c6c1ca9ec6008c51f36bdf55c2d6a8afb125ff92052f48f33fd64bc47bde1e48

Analysis

max time kernel
149s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63ef654695224481a6bf4d4bd1a71b39_JaffaCakes118.html
Size

27KB
MD5

63ef654695224481a6bf4d4bd1a71b39
SHA1

4990bd2eb163e48754080bcf3e4b678d91a70cb7
SHA256

c6c1ca9ec6008c51f36bdf55c2d6a8afb125ff92052f48f33fd64bc47bde1e48
SHA512

f7c382ba1008bfc75019b03857267bd751bc6aa0d19d559d9ed0330e0a4680cf1965b7a56981e80c1465db6081a9dc1ace07ea45401be6c7750c9ee750acf349
SSDEEP

384:SievNSpiRLAfG9MEFswUs5Ec8jkhu85eVpnrE27JOxoPvu1:SiQ08DsIHcrE2FHPva

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422470203"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D14B2871-178D-11EF-9201-6EAD7206CC74} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2068 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2068 iexplore.exe
2068 iexplore.exe
3064 IEXPLORE.EXE
3064 IEXPLORE.EXE
3064 IEXPLORE.EXE
3064 IEXPLORE.EXE

pid	process
2068	iexplore.exe

pid	process
2068	iexplore.exe
2068	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2068 wrote to memory of 3064	2068	iexplore.exe	IEXPLORE.EXE
PID 2068 wrote to memory of 3064	2068	iexplore.exe	IEXPLORE.EXE
PID 2068 wrote to memory of 3064	2068	iexplore.exe	IEXPLORE.EXE
PID 2068 wrote to memory of 3064	2068	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63ef654695224481a6bf4d4bd1a71b39_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5190ac062fb9b12bb55102ecb22471e4

SHA1
20378109e94e7df8d5c8f5e1048541465a6eaef1

SHA256
f1892f7c5622c12c7001b375bc2ce597b28589f4fa23e8df9991e230a5c85470

SHA512
68c55f34ac068f0ad973911393053c938c53273dbf8e31cdb344dff63eab16f659ae5d73b20b214f8076a4f4dc0ff0100b0c04290bd35ad819c1dc8076323879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2d5746ddcb2f8f640b991160240129f

SHA1
5a561eee7dfd645994fdc9c75403a76f73310d20

SHA256
fa8cfbee5a1a04684440cdd8ab8a37d8ea56a5f10afdd5c4fa575e8b40567d6b

SHA512
c97948d7d62158612bc9800ba30c49dcda6d3154d78c212e26ef86864e63ede7fc4dd7a7d0bbde61e893a44f28cc374a970adb2257e91f5d9b79257e71606588

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7e1ae582fb345813a0f42d32e7c909d

SHA1
3377ef17ad2e3d9e89e97fb3f571084f050e4bca

SHA256
2281bd9b38f958d10d89b07d1539783e632f3826b1527cf874f4c3d42d9a4438

SHA512
21cd505b9649261783eb4379b8ea8231932736ab22ab8346de4df91c00371c37d8c2731085378869bd1ac2e80e34f7ac30e431a12b784af415f3d3856cca9481

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11f6e93aff93f51c7c6a0f24c5ab4517

SHA1
e8e0e4d82244acdbb63d66187327b716c2955055

SHA256
5d6175157586b472c0984ecc361d3f89544344b8e4c944b06a15136ccdf8bd73

SHA512
c3f5ece4b15eb0f090d4be63b8149677548ea006260c31ea19be1ce07a926b58fc64b73ee6bc79b2d9ec2e79a29447a0aade73d2c5ed557d52e5ea0cbb94d4e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e5daee58f5e53b683bc70e7d775e055

SHA1
4703d5e08f655c584fb5b2b41e71e357234b790c

SHA256
546afcc4acaf4350684d8b8a3ff71104b785e3e249262d8d4b9709313ec4b511

SHA512
7e18c4ea1c2e129276c76511eb1787a82e7fbfa27e03dd38c53688c0b5522d0d28cb1fbba2f59a7c52e65c38b8f134e9a6eace580684d129091d5ca67d4b20d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ebfb164e5b946d31907e2c66b9b51f6

SHA1
5eaecb4ec5562501cc2828ae65a4f6328ca9a12c

SHA256
c4b7955df4425dfad141a79cb9305aeb7e4a52bd1027d0ad39e33f7ce277b14b

SHA512
09b8aaa2a17d2213abb734cf62accfd9196d28c9732a7d6f963de232b16d593ff171f0753cb5cd6f94eb6a6c3c63e59e4719d1a7be88b4455ebaf4e45e68ce09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42808e9a76fb1a1bf8365219adfda29a

SHA1
8d02d3830369d81adb276cdfcdfdc5f03279ea1b

SHA256
ed4dcbd3b468a083ae16988feed1bd0b2df52a5f248d56c30d96c495ca558b38

SHA512
01fc6bb8bcbbf7588163478c31a1ba5c613f951ef4bd8b561597255ce241a6abacf76417cfcf98d94e15bfb1aeb924f779faa7c2b7a86d6539b503043773f957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e754c62789609b1339e713fe58cd422

SHA1
9af9095503a804cc6df93c85405f3db9804c690f

SHA256
6d66916288d66b673505861750e627db06b8e4dbe38c5adae06a5de98c908d59

SHA512
c1a5e8790d19aae4a3a47ac43cb17d4ab917cd9f4c5f0071c0e31162d2f40ce43ccf29db53ee5dc5d7d366c1a3431eed07f6d05e327e8e446f4b0ed2859d9da9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b11b8b7404c1aa08e4e5cbdc947886eb

SHA1
748c378b89388da83382fd11955559ba9d7bd901

SHA256
250d13d11946ce8dba777b2bdfb68dbcee9b7388459b0aa0b85ce62649995095

SHA512
974847a52f78ad5217afb256a8d66e821262aa67b0aa92216c6e5655066133fdb1cbedf0934f938b7926a629bbafc7d2ab36f911469c867e4d6276d4c785a2d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab64AC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar667A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit