dfdce2c7d1fea69615746bfd3e23233c155b50af990f35bc02e92e8356998d8b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68d2f0031268d2ee8fec1a8a42950102_JaffaCakes118.html
Size

17KB
MD5

68d2f0031268d2ee8fec1a8a42950102
SHA1

6cf6848600a375d27c806ccd553a6ac3ee04cec8
SHA256

dfdce2c7d1fea69615746bfd3e23233c155b50af990f35bc02e92e8356998d8b
SHA512

972e3cee534edc506344e0f6f6632d67eb8f2885a73bea1066555d37f9431c6b1fbf7d823aebb2401389c18dc2e3d218831cfe670cc0e833882c8de87171ff6e
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIl4nzUnjBhhr82qDB8:SIMd0I5nvHdsvhQxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E720FB61-1888-11EF-B0F7-6EC840ECE01E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422578042"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2972 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2972 iexplore.exe
2972 iexplore.exe
2548 IEXPLORE.EXE
2548 IEXPLORE.EXE
2548 IEXPLORE.EXE
2548 IEXPLORE.EXE

pid	process
2972	iexplore.exe

pid	process
2972	iexplore.exe
2972	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2972 wrote to memory of 2548	2972	iexplore.exe	IEXPLORE.EXE
PID 2972 wrote to memory of 2548	2972	iexplore.exe	IEXPLORE.EXE
PID 2972 wrote to memory of 2548	2972	iexplore.exe	IEXPLORE.EXE
PID 2972 wrote to memory of 2548	2972	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68d2f0031268d2ee8fec1a8a42950102_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
341166ee1763819ccd5d5f867cdd7d30

SHA1
491d9097c7aa9ba110605bc606c2d34d49e1f7cc

SHA256
ea1916e4d946be070af3ead5d8010d34e336c25e333ae4c68c6ebd7ef5f688a9

SHA512
d6f47446a849b3e72b8c890dbbc6e6ccc244402533f8bce6a92f213ca191218c4beb13e5445138e91d5a117a082c360ebd22f2b6467ae3fe1bea9cb595671beb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6185cb64b2a94cbc6d69d4a5ef025897

SHA1
fa0483bdad50691dbc6060138e744e23090dc676

SHA256
e2658b66abdd2c80f5814426c563f13614fb38d07a3f7c9f87db3a888a98a45f

SHA512
57c286cc86f17d96497004d9ae9cb9bd9bc5d97e49337c5e557e9dd0f92b46574969f5d946371c25771f45e4be0c4274f6ed495b6262b180a772c4b55e0a3f38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2971ef7a8f1a318ff49a7adfd85971fa

SHA1
502b9133630435d5d67b322247220d202743a5b3

SHA256
829795c5477bbc237763aa3efb4c4b4ff1e83da1400ac7e94b79cdf0d91e0907

SHA512
9e0670ccb0d03d524339b1f083e37dd2462bdc616bd65bb6e4e23ea5c7121563b33b994982b9aa9caa40101d18b1877e00073887f017c3b47e4e76961995089e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
173aaa7af98de22e851c19559cf153e7

SHA1
327d44859a10abec6565ecad316ad28c2f58442d

SHA256
53d17fb583b0d8b20004a020bf0c7b04ba9d1a3d05eaf828a1604dca20f808b9

SHA512
390d5b720568edf2e60360405a0217d750dbeb537b6e27fd783691e5f119d909421e96c4c9704a16b6a222d8eb850b32182deec72b94a8a537a195fb379da528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4343808a933faaaf9f4acc8c9b66887e

SHA1
6f401f60008c285b474cd720dc3f9b80a71b9e9f

SHA256
900ab7d3374511fef0b45f2213b056e09d52967745c059107e1802549186017e

SHA512
5048cf1a0083d3b835564628f3a4d9645ffb00076ad30b871ad530a94576a12822e9f7f50697818bbb7062e2ba23079eb3439cc0fbae7583f0ed86c521dfc8c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a24d3400355b82c7fa1e19a436fd028

SHA1
431b157e319e1cdeb1c0e37099641ad6ac2428a5

SHA256
7a81e55ae1eb31c2aa06701006a35872a34c1ade322aeb23602a7fa5701968f7

SHA512
195cea71b77d08ba1603c8175b237fe17a648248f28018a0d08fdebee837193935928587efa9d86b12741df3f2912b28718a04fee41861398ba04195712ff558

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ed262f812766889303340d4714b6dae

SHA1
ae49cc27d3bf418894d7bc82957ed25033a83dfb

SHA256
b6be97f984fb2ed7e4f69fbc0afebf5b458584c5ad4d1c2004ef775b0667f1c2

SHA512
a90236ad67ec4642821d2a47662dc8022202a8ff941ff245ed7b6a0aeca05265cc0a3e14c23ff0bfe53484971ad4a88e6acd2d5e3bc6508bbb51a036f6efdb62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
448b1ce1da1288f5cf2157b4737b16e3

SHA1
01812a947578d649beea5efd1e04c5d5f992e842

SHA256
734d69f6c7cf1c8934d914f0d3365cdccb828a03157d2c5e5652d668846ed6fb

SHA512
e27f7c0f22391a815210aacc2fb6c34e0c88af6a8453830c0a7370f10feee1f0d9c4fd776c616294b9a1d921c3b982bd1db9d7ac283298c70f6bdcd8cebfeeb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44a569045741353e9d1147ef1e36bc2a

SHA1
a5279d472e2f097350ec37c42c54c27cbcbe2f42

SHA256
04ae973cd3b49fde51fefed7e14a212143671ac01dce2baad7507e3763917654

SHA512
701f891922fc30b5eab118a8ab47c92dc05d8b2849caa96808594a75793a2520ce664d2cbc2e269f79dc49949cc81c4a2444fee4d0e0fea71dd831bcf1df054e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab12B6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar13C8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit