db2eb794a20f59c91c3e3f811984f7136b1aeca775e99933eeb59a6def26cfb2

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

50e4174a1c2a0d3f2bd7af865e9fd843_JaffaCakes118.html
Size

18KB
MD5

50e4174a1c2a0d3f2bd7af865e9fd843
SHA1

58d81114613a5861de56068c0118a7d70b869ef0
SHA256

db2eb794a20f59c91c3e3f811984f7136b1aeca775e99933eeb59a6def26cfb2
SHA512

112f938c650ae0d435d35793b825182ba714cb5133cf74567cbbeb56043bb9ed43922d6024b5efaaa479568d7f1f517204da846b50cf5d1a0e7e23fc078bbdd8
SSDEEP

384:SHuCs3/B0gw4mEukACkSpCYBY3IInyN2RnQFV9DdRDw8L/CRA:SHuV3/B0gw4mEbfAYZNw1PA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{133FCFC1-147C-11EF-8E7B-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422132730"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2740	iexplore.exe
2740	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 3048	2740	iexplore.exe	28
PID 2740 wrote to memory of 3048	2740	iexplore.exe	28
PID 2740 wrote to memory of 3048	2740	iexplore.exe	28
PID 2740 wrote to memory of 3048	2740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\50e4174a1c2a0d3f2bd7af865e9fd843_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
90bc648fec56c9978d841540c664548b

SHA1
4d2c988785a1de3dc0d4e1185452bf54ccd90581

SHA256
6ded520650f70e5c0ca6532828955dce744faa72ae90ec5846e13ae13aa227a0

SHA512
429a4e66fbafc7ba721ae88c49af7c451fbe2c11b243ce95383260131ea65f52179ce1fa3306c84a353f70be1508bbecd392fa4cf8c6bb13cc1874c002b49929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
900e020b2e0e286dcf962a9209177853

SHA1
15274c64de1881a98729b57b8e720a829a5471e8

SHA256
67a468b73c7fb5be78f51c5625cef531e8b89a988988b9baebd7f7f3ac3bc314

SHA512
1c6b40d5d7f304fefb46916b48d7ea38b993f59c6287f2a7cc602bf85b1293d8550a64a08dfe9ae060b6dfeabc4646018d3dd4aaed523c27cd7c5909d974a94e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35014cb5932148d514588f7d8e40549f

SHA1
14c9508c3739c364565213383ee027b128472a33

SHA256
cf378f96a8ad0e2760f8c2e56f72993c0cd9f08d1d33d8d50f62ad965c8cced7

SHA512
11a2574349ceda633bd68724ce7f7f0ca3cf80132c55ac5a7eab557e6c329668f50c10649b2e7305561ec97152a4069820f0bbcb79c02d3b6b746ac2cd0fbc07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cbd70ee8b210a40c834f994f72d5355

SHA1
9a158800ec698ca2cb533ae28641c3aac17a4281

SHA256
e8ce9a91bc764bb31d05c85bbe021760dc297cf929426bc1d6c21e4db5d43b8c

SHA512
62491ae090184ec26c174112a3ba864df8459fabfa1aa758be8bd86ee676ff84ddd0dde4bdd4849dbf31310d1008f01714e17466633ee6a539e566e6fdaf480c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbc3ac5857956344d4ad3fef04ed665a

SHA1
2cffb2337797a9b9206f442a901141b0df771c22

SHA256
1ccdb82f58bccc30150a107d32b50dab5bca9d006a04daafb7d130461cafdcbb

SHA512
52a7820fcba4b0dce0e03964a8b83fa4e26ab07b84dfc89169e8c0d8c04b439c44bb932266b8ed5c63e8246472f9e1bafc06963c1fe029c1b4b1649e61c39212

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f0958d75b2550347f6cd0fbce3ee08a

SHA1
97f1c01281ed353fb4fb8227be7695653ca17173

SHA256
03880d636ae6c4b99fefda7fed486ad0642642c0b7b6529c9d19fd8909971708

SHA512
c920cb38723facbf96f3c5e2f42474283ce71c0e4ecbe6c12cdf61e8296001b4cd6ae0791b9423b8470ef74e189850224eaf44b720a9e86e2914c3f9283fcfc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34c2061f47c41c4fc2a1b0afe80348ce

SHA1
287a743609a9832c1a68070bd52ff7e4711cb5b6

SHA256
530c2d54f7ad33254973fd3e2c5060238db11f2a22e9fa2fd15dc533b9762197

SHA512
72f26addc7ab16ec60f33baf2b04cc78a39c0934b1b68ae0fabfb8fb7f0fa0c67d1e62fa259e0d3245788e708846d9850cabbb04b460d3a9dfc40203b76a1816

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d11119c014b522660491034d7537c251

SHA1
ab30f3462de808bf3b3f9615f85db3fc46467409

SHA256
21d0d4e56044446a4a32255538e8e1201d6b9b964035f24e8f793421f950007b

SHA512
89da139d9a0f58a413c6d4cfa919a1cb388b104d1482f63870b6bbacaf1fbb959b4974e89b9ac66b18cbd12a48c59099429448180fce56fb0307aa939e2a9f81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5aace8eacbf4852d6760bfe21cbfe8bf

SHA1
e0b8297aab5d3f99b4a988a4df56e0bef8389762

SHA256
3f92c83905aefa365fcdd2db1f80de0c6de798124b317ab0bc8e2a0f74b41eed

SHA512
636c54b21753b8aebb5ef33762299851e119eabdd0bca355c343fceecb8526da71062156d334a3d969c328fff265ba76a31b37a8cfd46e9cc77c6ba107a45ae9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcd5812e0c0b61e3b4c55f8b4272abd8

SHA1
d2b5ced0b4f42c72462c5cc0ec375b52a2cef478

SHA256
8f40ee62d17318ffc9a72977d4100cc60a3b73a367cd78063046c8b9704f7f7c

SHA512
52eff6a5192633a27ef4c8a4d9f45f27839bfe9954c28958b4fd4f3bf73d27bf9f8939e3a87f3a4e056f2defe74d4c09d96959624316ce474d2815a9b2c36538

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d546f06893ad3062ad1d81abebc8d7bb

SHA1
ae330b1ca4f9e05528b96a636d386d1be6678398

SHA256
3141de60d97d49a37148583c26e2d69454039d8560b6266cf8c8ee244c17743a

SHA512
04395e845e8070840ef0294408d4076896891d770f4e08018a53780a7fec8542227602f449fce077f3c4a4fc6f17d2f9a729a5da66a2411a5c932694993f41ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19AF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit