a50571d05b8bb5c75bc5027c4991660d4949ffdf9c57d2c84a708dfe3ae966ea

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 07:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

23cc7b595cfa2b2245509ecacb80d039_JaffaCakes118.html
Size

19KB
MD5

23cc7b595cfa2b2245509ecacb80d039
SHA1

76aa29040775a9b8a9e406e61c1ed3247f13f342
SHA256

a50571d05b8bb5c75bc5027c4991660d4949ffdf9c57d2c84a708dfe3ae966ea
SHA512

3f2493d86966efc2f34eab62c5af5b636396492b7a98b07d7edc9d5b4a7865e7da4a73aff6b982be0b39690968da32828ab8bf232c3f0c54ab2961ffec835883
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIu4azUnjBheA82qDB8:SIMd0I5nO9HRsveDxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF409641-0D0B-11EF-A296-4A24C526E2E4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421314879"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1660	iexplore.exe
1660	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2616	1660	iexplore.exe	28
PID 1660 wrote to memory of 2616	1660	iexplore.exe	28
PID 1660 wrote to memory of 2616	1660	iexplore.exe	28
PID 1660 wrote to memory of 2616	1660	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\23cc7b595cfa2b2245509ecacb80d039_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60f752c331b287728d4f5c05aed3aeed

SHA1
cc8f2ffbb1a405a8bc85174453c430ab813bff18

SHA256
85c462907728b94344a12bdfc533b4e3f1221ff747159031731ebaae1f333702

SHA512
682e08bfc3a7262f16b938b0430c1b4e7ec62c8343cbbae5c16fcebce48b71f94d7274e0216e95b76d4728d1055f16f5f67ecc631129dc8886c9450d82280e2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4919bee37e7dd60f3382fc2e1e1734fd

SHA1
c0b9f68ad778811216650f1e7f3f3ca5bbb01ab9

SHA256
4e83ee6832a42e6c769ed912cfa94d03a810a5f6484c80d2639d18dc74aa72eb

SHA512
0aea5e2d1899e10ba5fdfd6cde441b3b05ff7de0ed0e0aa8658611606fa4f10be6b9ff1c423dee8241302bcdc3fd95b920d0f9daf6578f6703e2233dc2633e46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2857c7a0ab6a4876271416c3f5bcfe9a

SHA1
cb88a9c3cbcbfc47e7be1a0ed438a897c351d0ee

SHA256
cb0e6e55710e7235054c0bda4121de61822f6ec38a1dbd878871290455e06ab0

SHA512
eb6b7b9ced42076f4858fab106b7df83430252e91cde29d964c3f6b773ec34ed7e4c31b22d642ce2cc6cd9a30d65dacd86c8fdeeb6e527345440b2755ff6384d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
185958e246c678f94b998a84c45e77d5

SHA1
e5390998be042353529147c5a2712ddc9011c112

SHA256
8d1a280aa2daa77a90f613e47839361e45a5d5c74fbead6f6242eb15a26eb6b1

SHA512
0487d6c74fe37ee099fcb58e9666eddb99bc0d7c5872441606a7a75fa5d97b83617b67bd3f23c74492ef7aa1f75e3b8b41e324015b35a9f84adba1c35ee6c117

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a43351f17ca2686fdd2fcd23e14cbf9

SHA1
e759a14fb9e93c4e755d85945fe3a20461030610

SHA256
0da014c129520fd836218006cb35a408da27a1394a29e6bd6774179fdcc14b98

SHA512
e10cf80ea620f2d4fa65a11a033da491110afe10213c4aef8c57988d5de8caba82cf90f27ce15e372765c93ee1982ad34cacbc554e84aefa9f73be737c3ff232

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
082d1c3165ea188576901e6938f94920

SHA1
2d5d6e4fb1d587ebdd56cf9cad827d61f1893819

SHA256
ccaa39957c4f4edaadec961798df41543ffad0bedc7dc02717fedf5fe53ce52d

SHA512
2864429575275b257a796fdffba504272992fb670ac1c18563b31dbf9ede8ada94e0ab8a405e10274186caa12f467e0862ced89ee1ae439339819fb8a11c76c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
009e5ef60681a56a3d23bfccf4074b47

SHA1
452a15289b66dab65963cb9aff8d8d5bd20b2bc8

SHA256
1dcff453c2f13dfe7c83c031ecbd844bd4acc014e2eb11823a16c73b6a939c0d

SHA512
ac88cbf6b1257950dde7dde484b54db897e5843c540f5552b592c3fdb43f9855789be5810f5ed757782c6a5dcd0b56509b02ae3931557cbf9877c3093455f63b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
903d3a777254b3e6cfe042b17bc8b8fa

SHA1
17891ee18456e2e91abd5cc2bcca5afd4c055206

SHA256
86fe507d945ecb654c2daee05ed826f8e76c75e0455631700bc732f047ba9a57

SHA512
844d6e913be9362d29b8b62a6a03fb0eeed34e8dcd108d8f2988e9231305e511d4549b529cc4755d5467659af9a44be93f2bba70b32a44a565631eaa70571fcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d294ddfc5d4a8b6a2d3963bc9a79b65e

SHA1
912205e412c90cec6acd2475d69bdc83d7b9eee5

SHA256
11cbb2ef268b83c6642ee37a717d31528493da98979369a0745d3458fa5a7dc3

SHA512
c0621d56345d8b43f50acdf9a9af8ce3edeec3af53813479f288f22a37378430a5a05150723a366b0db1f737159f537714f5e8aa3ac6f96eef08e00a3d79d85c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab163F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab170E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1722.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit