3fc423461005c36b971ff11ce8cbd76c2a059fa97c40e70ce0a75c4b4c71f8c9

Analysis

max time kernel
138s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5c984e5547b4dc6ab8a56505a7d7c7a1_JaffaCakes118.html
Size

3KB
MD5

5c984e5547b4dc6ab8a56505a7d7c7a1
SHA1

e01e634985790181db2ab5bac4b4656ef92cd68f
SHA256

3fc423461005c36b971ff11ce8cbd76c2a059fa97c40e70ce0a75c4b4c71f8c9
SHA512

63d55df51d0a514b4366dd574eea515833b11860ee5cf74039275f4d62d197f4a6d39b2bbff1d31074ca35e20c831659fb6f91a113c4e0053769153bb3b0ddd6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422332034"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1EE488D1-164C-11EF-B0DE-E64BF8A7A69F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1932	iexplore.exe
1932	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2804	1932	iexplore.exe	28
PID 1932 wrote to memory of 2804	1932	iexplore.exe	28
PID 1932 wrote to memory of 2804	1932	iexplore.exe	28
PID 1932 wrote to memory of 2804	1932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c984e5547b4dc6ab8a56505a7d7c7a1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f666be4edef7f749b0dc3a709f74dd9

SHA1
58f907efd9d46cf5ae9778f6ef055d85a9191f77

SHA256
7eb44c92e5d8ae414a3a3ea81be92b802bf0eb2c6657495692c175344fe7b413

SHA512
9f6696808083bda1a0bb6c62a93fcb36da7a109a9925a495e45d9cb3f6b8b6c54eeec30fa631e60ad50057ce596726f843fe0a84c76df4a21e384cd509148345

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd34a00750b8eba40680887fac9758e2

SHA1
468bbeecc9829cde2edbfcce8d66c38354b534de

SHA256
9e65e06ff33ce3332196892b37ede174e62c1702ad00008c149072dd60565a3f

SHA512
db46a50635e818c76dbed91dc7f8979527ac4e0a4e52f2f251412690721e1f7e7b35a71cdb16f5073256c6d969515c56f1784567089c6b7e08b3936d79a04c02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c4cbdb5f1d396f1a5a822746b503ca4

SHA1
286369bb9f1e45cf4fc700722ef17bdc678859be

SHA256
ced855dde0917d929030c3b667aaf8442622f5f7f37943c1098ae7e4a15ea7c3

SHA512
3da1114f463757f4d6e2ad4f3f6d7f761526f77e619b1709ea996ab2fd69c0c6cc022d403e94a12c28a405ac3f7e65f18e46aa7e35b576dfc2979b7d802a8611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90c05509618f284a86465402ca262620

SHA1
8b5e0b296547cfaea4031b133ee2c1597d9d8b89

SHA256
734ed2906f5dc29dd06539bd45e27f7fd6e5ca5d640b16fbc9d4b0e8d85c6ecc

SHA512
34d5198a12cfeff97e8d552e94425880ccd2609e8bd114c8dd5d6d8cf8f3f33ac7b91e39eeb11e8d9dd2d5849ec09ad28edff73c01e41bd1178e908741952f2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
061f8ba11c128088ffd36ab6e9a05397

SHA1
1368fff69fb3446bcc1d2fc45135fe778acf865e

SHA256
74d41232e4924444cadebf069c64821f5511cff9227eb01c66046f28996de940

SHA512
7775846f550398ffadcea0a1d2e26768a77525c72a60782b3921d472dcb90f5972242a4e3c298cf11a6790a78b612615c197077c29fd729585cb96ba17db7e74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45acd48a394643e16e8762c198633068

SHA1
0a25aabe1c8c695f2f3f61667818b05c36462c7a

SHA256
735300ef9f6b7bb1111f1dd91bfbbbe0fc4fd5ee7669b7ffe8dff63dd27a378e

SHA512
dc0d2eaa57992cb439b252b5649f8e2480ec98dd2d92a7b24576382cbc65241ccf01b5820993ab2abcc802a0008354df239fccc6decf9da91df6d1a1b86b0fdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de4eeed9e1f08e0c6f50f8d8cb0e0d45

SHA1
1670225a7eed3284c3df9b869049ea1be299fa97

SHA256
ede1ed65fd8758f20a4e3204e624979db55e7fa0b8060a0e406929a8fbc977c1

SHA512
7f89a19232222f2115ac04436bcf4f1171856fb779c02d9a0546fd1998fa2c0145e10034aa61dbef11ca6ef474082ed5bd705adf5e3ca1439ff282ec41ae1c3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4274ebd4f43d273e447768e1dcde9079

SHA1
1993074912d83ba95d32ab2c621326bd66537855

SHA256
c4640f1736d05a9dfdfd8b17b32247729d040a072f80009f5e94aafe80bbe068

SHA512
ade298b2b86dc6931d22a7053d571e83833059075068225e9b8d550380fa2b46f34584eafce53fe53b62a69aced6cfcae5d85c48914dd9632fbe2de3b19530f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55a240b76d7f2e992352fbb4d2ddb71e

SHA1
5fd3072d0f9a0cddafb3b800263163637f1bc76f

SHA256
97c4a53d855c57a8d7a8b7203a48d254deb5d1f417cd20fb8051c73c47d515ae

SHA512
05fd06dbd90961750d078af2bb22793a611b911bbc0fd5f8434eef8df970c35e7657ad596b41bbae2b1acfb2f0ef839ae16905fddabb41fbc911a73f07e3351e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab197A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19DC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit