a9104a4494430233448f8e5e832671df30305c7cd3026c9f1335f0ff1436b7a1

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64ecb0db3f9593def3d9502f4ace01ff_JaffaCakes118.html
Size

127KB
MD5

64ecb0db3f9593def3d9502f4ace01ff
SHA1

1500adc2c0a05dd06b2020579daefa0305b614d6
SHA256

a9104a4494430233448f8e5e832671df30305c7cd3026c9f1335f0ff1436b7a1
SHA512

326d2ba86cb12aba0d008541b7c010ff2e2dac6fb90b8d97f06dbe5689fbd3e18c79c7dd80e63290a353f6e366447a211b222003e21c30a97bcb33fc9300c983
SSDEEP

1536:FJ7QBPyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:FYyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422490862"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAC48461-17BD-11EF-9C59-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1136	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1136	iexplore.exe
1136	iexplore.exe
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 2256	1136	iexplore.exe	28
PID 1136 wrote to memory of 2256	1136	iexplore.exe	28
PID 1136 wrote to memory of 2256	1136	iexplore.exe	28
PID 1136 wrote to memory of 2256	1136	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64ecb0db3f9593def3d9502f4ace01ff_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1136 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2318ddce848488e92a2583be4a193fa7

SHA1
b7c253d3a90b5c218c509729a9bec21e012dd4cc

SHA256
965fdc03e2aa946170bd17a6ea7d0801b1edcc91133c41fa7c5b4cf2000c6d82

SHA512
a6ef084c7f49f31726836b9bbf9efb7f51e895648c3182a37b9abaf1a0bd2674ecf14eba669d5531429304ad5c690bbec069849ac2997d99fde2643c57486ee7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1af215df4a4c61ac28b23fef9f49bbd

SHA1
48d0efe9c1974529f8c45f3c5355f04e245bc9dd

SHA256
311292ecd79bb63d3235ea98e50e61c8647b0e9b22a80b5d91316901796acd26

SHA512
ef2ef36d5769e43c5b317625244c06035fc001484526b353022c566ad17576c755f52722d67c9281e1c5de29f3435467541d3076d50ef14eac7b66308b90c536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dff61ef12a8a2a1f62da68c6766a5864

SHA1
b452d0dcef1b7b24bb828967f85bdf7a6377d64e

SHA256
c9c9e7693cba2338abed6be13f7b5249e57c4b7bfd4dee81ef382e614fd19376

SHA512
bfc1fda1916839dc537bb72c54978c02d0f055582d815dd28a550f81cd4eea8ef38f4dae61ec958b86d309e9d3f524ec0aff73b7269fa19077e772e87594ac4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d1b725f758962657df0ad62fa86404f

SHA1
ed6379b194fa85bae34ebd9a7c722186793d9d95

SHA256
137acc60e50ca6007de8e8f911fe3de188ec864d038b1309cf4b66a241ac428e

SHA512
7ee8312d297c0f6bb19dc8f4ee3dafa390f96cdfafdd109d1b6633817d1cbcf3cbff2927ab294daa89dab5d364fe1ee262a983338d2e2a8f07eb4fe122062234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
641e56af2e1e945a23a1afca5ad2545d

SHA1
4a77dedbbc72d25fb7d3be99fffec98736b5318b

SHA256
66bdc14939bfd4b11fec7ceac5ae297e3cc30d6c04f5c783e3002b45ebf17498

SHA512
0fc0210172c8912682bf985e27e811323c3dfe6717ee60efc324e8159fa71870b0e1d851caa421890f85471d06898637d2bcda7b6e4493127a83fb0674d3c2cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58a312f8800b15321acb1e57e270d1cc

SHA1
cc9ba03f98a4b753266ffe6e3caf440d9a90bae2

SHA256
3d8ef6e8496bc3b7155469a42641ab058bf9745268fab607bb3020536bba2cd2

SHA512
406ebfabf737e99f780c0582f9c4f69af86f49edf516fe5382b4a4938a9b8c908820c18265c9d8dfe4f25e2dd53b23ae4de6f5ec6e00035787cec7795db77745

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f3bcb2f993cff9fd15b8580eaf309cb

SHA1
8f42c116bed20e8f574502b6e38ed7ec2ff6c6ca

SHA256
e51dba93597c96cf7ecc929049b35e8a0483013eaf6c7ca1b7c4ffa4c3b1186a

SHA512
df29c4a8528d77cf54fd2422ad34222770898ff24380e6cf37ec5f7a2f4b53520c2e6f4a1b974fc1550ff34378511b9ce89778dfb3d8d5e9cccfc8ab87caa96b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
761313d6e6f52ec688479e24aa38beaf

SHA1
367013bb6d73a5babaaa7fe17f2b131c17ec875d

SHA256
f11596e82af88a43e69fe7e77e799a130dbd6ec78628954a5b90a045fe6afe2b

SHA512
56bc404f8a6d6ffd36493acf3434d35898922caa2ff45636ac6f903273355bf53783a2bc7a2a2ede9a98a573a0a0f4624fa695ebded92b7de026abada7b8dfc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0be27f69432bf54f62744049e4424f45

SHA1
f46bf14d0ccbb6fc9b24fd1eef3a82376c1f551b

SHA256
43a6dbb220d9335c9584e4c7629f1d8bef48be697fa57d93435f2713f51dc41e

SHA512
ad44b1e41673a1153e0a365fef181c3517a7c4534a39f42f551610f4ced54035f15b0f89257f88eda251ec610f3ef2a1d09277d10350fec1293bab6ee4847b59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a0b51ebed0b391bc80a713d4327fdee

SHA1
190b6259e97692bd8b82c545a259bb148788b5ce

SHA256
f02c9abfd3e9b565c35e30677daa7e5cd88a43b5ad4c3bbfc2c77d0ddc6b8f21

SHA512
30848a82341512150f92bb9c816555281d78460c233bd7f8aa041dc0b7699ce8ab097edd8c0f66c6a554b300d9cadf0a4d73eeed6e9639729051e048ab26ed8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a014ee2bececd8cda979d3528072b225

SHA1
7c20e181ecb009cb963af4a0a29b5aedb598704b

SHA256
739927742ac8126b2198d546daa206c47cbb4c7f37b557f0de5e4cab863c9833

SHA512
78749ccb973806024b667cbd1511cbd54a597439cdf20926722112574cc24ef3c98de8aeb3db5e05b53d4087f4d7d791bd50d489743368f1cfa2f3074555c2ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab92A1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar93A1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit