1f486846eb465f79ab67db95735a72a0eabff39daefe5d65efa30b49540fada0

Analysis

max time kernel
136s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63a2533e8f87f64a3c63f15f3a46f15c_JaffaCakes118.html
Size

2KB
MD5

63a2533e8f87f64a3c63f15f3a46f15c
SHA1

31ece8a7912fd2b48e3a79e0b9b1d7bf9c1bbd58
SHA256

1f486846eb465f79ab67db95735a72a0eabff39daefe5d65efa30b49540fada0
SHA512

c98da490a03c1aa87d0b445f8b0be73b218240cf75d7c0d7d967c47b5db3d80551f3647fb3479a78542708687786ea16ab646fe4b0adc28c3da098dfbd11e5df

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31A44F81-177F-11EF-A4F7-5A451966104F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422463920"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2244 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2244 iexplore.exe
2244 iexplore.exe
2836 IEXPLORE.EXE
2836 IEXPLORE.EXE
2836 IEXPLORE.EXE
2836 IEXPLORE.EXE

pid	process
2244	iexplore.exe

pid	process
2244	iexplore.exe
2244	iexplore.exe
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2244 wrote to memory of 2836	2244	iexplore.exe	IEXPLORE.EXE
PID 2244 wrote to memory of 2836	2244	iexplore.exe	IEXPLORE.EXE
PID 2244 wrote to memory of 2836	2244	iexplore.exe	IEXPLORE.EXE
PID 2244 wrote to memory of 2836	2244	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63a2533e8f87f64a3c63f15f3a46f15c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78b761b90749fb8145d35d919f11e61b

SHA1
23a3901754632da769fb253d1e7814e184ace149

SHA256
4bc25e688d603904af3931722a169c6e1b151378314aaa1b712d339f2bcff3ab

SHA512
87e0d0bfa21b6059a18d4c7a9abd9958636ef89976fe655eb9927481ea34a297e1ec6900bcf2020f79ec92cd3b42e746676fa43e0bc96bbc7561b3513945a95f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cdc52f8235184dd1d6d3c8e3b527719

SHA1
e607c2c21a8496195354b686a306730410b827a8

SHA256
d7a4fa9e5d2a3eafff90302f140ef6d4fcea5583bf82fb58c0c7ff3cbfbb4741

SHA512
5d00456aab80705f89defc54665f7caafa1cbf7dbcaa2cc92bda422dfce4dfbdd7ad250f2e254cf4810ae940262a40ff6d525b7497e061af4928d7575eb9fcb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68ffa5664b0c5d68f7e984932a44b74a

SHA1
c1551d02b0c88e8060957cb8b813d3eb02d45eda

SHA256
db2a20c046d075b636be8f37a83a10ba581cdc23fbf5c740bab48b29dda18720

SHA512
58535c42eb4f13d7b6e6ae283eb2cc8cdad1d1dd1ec78261ba7826c299314c51279a717cd2eed84e7d98fa220c6d144f21668be01ebe56a1d526f5ba92b57fda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dd80a2b6bd2962f98dcd709b9986dc4

SHA1
919bc1c62c31e899091e52acfd136ba1dcc68a8f

SHA256
2138d0d158164e307ed042b4a679d5784d7c2c73ca9f29a6cada7dc05e0d7e94

SHA512
31206475d230e1ffda65f36182b436d2a35ae35ada5555f0d3a71fd3b16b74aa394e8e25d1ba8e6d1e4e9927c4afb8a86b90e781d7004cf18af9d1af3daaffe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2acd4dabfaacf2e9ea12e923adecbbae

SHA1
a902bb361886c62389400c6ea25c1b48e6f7525c

SHA256
b927295f24fbff7b7a5eed9a450a11c820f728ebb67d31b7f453b15de5289e4c

SHA512
dbdf185a8bfa21da34651181f40d4146bbc61c91d8963ecb7f53245387dc0973760b5683f6ca9b3384198dfcc6b00be48ea9bd71262b9e844f3ec30c632c1ed2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f111757913f86f1983a6f8430a733e16

SHA1
93c8c2e642478e8dba288e064620ec53812c65c7

SHA256
2441d57dc4a5cd7660c03664abea9b8796f02168e4a2bf2c812e68425dfc136e

SHA512
be14a2cb5b62c5b8f47fe9a9eed724584e791234f0a70454beb70cb98e0668c207d4a566bd3136ff82368ae78a62db832a48781f58604db4a7ecc0e60e28c49c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c085045598bf9cade86e7b56d26a861

SHA1
71fe27a7844ec556462b7715ee7d3fcaf01b8a97

SHA256
a242e343369602630acc18401c7c41bda26a5e4edfdcc2a6df1107e34ede64f5

SHA512
a9aa1ff9e852d6f09d3cee9e8d302ffad252b2fda07aa8e4b4eed752cd27f3bd7a6806c2cf43d0e61f108d10ebd458772e2d8b06f60e585c5cfb01cb1686d875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63f58d162b021e902753972686d7e9be

SHA1
ef006fbc3a107c391998ed8a8a8bbe7d104933dd

SHA256
1fe1081fdbf16d5661ec91d58c4790cfeb4e42c1ce19ae2a25ae69ae610b93d8

SHA512
25601c60151cabe73e36802e4e1cb1f03c1cb0c4d2940fb0968a72afc172afb3fe981469c41836532ad5bd6719a062458fe7c271e50e72c7c8054a62e03c345c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
878e9e5a6c1ec0d9c1147db5c167f4ba

SHA1
a078fb8ae077da8a55e07b066856142690fff187

SHA256
c027eaf0e00ffe6b20142f8d19a489e9d8219af033b8f51075f48f03d56fae4a

SHA512
24fbf7765822e7beeee51ab3ed99fe51702608d1ae9672b27d8e585de5de72829fec1e96b7ebed0a3d75fac1301fcef66d36a8ca306af8be88d0a8a5e19d7234

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D33.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D84.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit