2fd95494eb3f0a4ece2c92e710cc9bb5cbd9326f44ec0109740a933de45322d7

Analysis

max time kernel
144s
max time network
144s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32a43ce62d62da877bc516c1a30ef0b4_JaffaCakes118.html
Size

115KB
MD5

32a43ce62d62da877bc516c1a30ef0b4
SHA1

9898dc57d29b70da7cbd65dd549de5d85d7d67dd
SHA256

2fd95494eb3f0a4ece2c92e710cc9bb5cbd9326f44ec0109740a933de45322d7
SHA512

4ed1cdb2a8321a80559b1309496d36d47efc50c9a697f5d09394a4bdd422774f158bea805b4c581c92e3f84d421eabeb6c5a19294ec6ca86bfc079133047f134
SSDEEP

1536:kyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsQSz:kyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{19A07521-0F4C-11EF-8A74-66F723737CE2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421562367"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1960	iexplore.exe
1960	iexplore.exe
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2972	1960	iexplore.exe	28
PID 1960 wrote to memory of 2972	1960	iexplore.exe	28
PID 1960 wrote to memory of 2972	1960	iexplore.exe	28
PID 1960 wrote to memory of 2972	1960	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\32a43ce62d62da877bc516c1a30ef0b4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d023ce51edd074f82cf0ae4bd4724ed8

SHA1
d760436ace22e050c91d359074258897469eea67

SHA256
58f6addfd619f15b4f676669432007a904ed976147fa4eba77055d61f1293143

SHA512
36f9c1409c2a1a1ab5b75444bf0724fa4e5fc8eaeb54175d8388b2016599ad7cfe0737355b3ce8c7e2d13bc300df0384868b0d024f01f7ec77b8c79ce5cc1e0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e44edd417185776db40a6f1e16f8fc9

SHA1
d988e4546b643af8d17aecfaa5b2da1b34d86591

SHA256
0ad2335218d008de86935def6c00315fde43f9b9ab2d601098c0c374fc532620

SHA512
c8ac3c4612b37838796367ebb4ccc03d15f27a105182950d415120202b6d2ebf156c48465d9d2f6d68f6a6de06306117fbea52546cd425c6f8997052c072d1b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee877ca808758eb3fa44c18d7c91cee7

SHA1
ac031f34f421b9cd3edd4ec4e3e4ac9f571f2e6e

SHA256
1c9af4d7b28d742bf3ef910f0bc1d6316e0e2d858405a7feaaf48302cf8026c5

SHA512
403ee2b6e53c62d1dfd21b2fe022b48e5f6381cb5d92e9938ff24b9adfef36646432df790a996ed2000bf418f6acd2ccdc08e2b8a04d777fb96161986d43202c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6baac0149e68c4ff70cf6a057ecbdb9

SHA1
b82573067a8606d5115295af763f84864eb68608

SHA256
99bf237b712dd85f45bc4aaf6a9eafdc68888c04e6e8ae8fe21f004658267775

SHA512
1f15bf1c5f7bb37a0c64505cf4e2cb11c0ce8acb905c2f332ef7bfc5b761c29a0d5a6f1ead9be5d174db6e0d26c0c81aa087c4203f674424451a38d3ff07dcbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54469d2fff9b028e5613fb245e882157

SHA1
54a9292c101af10090d54a9bdc6e558c74b9b08f

SHA256
715718670d8a103c62c21e7a7a77b63be4610635a01d90cb942ee8a642442692

SHA512
8bb46c5e156aa37438b5c82ea9980614804d4fd408220885b65146be3d0187833fdf768e7ccdd5e50315eaace2f471bdabcffb09c7a38b805309797a37e6dadd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
791fc99a4fcb6c09b67ccabcdddf7dc5

SHA1
e0295900b4ac13021fdb5764819b563b1e7db845

SHA256
96e0d8564b43be92c22e3daff7909864fdcb13cc8b5a4ed1130dac8ab900eaf1

SHA512
6e194248d4fed691b9ef4f3e0e0b6e94dafb3a63b85b4bfc4f0d2001e9d86fad9f0ff4c063eaa42e59c895f26c97018d11f82cfcb6885e86d5edd0b3b8986e0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
374e401f650e43084fddb03a11bda6f4

SHA1
cd7da196b2c39cef7755f817de288ac7cd0e77f6

SHA256
0729b3521bc5d8f427f3e048b4760cff6710414474795f2dbc3a116e2cabfc90

SHA512
cc1d2059fa02e96b990e54ea8a4e81a01518772a7d4963379b8f77cce33e4b71e618b8b11230ba2248937e480c25e3b80c629b3600804f1e219336695ae7e0c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83da7852187487f6bdd97c8aba48fb2c

SHA1
b7fbac3e7f255d66fba87551225495596f509204

SHA256
0b9c14690049bfbfaf82a08bea2faf79c49df5d54b15f854a252a7f5510e3275

SHA512
93abdd5b9b45c5b9da7596c4c7c191a6340572928f1abf8ff6d9bcaa275f83130b5de465d981f2fb06e0fb0aa28697b1cc177322d06a1e9518c4239a662d1bfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60dfd05401852ea01adb0265b0a12aa8

SHA1
4d0a6f5adc68569a481d2305841c9bdf36a63c6d

SHA256
7f74c7ed26a1d6dec5490ff9abce1ef02037e2c88d4a26b4c22eac0e7a912663

SHA512
262318c3e1bd94bed6dbf7665e75616abec3e3bb01bcde1e0f25be515e0aaa890bcacbe8449e7afc6383eee78128af6f11c10cb9ffc6daeecbc1bf546fc83ed2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d53d008de66e1e69822c196a6e082f34

SHA1
d4bb2ea6185b067acfaa7c4765e00db4a4e69614

SHA256
b24da25fde89485e727b2120738df2e41a5d422108a73686222987cfb90c23c0

SHA512
67ca19063440ded6ac89e39335aad09bdca3780b81867c4244e6888daea419c48c1c727f554f56840cd58db48f5e348b1db34ebbc2174b5dcf60235cf64d7a2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1bc3365e35897faf110fce22577373cb

SHA1
9ac3c6e61e7aa2548399b86b0d771e1b5a3f23a6

SHA256
67a7589e5340e3d5d2444bf8947bf9de047f77a5581b4daed035e16305aa1a48

SHA512
6f0c6a8983e027420f71b870d14ca91aea3cb221847437d0103bc1884f9a69fded581a5eec41ec7be5a7aa086a0fd5d0bf5ecdab49b752428152201dc6a5071c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar276.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit