04c7f7acbef322070a1c528fcdca5a27cd8eb431ef3d709440b0afe460ea328b0164a45b14b13034d1aed7def0fb6750

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1adddd97f6e21d6886cab07ffe514335

SHA1
b42c7bf63e412d709e944e38395061f6478eed1b

SHA256
d31a41770b2fbfecefdf0749ba2ab7efd0166a5dc22e35f141d8f99dc7330ec1

SHA512
5e0f12b7a23fae741337e0f0166536c65411663a8b2eb11a844ff6e3f2432a6ba05e4ee4d3a368bd7dc44096655c2bd290ac3011bce2b97c4a8650640a5473c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4143b4a64309e9b9abd5061ea84539b

SHA1
7be3560945b2cbce28318c4debc11647af019db2

SHA256
91744f592f1ed52943eee6972bdfb11e4e8fa6b9c3d6335af38a2c5df03d0991

SHA512
95e091c68d58a55e33c4d9d19445ebd58f0d344f274ce10efe531ec0441d200dcfa2126c73d298b64a19015e0985cd57ca8f6540a2c69f0ab0e5e7ea09c83454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc1f4f2606b7867cf9cee0f5ad176c20

SHA1
1e1cecb5b20854ff02be00640b52241305585a4a

SHA256
0923a223b9c5cb9cbce256d8c0d8a9add03a2cb11978e9e1fba9d63c89504165

SHA512
3e85acad421afb182d8c4e0c8d64803d15f17e554de73c8e9c676357dfd443ca7d4335e6f476f9f9c5af32a1b1ee6bf100917eed237d72f893f35d1f98f74d90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac8b31b75e4a849b7d9be042b7ee8e33

SHA1
0cb3667bed6448383835123eccfa406dd6cb86de

SHA256
70d9e6ed5e51c3aab325b2409a0d0f73a143cef2acf47f353b5a9b12d42c4882

SHA512
ac46cc2d8956bd49f337c636dcacd53ab3d353e27b61e4dbd47124d90a5489ca8c44805b2759fe577be5ad4b8778d367c794237545a18bbd4beef32e83ea8d42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24fb36b093da1add5fd7a60fa0b7f85e

SHA1
e6a236b1677b58b76106321dfb1ba9b5e4cfdd0a

SHA256
33cb35fbfa75931e9d52ca83e424c6001451586e1b73d1413cdae34a5fd9698b

SHA512
75b954c3de186d5aac2a6a54c2421f72bb97c8c9baf45721cde1e5d0baf4bd30013b8ae9e0c12d439fab823efbf4feee76ea04f92eeb2a5f6e1a478815797bf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b108a654e13249c6032ab3956e84d2de

SHA1
ccf8e21c7f763d676263b92ef079a65a6becddd7

SHA256
cffefd3a8aa272e1abc098d42399e9b557f141eaac2cbd1551be53bf5e166dca

SHA512
8f781969b5081a8179005b3a4df7f43164f6ed2bc41ac419fc093a1cfbd71c3d04f9f871917e241bf670e48ded502d8142f6771d8c77c24da0b1c801fdf464b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3084.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3172.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3175.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit