9f7d81121ed3f7dba66e108f5423b21388e647c399caaa2bcebb3f202502412c

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23afe7a222b737f03fa3b607a4b1ed51_JaffaCakes118.html
Size

18KB
MD5

23afe7a222b737f03fa3b607a4b1ed51
SHA1

7794f5fe77da1363eb1b6f89b37c92e41e3e41f5
SHA256

9f7d81121ed3f7dba66e108f5423b21388e647c399caaa2bcebb3f202502412c
SHA512

45fd5b16147d18ada14c57acf3490eaea0b1dcd50d24ffa2899f5c9b29298bf21540bafc277c872ed1f6d3c0f569cb86ae2a3f8a13bd4d35b49896abe60b93fc
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIB4DzUnjBht382qDB8:SIMd0I5nvHhsvtMxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421312963"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{68C7E671-0D07-11EF-BF06-56D57A935C49} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1384	2020	iexplore.exe	28
PID 2020 wrote to memory of 1384	2020	iexplore.exe	28
PID 2020 wrote to memory of 1384	2020	iexplore.exe	28
PID 2020 wrote to memory of 1384	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\23afe7a222b737f03fa3b607a4b1ed51_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1292de36da32e76538bd5221c364bd12

SHA1
b26a60f1a33ee21159584482efb7c7deacc9e130

SHA256
b414af66b0a3d1a2bf9d02231f684a5c0ad3a2262a8b852cdf599bc6b7104aa0

SHA512
33161c1aaa3cdabc551c33bbc8b5dde6b60b0d41347eddcb3a1b58f1535c341478de339cded063170e70e8fcfb0faf60baf28e7b784fdc81c8390522c781537b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07996cb904c4abb998b971e5e7fb0000

SHA1
d2aac92ffb91da48614856516aa59025a540cfc0

SHA256
3fe4e16b6682b81268bef233192d7b51a34abb28ee89b8f1702d6a5b81b3da79

SHA512
cb1c0845038b5f838a662b8649a304caa389663000f28dd13b75c734c58100290f3d66db24bf042f2586b1db9b02436aba387320e53c9d6a1defad35bdf33aab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
532543a2afea8c0dd8e32e5d00242b59

SHA1
1e85b15598ac68b216b50dcf75a8abac3ea9b6f3

SHA256
cca2a2ff901eda3a84bda5acde6f2e38bd1299b54c3a0c59d824ec3845a16863

SHA512
47d2d25b5b3090111fb7d1180f701526acda1a46539eb5ec4611c1657199ebb2995a5edf2877cbece40d719f4225358b93984a996d99c8410168c2741b49a884

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97691567674be9aabf4310e17e7c31d0

SHA1
e4ced229ce55842e2905aa4978e83cea3d6e6aa4

SHA256
02aba86956a269c9e50453c49a18ea4741b5de28c6a4b1683a99dd5275805602

SHA512
407da751fe61348b13141074ebbdf3e4b87e9ea3051900bb821ec3c2c0ff14310074150464f2f7283a3abd3c19ab7a8b7fc94bbdeddf9bc1b55d9e8fcac3c070

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d9bdf417db5065b25d738743c4f2438

SHA1
003b736578b9ed6dc0396778bdbd691759bd98fc

SHA256
88870c701a8a0f0b615496580ac884d9b055662b33723eca4054a361027dad0c

SHA512
acb8e011f3bbbe4f0387df6969b13408f46fea677c8750951093adfae7dc047a034b00f266b49bc9854bd8c459f16a3c2875c57bb8edb359e0a16fac4bcda471

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dbbc96ec96f3d5c46ffccdc2b6ada9e

SHA1
d79be96b7d6cc2937d2f769688fb3a2762301a9f

SHA256
99a33625ec6de5913c81f5a1701cbea31d6acb6bbf466d5c342b2288642903e1

SHA512
191cca5145732b191f1a35579cd308b66303d20dcf69ce15121d5ae11110cb23ae8f09f46690f33fd58b95849c912a5538e7eec3332d79007c5885acc3b47f3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3b7085aabb4a0b65f10423c619bbe38

SHA1
ae033dee95ca1072e19c2604544abdc347096b82

SHA256
6762c12fec9441bb0b0e6ce244c8da18d2c82046b3b59de9b8338cc1e189b7e2

SHA512
2be09b90cdca5e5de5a9fc5ca10f449a276a534e21269fcb713d1da420693ecc1c528d05aba84cfbc8028573ddbb06618dcc47b9a916310f8553a79a5ec0e915

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41c2f9d9c947dee81f2ff90a4ab354c2

SHA1
c1ba4214f6dbaf7b5612d7ecaaa8523e3bf991b7

SHA256
4311bdfb4019e56ec5744a0d57cc27b3cb27599bac39c3d9b835e65a29689a34

SHA512
3e7dd69934e0efd68f74089ff3cceb0f5b491f11f41e3a837174e7a21deeaf2e16e0890673a7612b4bb5ea4da55894e6216212599c0f04b4fae326eb78548eb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0ce35c81af1f94b59a1d7ae98dc6b27

SHA1
1e12a83994adf624345837b21d3551f17826c510

SHA256
8ff7bd73d4baf81251bd981b12d8eb53c50743d5f81ec5be41377c80e191a3ec

SHA512
999c2af869c1c4af3fa3dbb906971df83156f19dd4637befa279bd299ad18c6b8446702db6db31834c61fd7361603e27f1054df06e79908de91400e4c94b85c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89805b410a0d2541af1f6c81f7e7737f

SHA1
4789627ded5ae52d9e19a955f4142bac6a8a1689

SHA256
27c399dd0681c784276894da0eed308ebd23db720a987147e10ad910b2a428eb

SHA512
3faad66dc303e92b3ea14f2ecf7a1a5602e11d21bb2ab6c4ae2b616fa08deb1abce46a81f56b8ae43e0e7c6983046f33182f08c817db9877b971ddd6fe16e336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f83e810dc8b6d4694c5e5a5cdf61086

SHA1
65d26b2cb4b5a8a4b244e05d046c2ae4b1bcd1e8

SHA256
acf5702577bb1194549d0d6c66514d92e5fc4ea89157b9d8543ce3b25278f75e

SHA512
02500eeae8050e1d2cb4bb00019036922d7d491ee813707aaec18f470385a4f3644e957acbdab96d3c2cb564305751336be0256b6b443ce703697df44482c16f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7723.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7823.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7885.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit