21de649caf0eb4fa770b6e8fe4ffc7108105fe63cb2748ff334a045714d30ab4

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f9c45ddc4dddf4a07a2fcbef574842a_JaffaCakes118.html
Size

44KB
MD5

1f9c45ddc4dddf4a07a2fcbef574842a
SHA1

75e2b949cf8b45e70f5e9c5ae8c4d3c5bc1f6abc
SHA256

21de649caf0eb4fa770b6e8fe4ffc7108105fe63cb2748ff334a045714d30ab4
SHA512

fe2835c8912a42cbab2928adbe4fdf420dc502ab631a67b5f209098d123cf7cdb091ae59ad9a352faae4f9279bca901d4bd136412414d26f89790b7f0474782a
SSDEEP

768:4OFVQC4CQCnCeC2CuCqE5GPal2HGqwAx5HOhF:4OFVQBHGBlx1E5GilDqwAx5HQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88FFFD31-0C33-11EF-B937-729E5AF85804} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421221963"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1720	iexplore.exe
1720	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2780	1720	iexplore.exe	28
PID 1720 wrote to memory of 2780	1720	iexplore.exe	28
PID 1720 wrote to memory of 2780	1720	iexplore.exe	28
PID 1720 wrote to memory of 2780	1720	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f9c45ddc4dddf4a07a2fcbef574842a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f38c3531c24e99521b1216ee5a59d9b

SHA1
44ee3661b322ce2a953475e57a34bb04229c8211

SHA256
d38bacd1b9712117649b3d1eba14755c4db17f1bdafa67ff8b6c7a38c3a59ea0

SHA512
99f9d7d4b04d04b615958f9ecd51da3caf8f6b68508017fb702a2d4110091886ab17e527e3c1eaad1ed8bf521efff4db7e83dc781ab8183426914b07ebf95c01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9df43dfdc1eb5b5d304928779a03f14

SHA1
1a3b5ac5477b5b2bb8ac060b6389d99305d8e6b3

SHA256
feebb336d92cd1ecd9b2c2b9e175c22686de45334da3acf26f2980196f521c1b

SHA512
eca8498e84f650b0a21b08f75dbf40343f208b66e266e234df8500456afe059ae76a3ea924bc1d56b7598411cf983e670bbfdf847b4b6ee7ae036796a5e41167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0afb04623c43b87f3315d672eb4bbe78

SHA1
ba2ae4f0a8c248cc47fc4c968390d319442f2c51

SHA256
046bc24c31ce49bd037ca6f6e23fe2e16f67b1399d7f25f103d65e5ce184bea5

SHA512
a01b889357eba74b47ac0f04e0566b1d9b94b265c0d8773e72d2ff166c55ea8b2e470d8b6a3d1e2643d2f2f91a1b437ef83600856916da4c74c19681e743ebcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01b9acd8e27f9af37d6d6feae4178a73

SHA1
08b7c32d61b13db297416542992ffbcc9005a52b

SHA256
0bd508c80af6c78c76613da5e00cd44a597eb0e35154d95c54febe85771fb0d8

SHA512
60c728a881022c72e591ee24fe585e94d9bacd3e070f5085f965b8bbc9b52e338e162cfa9806f15a70e5b89cd378e88ab76e0a9426c8450553899dce3160632f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0966d5720106c567660ff0435638cc24

SHA1
4efad2aa0deb58c2448ed643c89035b67bdfe41b

SHA256
67c6a3105ab17cdb629f5132e6f5ac4994be8e67b2de184460678d097ad8366e

SHA512
900d82220fac1710037cf3f89fb4a02a5438a875b036a84339b1abe6a88ab11e6d6e0bbf42b86ffc6ff559e8e221d84bddca5257d90d6f9b741ed7a52f011daa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c64922fab58a6b2b4e148549e29eceab

SHA1
5b6d1bbc22eb89928e6b8007d7e169f341874c8e

SHA256
fe1f90c1321cca9af788d310a8d26993013cd68413db519d0bd1db2b009d7fea

SHA512
7d442bd7c60274c240a1f8100d5da7dc9e2703cff4a762a1af913e949e40aa42f050a139c5fcac6bb7c5b853b9c2c7aa2387f3782c3f5051cfffff33a7170363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85739281f8ce2bdad001e3f84ab149f6

SHA1
05493ef82a5b06c5ab06e9e521734bc7a25df24c

SHA256
0bdb54ccb29cf7883e4bb7fa8b2511eecb5646d5e9c65ebf6ceaaee97ea38f6b

SHA512
92c32a1124d4b980271700ef41335db6f4fca12acc597962e1b14e101f76d2fedf01ff03292b374cdfd8f7b04a7531471cb6c80a7277525bcf340ffb7f91466f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afaece1a58016d5761a5d2234bc9cb2b

SHA1
fd90e14403ba89e0bfda54a8466d3babbb189877

SHA256
f64c877c812ed1f90bc495fdd3ea3e50c16aac24716be0bb68ea6f0e010013ef

SHA512
d3744c57d29f16c651c95a9b39dc90b4c6d461f0f4f26911c9a65d36e757d74d69469afe0005e1aa855b4e51081a7171a97566e51e948f8d6f691d7b2b51c963

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3801ce3aac1163273634e29864bd4038

SHA1
ed8c6e7658b0319b6070e0894d238c30e89060c9

SHA256
c4b82b70b37b37ebbe5a9848e74300f5bda9d0963f885b7ab4ca9429eb1d5f8d

SHA512
e814aad9948c2dd5d583b6e8335e992870e6fff37c540c7240909435677e9f5e681a24eb477846d194c34c9ba730ee7eac76261eaef0fa02e0113caba5cbe711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
604f4a390c387cee0e342888abd239ff

SHA1
f8af33a787c8b70e8f5a2c1817d55ed0abdc9cf9

SHA256
535b9096d5eecabfe7d132b3bfe81306bc7e4c5d54f26d69a0d887854c5493f8

SHA512
70cefa41af4272a5e5de9dd97639dfd64997b1363cba38584900741f06a53232feec27b3494c6ae52546cbf54477fb937ea40dc88f8810fd0d52314bf970c6f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBA6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC78.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit