edc7cb93b597995dd43293b0da92708398092776cb12dd30d3361494a729e027

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

603e56f8fadbdf281d8e38693912f0b6_JaffaCakes118.html
Size

19KB
MD5

603e56f8fadbdf281d8e38693912f0b6
SHA1

fb7ecac52f7df47493c2940d9def2dda784f6668
SHA256

edc7cb93b597995dd43293b0da92708398092776cb12dd30d3361494a729e027
SHA512

efafe548ee1981d0fe5f8bc21399b887b39ef32dbf6b2077b58f628e49d3ad19253a96c98e2053421ade0c992698860629c8db9c528887810afa0ffbeaffc8c7
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIm4mzUnjBhWY82qDB8:SIMd0I5nvHFsvWrxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D23E6F71-16CB-11EF-BB79-CEAF39A3A1A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422386881"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1876	iexplore.exe
1876	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2720	1876	iexplore.exe	28
PID 1876 wrote to memory of 2720	1876	iexplore.exe	28
PID 1876 wrote to memory of 2720	1876	iexplore.exe	28
PID 1876 wrote to memory of 2720	1876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\603e56f8fadbdf281d8e38693912f0b6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
996cf2e82773be7acb5c4f198625c94f

SHA1
245446a4c6c5781dae9bdd42c8f1b304ff9a49e8

SHA256
1c25d305abe1a47b72c7ab3f924f81de6ab80eb85d1278ec4e5797b3b5357e0e

SHA512
75d4f23e60420a184a9edbc477f2949436d919a203e662e4ea1f97e49df25d9643997e57c9374999acf738476c2eea6d08fdf23c7009c8fa62449221e9ccc9d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4415bd950d4aabe8c115accd83b138b1

SHA1
bcbefc71d703fa3caab66c8f7687c7adfb700f82

SHA256
be23882bf7c174f3421fbb10f2174453119bff59367a55941cc056b878bb30ce

SHA512
abe8666b178eae4b3304753de1ca6d694b3f84f1b9ec5408f652403c8c5872277ebf247b01f7980edef8482a04dba7ffbe836c6e3d2c4f3f3aa07fe3b1f93e7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1479fb33340672807a73dad9871cdf51

SHA1
ec9e6d22d9c3def8d6ee29ae9c281f40ff7e546d

SHA256
bce25fc459ee9699a9d2056dcfc57afc1ed7ba47c787535f384f5da1a24fcb48

SHA512
91dcd52caea914439ae39f1422bb3af1b7fb5cecc98ef24fd95077e793f4847632d4ccad2223dc5c0fdd8ad2a478d796363d13738cc7e697f5f7dbe5a3809e7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13a0b6d4bf23fdf3a3d237c6b5ac8994

SHA1
e47b2da005a2ac662772cb02d88f7b900786888f

SHA256
d253b34279cc35bd32733691e0b96ee2a88035c048f629a1c1910065ec0cb333

SHA512
272438250c93e9df9d5d6e0176d6e34f944a377a7c71c83071fb49fa7536196816fcd44b0c2e5d01d798097b96a3a1edb6185562e0b02c7e24ec50637a7e275d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4734866506d52483ae23f008f15a6821

SHA1
a922556e09b16e757f41b9a893d0855219b750e0

SHA256
495dc175c5c9f470c6ed9490c4a174db7e1cfa8d35f6bb34e19e0de60e2bdaab

SHA512
602196a2395f6140db914c1196b09b17164d7cfbe925274e7cc572f553aa6307b28f1ee940d3b556f541ecb122395bc55fd3714864bf11764fa8276c505a8601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0776fd49e7844561cd52133fdb1fe89

SHA1
c082ef2808c53e9795dda65d2b9e4d513f0c06a5

SHA256
82d1ffb5322f30fb8f2fd423a2978183f4e0b7192347a52c5c933db7c6eb0395

SHA512
ee283115f287abf145e2e52df4a9d99fcb1ff6bdf3b76a04bbbfb14f46b5780d9b421bb82d75f57a702555bf874169143693b2ca523554c1f6d383c852a67341

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00eb9c9f86d37c7df5bfe320d2f6f164

SHA1
9d4fbdcdc7a113dd0426f0a1facccf3d2002ff94

SHA256
bb321eebff1b63a3b06012f1e5925e0fa67c50005a2a46821d4c396a2553db95

SHA512
2fcc6b9b5a5c10bd72d201097fb801e716ca1075704f3957a4c783b5a395c66988d197f2645084a599b1857c3b5905148fa4653b4abb2c166ab403cf103added

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bb134242fe50b0a9c452481161673ab

SHA1
0a3cb38042bd3ca8d3e6f48d9bc583612f5adba6

SHA256
53c2161f50fe407acae8c9b66ee18667c3f8da21bfd4864e639e0ada6090b252

SHA512
7c3745fe72732b2bc0074875b5f3058f9fedc055ff982d1da971ffca8c2e7f955d1bea129233c2060f2b26b61368cdccef69a3f463d68408dd08ba42caf7d21f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15ea2a3f1f08d80080451922c896709c

SHA1
78b764ae3727dc6706a16e529552410af879be79

SHA256
04229dba4d16a464e6961dd8ab4c9007a1154b9ec6f8533740271ef0ce473ea2

SHA512
4094e574fff7eb3285b2d853ba8e01d9c032e282acf1cbeab5de3360ed68435b83e819d9cd1bc2acde0dbefed29777326d52bd22cd826b86173c8ec30e45b661

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D52.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DB4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit