dc2c061cb034fd3ad4836ee1ac2059efed595f4afc97fbe7f38ac7de461e56f9

Analysis

max time kernel
135s
max time network
139s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4c2218cc3a6b15a3c8adc84c77f59369_JaffaCakes118.html
Size

213KB
MD5

4c2218cc3a6b15a3c8adc84c77f59369
SHA1

829adca2261dd2cc3b0875dafe7bdc6eecee6b03
SHA256

dc2c061cb034fd3ad4836ee1ac2059efed595f4afc97fbe7f38ac7de461e56f9
SHA512

7863e216ad9ea35846da2ef333f4783a206c00da90de7a6be25f0d51c3836f162076f688e6437fdfefc19aa42984c5c282adcf11b7177177d3090aaaffe66586
SSDEEP

3072:SQOcNSHL7uusheyfkMY+BES09JXAnyrZalI+YQ:SQwCh7sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14B2DD61-13A6-11EF-8E44-4635F953E0C8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422040818"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2984	iexplore.exe
2984	iexplore.exe
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2068	2984	iexplore.exe	28
PID 2984 wrote to memory of 2068	2984	iexplore.exe	28
PID 2984 wrote to memory of 2068	2984	iexplore.exe	28
PID 2984 wrote to memory of 2068	2984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c2218cc3a6b15a3c8adc84c77f59369_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2e2017afe9b4dcc370ef9bc0ed1fcbd

SHA1
b3a82b2d24e85cd2cc432ff375fdba306fa1b5f1

SHA256
d2d8cdc021eb4a4e40024a88f83a906d28b78cedf9d7f6476beb8dab3f23f7dc

SHA512
57613a656e88e5501aa709f8faa867618448612f627fa9629dc53167e65f76ebb722ace926f8f2e3a68813631c914af2bd42a02222181edf8415cba009ca37ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a82dbad54f69d97a1f08b3d37746a959

SHA1
e31afe096f6d2d95a8fa0fd3fd6c2c184b7f5115

SHA256
dd875d8eae9ef8d24111cfe5d66d2863c0f1572653bbc550fcd5604efd9fc9fa

SHA512
ef5babbf989486b2a3eb59b11c6242f9f73622993fe61436a48220206d8b868ce52920da34e6fab515ae03693590bb2c40dfa9d52f1421f1520f3a7fe1e0482a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55a5c9337bc7b2f536b920ca34c61f20

SHA1
64669b0300233b8c1b12c458e3eb944ee8d3d9c0

SHA256
3416cdddce49a77165fccccf45033a49af7dae57e06809f0e5f0d9916a4282c4

SHA512
50d73dda978fc70946107f0ead4cc0074a5442a0666558e176fd1643cf4af4d22b6bdb4ababf0f0939572618f040a1ac6529856898693d96439a3903db50b96c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba41afa83f6976d23c0bfc4ac4bcec7e

SHA1
d62816789c97853f0d1dc0e8f72dc4a7c69fd4cd

SHA256
b9efbedb01e01e2650bcd290c4b68b936f9e1201596d6d5c703dc869cc7aa026

SHA512
2a195ffb8e312247743f49481bdbeaa764ab232141e2a7f8e2c8affe94495aef76767dd663b4e8dc4bee965b6c78f3c7acc94fdc1d1726a8de32a548d4c72fc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
884908e982928c8841dddd2b47aa06dc

SHA1
33d5b7e298191d379255f418581fa0adeec226f9

SHA256
45b02bf0613862a5e3bc5b62d0d25004751a793ee9fd3fc840394a4b97968448

SHA512
d366e1e90cbb10a92954bb7db399dd2bebcc081bd4820b0324a63d245bd6c73746ba2b2dcc186453afe3369047616e6550531b76aae22966f5788d85adbec6ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00337a8b859c63b620bd8466b569c8a5

SHA1
803d67f2faef8daf550c4562635572fbe32ac673

SHA256
d54ad70f69d9347255b6c8590d92a84e278995ceff17e89ca29d968371b99d59

SHA512
fc2b34a69d30a3c0c0a254c9ae12f54f2b5afe0287bcc2d1fcd0bb9961fb4c45f7a734330b37c743966027c381521dfcef6397709823aa2598c77d6032f3867b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
754e77614accef22c2e1a54f593fe2fd

SHA1
dd0668a32ee31d32b4824337aa3f3a528a61a550

SHA256
672d0567463de40349906e047293f35a91ca284e0dfabdc5457b35b27e00798a

SHA512
ded684b272bb7dfd89e94ec46642c7804e9f4c7d288986069435d62ac5469afeed9aa18e080ac1834ddb059ada45f1ade2e7190bdf79dc5e507b247dfe76c3ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9ba5438580dd1c0e71222a082e266e4

SHA1
36664155366ba3388ec8b365c944efb141bfd7fd

SHA256
1406b53c3a74d140aa5d869da7ca45e232628be53f6e91da2afbe690aa7bd260

SHA512
e21fdaabc88cedd36431a86410231b1de83f54f3616d288fa59b45bb93e107ffb53f48bad73bbcb6011e6d810138981806254f2620d6a8be7f6973818fafe46a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34af4df6fa14e955dffcbe8ab73ac0d5

SHA1
7f288b86e41527417b16fb4fdbd5dd41d1f966cc

SHA256
0fd52dc403fe9f8b35f182a06646d79acf152c082d30ccf82780b8e7ce2f26f3

SHA512
6205cdaaaafced469adcbdde003c065efd2f168ca706307af905b3595214e8003773ebec75e2c1aab914630b9b07730981b19975e483e8841085e4f1bc53f8bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71a740d0e792abdf9587f4f89f402105

SHA1
d35b7cc4a3a3e21ce5fdf944beecf5527cc46b07

SHA256
f6a0929f82545704203c8a765569c42730032bc464c346dcd94dd6a78a64c8df

SHA512
c5acd1ccc58e637dbcdd85ac65ea692d270a170b8bd407dede642b706c0737fa724174f27c65cfca24669774a4325dc9c38fb36e24ff7270866483e0fd0b62de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ab05e32e38bfa330c005817e8a0bfdd

SHA1
6abab4537b90bd3bafd66fe151ae92d1d6618999

SHA256
ef702c8c3f69aad194a8e1b9103a22d84e9dfc87dced99148726a56bf23e4143

SHA512
e6e86c2ebcec8b9a06ae7a01c0c0b2bce8d4a3354e386a236078de9e20462a5a45dc1ac4c0eaf137449c052ec64cb6df13e08a676a2b2bdff16371385b4f094c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab39F4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A76.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit