61c7aa592c5cd8f8dd5016e75d9be6405587576ce5eb8029e920b7d9e87a3968

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c3f8ce840a81f7faa3b06a526c4e2bc_JaffaCakes118.html
Size

25KB
MD5

4c3f8ce840a81f7faa3b06a526c4e2bc
SHA1

e1cfe0533ad9cacb6edaf2e23aa0f624b83e1c9b
SHA256

61c7aa592c5cd8f8dd5016e75d9be6405587576ce5eb8029e920b7d9e87a3968
SHA512

c07e6b4b1b78a622c2eb5d47a955d30424b9e9bdd4d227fc3906c60c9e53fec64143e9f45d69190fd36f788356eaff453ba8fc498f5937733dc1b26ea98b620e
SSDEEP

768:SvlRhYp+VWjXedWg69N81vhMSxAJBpeq2mRwgRpjVB5A:SvlRJxAJTeq2mwgRpxB+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47464BA1-13AA-11EF-B781-461900256DFE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422042620"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3020	iexplore.exe
3020	iexplore.exe
1208	IEXPLORE.EXE
1208	IEXPLORE.EXE
1208	IEXPLORE.EXE
1208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1208	3020	iexplore.exe	28
PID 3020 wrote to memory of 1208	3020	iexplore.exe	28
PID 3020 wrote to memory of 1208	3020	iexplore.exe	28
PID 3020 wrote to memory of 1208	3020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c3f8ce840a81f7faa3b06a526c4e2bc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
501705759d76c9b0a14bc030f7be8f41

SHA1
f003de8a6c0ecc03a4829423ba3c3c6387feeaad

SHA256
5ce323e7293f9236cf8556dfc5f0e7d156f5604870810aebeb6443d28ac1944c

SHA512
055d23ddfbc959415aabd356552037a45538c821cbf59e28f7f1ee53d8d1202de4d1218a9348647cfe07b5d2d7d344a1bfd6f761c8a8c403091f0ccf0ab80b74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b148f0d257bd07b05ddadebe6d14393b

SHA1
5f6b6a69d3c5dbfffcba76d8fed0bd199666e51c

SHA256
76c8c07f3389065c738ef54dcf80479196ad5259670830dd02f0ededa747a2cd

SHA512
c1d2d260230a4de9757928db37231fbf23a7950afdccb96c95a2c62259ddbe656d3219cc5e3f98ebfd5703abda88d1f6e04815ca8215a76db8c46eaa17460f79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eb7b80ce5177f2a279475886f9e9928

SHA1
c801971740347d00ba628c366273c1f471e9f2d3

SHA256
d26e1680264ea4f2d0fb8d7cf29ca377978232f4ae8ebf8b9f9ce1f205d6039e

SHA512
b71d636f3c19ba25f03ace97ac05e77ede0477ab454a77cb81417518276eb5b0eec972ca5f0d19a30a482596c00d3f23eb785a06b53c585bae8d1e3d03a8debb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67d48050076cc57e2ba81a24d05ac7e5

SHA1
74d115f298dc9abc148d8c81e3f5337db960498a

SHA256
e2f39cd587c64b436e2ff903f379e3f03586a0413cac3ca484d3f8d05d8f27d5

SHA512
46d96a1deabf1076787962928b24772c4156a68688b5b63933c98c90f6e9c8cc8750273c15ecd34363daeba2b0ba7cc99846338aad8500b1d39c7a4bf0b5facc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fec6f7081191d0cc3ca63b322d8386a

SHA1
4ed1b592b66230d684bdd9bda980c251900c865c

SHA256
9c65746a44794663ccbd9da4858cb0833c391ea1aaba90240fae7d5e501db4e1

SHA512
6bac49526ef2486933b45c77a0de52d6be4c031f5af33d59f721aeaaa9bad8513f2699b84c8742d5ef13cdc32916e4e32b4283d7f16d9bbd02d525baa7c1ae85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f60137a0c576dc54d12e751e5b069ea

SHA1
bfad9e75a5571f625619502962559b65b3f05141

SHA256
764898d3cd0db048937f1dd770a2991f946a7355b80a3071960c4da8ec1675b8

SHA512
4f02e9cbec8a9ddf2a6e4dde8b976af14c7018d3f4ddb15876e256aeaa758b7a2c249b2d7fb84a4b7a0e6041b8009da9b8b8c3fc9f42267ff48c039644cdd509

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5581219b24c69f97878960ae4457344a

SHA1
b5ee8fe125ed465e368bc98f6303c3e8d302c731

SHA256
a73245380f4985966ecc129d88f4787e71a64bfd009916a4adc85257d6b797a3

SHA512
83a142f281812a7980c465f147631ea7d4158a023084f9580d6d49d4f1360f3ecba4f6964682477fac4aad94440ccb5743e4b4cf588b4a3fdf0978f5e69f3fa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60fe8bbd953773cc3cfa559d4ba3af25

SHA1
18f4e316ae057ce33a40b2af7a9b3368a6bf22f2

SHA256
d757bfa34612f7b293e67e8795d74f58d94fcdf55c9bc452cf3c00d89bf51c83

SHA512
9662d421dc0f6a76a7b70339480d6662a13fe66d2d43b470df300d2618f46ac897e664bdc147513e9a2ba4c1798b33faf3460612b2b8c67cba03c5d48dff614f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceb1b4be716df2fd0ef18735e68c2fbf

SHA1
6147e00489c45e46bfee7846452a963afebd03ce

SHA256
cd9dce1a26b12e23f7a393cdf07531128de642672d3151802c7b820284b5515e

SHA512
87f18570de7ebf89dd841fc9b9497222f55f686a40c7a107d9769944ba36f648f787efd3e623790f4eeb5b90f245258606185e8efb7ed693a97afae519cd8dbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1268.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12CB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit