6f722dc5a4971a1627b93138b050ea614d54524530b1dd6264db507ebae3a981

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

638cef92330b9cc2a14378e6be979971_JaffaCakes118.html
Size

18KB
MD5

638cef92330b9cc2a14378e6be979971
SHA1

3a682a7089693333c35ccfacf00c68db27ad5c49
SHA256

6f722dc5a4971a1627b93138b050ea614d54524530b1dd6264db507ebae3a981
SHA512

55685cbe1c8ae2a2cdd2304cee2ec8dd12cd48a5bd7d88cdf8f01ef16b84469cc18dc0fa89e16f9d4a02b0543281a87472071ef774a6c571898101f0e1fd860e
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIc4WzUnjBh6882qDB8:SIMd0I5nO9HHsv6PxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422462152"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12A7E501-177B-11EF-8AAC-6EAD7206CC74} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2848 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2848 iexplore.exe
2848 iexplore.exe
2520 IEXPLORE.EXE
2520 IEXPLORE.EXE
2520 IEXPLORE.EXE
2520 IEXPLORE.EXE

pid	process
2848	iexplore.exe

pid	process
2848	iexplore.exe
2848	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2848 wrote to memory of 2520	2848	iexplore.exe	IEXPLORE.EXE
PID 2848 wrote to memory of 2520	2848	iexplore.exe	IEXPLORE.EXE
PID 2848 wrote to memory of 2520	2848	iexplore.exe	IEXPLORE.EXE
PID 2848 wrote to memory of 2520	2848	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\638cef92330b9cc2a14378e6be979971_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dec24a8e651bcec7d2d54d814cf845b0

SHA1
5dfafc13ceff63a157f13582b3bd017aeaceeca9

SHA256
e779319eba946f070ead30f49dac8c6d8daa9faeb9fc0493a3044bf17b095131

SHA512
d46a1d0f71b7da6ffcf4405186c65942825476fc41a18e7a058ad8f1aebb06c7e6225b464129b2d029daaf6823c673cded21bd1b9b1bbb5ba6f5a3e84762b8b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0030de1c7b66619942c9a0e4db47b06

SHA1
c305d6fb8e6fd9d9ea4e76f0e0591175e208e7e1

SHA256
63e7f6c1e458c578710757ab76fda88235227dff8b8278e029519cf92596c68d

SHA512
a842a61960fba5582bd7e88db9504587063c6335c59990c823687d45b1e160a1d857e855cedbfc010b0eefeb3ae598b2987806e38ee2921efc4b9fd045a68c05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58874927ebe8919b10959bd067d4c86d

SHA1
0e7f334dae7d1c21bf2d11a19e8c123cc30b59c9

SHA256
7a1e637064e308cde1dcdfdd93f95a6a94f3dd2784defc41bb6f8caf76ff8f00

SHA512
a1417a13ec47ad34462b4958b0a661eb59a5cf06de33b9836db998dd186f34abdb478d7f007821c92e32a13a72bfd319e5664fc0855d9ebb56193ed9c08d721e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9069600c6ac3f275e7f8f46576ef5315

SHA1
206c85debab358268843f4066549ad82fe2beb34

SHA256
680f0fe0ca1cf485670e90a9f5b6f0c69eb146c8f9234aae993e0f60b9d85f04

SHA512
55c320160b9835e2a59fc2ce8549879456aef9850d051cca533e17086783113af6dd4aa2c99282dab3c446040eba0ff8bc878c45315da2c52cfd8be5b5f2c775

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e06c144a7273f7b3a81283bc5c073860

SHA1
c6319e5ba051291daa6e491ecf2cf59cc95a784a

SHA256
fab6872b85f4ac28766bdd6529e6c58dbb2073d0283347dc6c6da6622b75577b

SHA512
e14aeb49cd35af6bb59abd78fd3728c19d4729e3e9e3a3a1271bd10758490ee088addf184d17e27e37631475ab81e24b39d2bfee39f3212e3a753ca3e5581dfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc856d0a97e4c6dd79ebefdbc257e19c

SHA1
b9036c6b9e7bc85b98baa99ca0900b7dbe16bb7a

SHA256
fb13ae97daad7803fb8ff38cc9db3769262414969085207b3c1417b9b78a0a76

SHA512
543e3c40bb68572ad875fad3510904307212c452a365c46ac120b6e1aafc146536c8911b98d204387f97be780de5fcaa50dd60c97de900e4218389a1a751516a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56c5ec9093a8129f85c1f1e3ea736626

SHA1
64ff2434bd27379b2f0cae42e372b40da3792459

SHA256
959e238b284eb3f16d9b3e9882fd5cfd46512a7b01970b8a4125e120e6ffe00a

SHA512
776c298e3a5b2b978acd728798612536a4b322b5bdddb8d84e539259262c03fddcc6bc8520d92433295a65fe2220781cb512dbf4904e50ba51efee79f1d58d2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b6bb14d3fc341293eab525d66df6013

SHA1
71f77766d4c67a276cc07c78c931450c3bcb1206

SHA256
74a5a0b925487808e5249864d932862cd2939f7b6f111a74d27115a4b981585e

SHA512
971becd7d4bf30e8800ad42d88cd8a11083e9e56a2a33a2e6936ca0ac8cb4645ac05b75c2b910f09b8f925d9af1c2c1d397192556a60ac353ac8bf08d1257900

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B2E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1C50.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit