ec763892bf121e43d1224f91abb62a34c02c8fac6bc40c21566a9177dc48a5a5

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

62ab5af48f655b29e2dd5db878a246ad_JaffaCakes118.html
Size

19KB
MD5

62ab5af48f655b29e2dd5db878a246ad
SHA1

1449c6ab8afb747eee9ceb4c45e2e18124faf641
SHA256

ec763892bf121e43d1224f91abb62a34c02c8fac6bc40c21566a9177dc48a5a5
SHA512

e7f5f068c85ab389c2dc7fc86d9dee362ec893cb882e8a7e728f8e8b703a9551ca9263fcbeafe4a8a3a63b3846e307705214d5eb177cb442e6b172bad232ed93
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAmh4mzUnjBhyk82qDB8:SIMd0I5nvHAsvynxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5718C8C1-174F-11EF-A68A-46FC6C3D459E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422443368"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2216	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2216	iexplore.exe
2216	iexplore.exe
868	IEXPLORE.EXE
868	IEXPLORE.EXE
868	IEXPLORE.EXE
868	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 868	2216	iexplore.exe	28
PID 2216 wrote to memory of 868	2216	iexplore.exe	28
PID 2216 wrote to memory of 868	2216	iexplore.exe	28
PID 2216 wrote to memory of 868	2216	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62ab5af48f655b29e2dd5db878a246ad_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ec2f77bf2d881ee5cdb52a766b0387af

SHA1
3be93f83d2cdc5ea3eb0092d5e6e8313a51f284b

SHA256
a72f236a1ea85aefa4882040ff9f103c2d6fccbfdfae8b900ea0fd8a9fecdf81

SHA512
a3c1929f6c5ca5464468d9ecd9a77dd197194624d1576b524fe4cbc1e152c7ebe1f13fc40ecde1d53f8228862b56f524777e56ee6c6468ac96ac7e2ea4ace2d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fbec563e5cb397e3575679c449e0e00

SHA1
d427217a5168f7482f31d3d8264b2c6c0e1e2576

SHA256
e734a1b4f1ed8244db1dfe535f247a7fdf9156eb08e5bedca3c8c3f6d0f32dbf

SHA512
c16a141d54851c36931b1100401565d0ddfc63200b0a65ab4a58adb79ae6714b352cfc264c7f366bfe4fd12ae971049af50a2444f58aef40d97582da71f179fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f975116f9b8c0d0b8d327015ad8be207

SHA1
3e0db0c772abc5ce88b7e5902c34afad6feb4967

SHA256
ba2e74b83d7a70067aa0317f8f046e7f9876dd620234bd3ee1cdfadb154713fa

SHA512
e12ab611ce9b295f6853b6f36b3fd926244cbcdaaf7a787e0382bff582f101e132bca34b099958a222a6a876e570e1222816c10f574dfbf8cf99ba120eb9fd5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00e03d4cc5d730f894fd8809436e5b72

SHA1
e7ac98fd62c261cff980f9194c56d8f686e3e055

SHA256
54bce16303c19de9bd3ab1becfa49df3493becbd3eb811a8966d54e89dc38735

SHA512
9dbbc3775f2052547ef0f3250407c219d02d0804c669ccd948600a7199ce4458a89822192b852ffcef5adac7d48efb214472fcfdc9e9116f1845eda1a5b7f249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e1ce741bef79e19356be033c23e85f5

SHA1
f0848178d17be6a349fa68ee043ad6ab94a2b36b

SHA256
9d7597283cc149437521e9d09de786826459314faaa4997333863387cb84d141

SHA512
556abbef3f6dbf9bd2b4ea55d287648eb93ee84765e6ed437a229ea0b190590ad515bfcb2f9b63a011e62cc3bdb97c65924edbaf639f0b3a161b53fba8f9f36b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27946cb72348dd0cd1ee67d35667675b

SHA1
adb11c1bc18e9e1ab9843221681c54d797d01508

SHA256
3c9121b465d2de713a0073c6ed2b32b2f6834df82ffa1ff940937c860f4e1042

SHA512
af2a0cd9e5f06ae627197b6271e53f47c21c771e6ffd78eace53d9127937c4cee6fd0b15cdec0a950cb499fb337ab5901cc7e17d69f1b6bc75a052d38fe41c7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6653385bd98e8507dddcfbf8ea2523e2

SHA1
161f6b4f6f94fac60bf4bd5ae2440162e6aa6fdf

SHA256
6435398d7276a80a4d1d2e6b1a6af0bc383ab15e534bc803b271d37f249c2c9e

SHA512
2f11e88b817b35ba766d15194f12acf92c314917e694534640930149d2b8194aa039933cbd06e1cd23af1ee154b88217e0c8800ffa8faf3c7f7a2aeff8a3f468

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73c8a6d96e6bd2dcd569c7a5e9194292

SHA1
cf326258729ab4b9646747f41380d4bc8e0ab143

SHA256
af0c9046520f0bfdedfccc6c35bee79f758e994c592c8100e3e0cf20d6d32b42

SHA512
071d8d26e8fd8b4524cfd587b64723a0b52bb155dba4dae0785b5a3b46cbd287685e5b1d32f59b95f21c9ee3d7ac97a151c93813da8cefdb3e95da7d1ee7a780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d19a0db429a30f442bf7763a0032abe6

SHA1
7dd4d5d58a8bef2d068e4879c35f01a7277badb5

SHA256
52204cc4f0e1ff64f634026197039759af6ae14c68401de6b9934e5869c375c6

SHA512
61c9c51c46d88c3de2949bbbcae83ecd284241aa1048373e89f271dcbaebe8ddc4e81cbd390584c596fc140d7308e107a35e2b7c80cbf1c70c326314b00b79bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a046deebfb80787728f3cd0ddba55f2

SHA1
92449d7a10f1574e8f9a34576cfefb9f22ae3f44

SHA256
7cd44922d5d40cd940c03daf608d06d3b0e9dfb71ca0924ee7929984276fab88

SHA512
4be69e462e723f98737f09affe2fbeb39b7996c56f38e058f814fdcd385cb6551280537b69d24c03266de85f360c5e1fa71cfbfb60a9f19403582188fc1fc75c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4bff922044ba610f6c3178c6f10c6361

SHA1
3d6230fc49700a2a46f66faf1daa7e4d8227cccd

SHA256
77fb7c3edaaf0fe829f471a2ef60de67aa046026d067e59e3f70fb4075deac94

SHA512
2ad2cf8a85d6dc25b775c046127fdd484e1b45d9461fca9e72881162e040a6e6789ab748ec04e5403d2d16507188a12578827dc89bd470ea97e5fa9f02661e39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar103B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit