3d81eb06fde671da002a3a8016d0b27fa72f862b986f33cc8eb519a21a8f4f45

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20a65b9a695cf3ec1322d1f8bcfe80d8_JaffaCakes118.html
Size

18KB
MD5

20a65b9a695cf3ec1322d1f8bcfe80d8
SHA1

4a8527f80f81bbf52c0b8ca43079f55c1591425a
SHA256

3d81eb06fde671da002a3a8016d0b27fa72f862b986f33cc8eb519a21a8f4f45
SHA512

1b67b0185a9bd456b20bf41aae1b273c4df9203759c1b74e610e0f3e8880e78f3583945bca074e08a5d4503ca22736ad7bb214713feca1bc490fd0c74a3b4203
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIj4nzUnjBhF/82qDB8:SIMd0I5nvHxsvFExDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6FAD4471-0C72-11EF-97FB-6A55B5C6A64E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421248980"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2648	iexplore.exe
2648	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3008	2648	iexplore.exe	28
PID 2648 wrote to memory of 3008	2648	iexplore.exe	28
PID 2648 wrote to memory of 3008	2648	iexplore.exe	28
PID 2648 wrote to memory of 3008	2648	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20a65b9a695cf3ec1322d1f8bcfe80d8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34b634f6400e63420e4e96f347d09004

SHA1
9b0a405a51067896c5e2212dbefe5eae51b862b3

SHA256
a6d02ba7a2941d908d0a9237c708f33359aa65fff73b897619941cbaa6668da3

SHA512
cfcaff8ebec733945756f810b76a160345d21f35dc53554c8c9fe22e7092ec97d429498663385e4dd8b4c51cd8154d350e087c1236b2bba88247565a421033ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1d6fad3ac8014836c609cbd01cb8b66

SHA1
676b9bc104f7f0bfa109ff9a1968d14b9a6bc314

SHA256
a30c6d3462d541621bf9a5e625b53825f6d650281e2b4eb0103569dd08340b45

SHA512
8a15159022d40c3d166852034da41c9259a60db571ebfdd93f71d241d0835a4ac4e0f79460625b2d041db4c26506885c4a4db94e9800bcefb1c926c7b6b3f7a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2ef13cb5502b2171ff1ffbdadc05ed1

SHA1
fbf7ad89ab6d9e71b64f5b44849b70c20357f74d

SHA256
e89c811403994cfc581846fa8b85cae3ff6427f005792dd58c8d388cf58c3bc4

SHA512
55449ba0ef89e4337f7503c7f1add3cc324f0f1dc4211ac17b2655a697bff52b46b2ad31d77a5990415e10aeefc81b3052285f01828bf505215d21f48f22619d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2196c2bd5ce1134c3dc101af2d3a6fbc

SHA1
4ce124415d230109074cc991e0874a241e5d486d

SHA256
9c7ec8683f029dd19f13a805fd5d04d7d2ebb543d871819438a24d004445b9e5

SHA512
4406cd70450a46726eac64c2cfd34ae41a1408693ef2f88b3a6964fc24a22b9439f992417c7fbc42c1895889dd817cad5a9cde56af233de6026673a9dfbbe5a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24a588d34dd13875e51893aebef8108d

SHA1
3dfd45272b2ae6fff80f4ee078ac9fb296175a1a

SHA256
ec73a582492b1d1a62d4a01babb318d0d6b3a5b8676cb9fa71fb596c4061390b

SHA512
19c79f0b00571895245bf786db11116f8f7483877d42b65d37992be09b84eb03faf5ace25a20b3aacc40215409520415fce8f44ec0362450907939bb31f3ab30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7a8a32c8981f60d15177095190a1d6c

SHA1
913c6b7ef62897b9d1a815a94a4b55503ecea8be

SHA256
cd8e33ffb86be13238d3784de78108452e5c77821cc44e21adab555d2b9c575f

SHA512
64755c81c39f3b79f023708c4088db248e79076f3c6da63aa291b77dc02c947311b4d2bdfb8b96641061ee3f182ae0df8f7db8f3770170382a235f41325c2e89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7eff160fe8bdede26e7a53993a160363

SHA1
4d57915b147f27f021e9a1598bf2d8c1c8db154d

SHA256
0a89b55edf03cbaab45ae55609b4eec01bdc8f51a20352c4ab6f0ac39c9b530e

SHA512
931a897cbc222394f8a8fcc5994531115398b2ec1e6dbfe50a0fbb072ad0f6e6fd5bf92b4d277e243d11854f1dcc7dd849cbaa50f575fed1e70fcfb926d5071b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5921107b839bc5a644642b636c99b4a

SHA1
a78a033729c8c4c2f6ee43a6b24fb64493883060

SHA256
da4e8edaa5af3696855c2c70e4f6d063277187864ae9abcc71f5de481aa2b2d5

SHA512
85a693ee1841d9ace7124c4c33b9236dac2c0e832f62cc90468976e55719e167c4bd286bb87751e03cfa481d0315c190fd6f483ed2b54dee7876a791b6f9c027

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c44269d930afa70902d743af03c6e16

SHA1
db91e479ec8d7418b3f43b07796a06533ea52275

SHA256
3d02e76f3a20e7e537a73477000c3f88ce0e303b31218f077c600e0eaf5efbd9

SHA512
7f560c63b2928a54b999697cffb6af8ef7ea6e2404b287f45b91c6c755270110c3a8b97d70e6a509ac857e42d8fc89bcc7feb5bed87c41538795efaa09309eb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E53.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9F5F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9F84.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit