11cccd783b959a20396d119ccbb5eb2dc9d1c6d3b84af457406cd63affdcac2f

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6592196f3708dc8c44dc9a4ffdb4069e_JaffaCakes118.html
Size

18KB
MD5

6592196f3708dc8c44dc9a4ffdb4069e
SHA1

ac0e6c7048ab9b40645981fc26a7dcf3a885ac7c
SHA256

11cccd783b959a20396d119ccbb5eb2dc9d1c6d3b84af457406cd63affdcac2f
SHA512

4b2a9611256821549267d025147ab19f455db8163a00dad6a43c6a77d0fee335e85a5b3ecb9c88dfc9aaab5d1caa2e63039ecff4069e316f6df7d19f380878fe
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIr4BzUnjBhj182qDB8:SIMd0I5nvHFsvjOxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422504217"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{03EE68B1-17DD-11EF-995F-5A791E92BC44} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2292 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2292 iexplore.exe
2292 iexplore.exe
1376 IEXPLORE.EXE
1376 IEXPLORE.EXE
1376 IEXPLORE.EXE
1376 IEXPLORE.EXE

pid	process
2292	iexplore.exe

pid	process
2292	iexplore.exe
2292	iexplore.exe
1376	IEXPLORE.EXE
1376	IEXPLORE.EXE
1376	IEXPLORE.EXE
1376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2292 wrote to memory of 1376	2292	iexplore.exe	IEXPLORE.EXE
PID 2292 wrote to memory of 1376	2292	iexplore.exe	IEXPLORE.EXE
PID 2292 wrote to memory of 1376	2292	iexplore.exe	IEXPLORE.EXE
PID 2292 wrote to memory of 1376	2292	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6592196f3708dc8c44dc9a4ffdb4069e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0919b290eea6c8a24ef28a0b2c28cfda

SHA1
9e61ad7959f70633f45cb00174903443f19f4330

SHA256
e835b1e4515cb5472426717d1afccd38595321b4dcf52abbc3dca6f24c2b952e

SHA512
cc7c03600d96f8145373a3a885f3c6c7f2d520f8109ea2447f328632932e165daa75d1795b6c6aeb6b590d537c33a315502902bf85e5064254bcd70acc63e8d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f702a7e23d71c3220942eb7513ac49cd

SHA1
0296dfb867b549189c4145600ec24c1b7788bf65

SHA256
56631e20cf84fca1af936eb2c20bf36958dc8a50565f6f64d4264a9cae38f7ab

SHA512
044c37e3a90f17a1fab72d2eaa10f18cda7b6452d3f2a4446c24ec851ede65e78046055ead1e009db9d1d2b73702e30fdff1e184d312efb2c54df8d3dc4f61e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af7b410b840bba217b66c4396ec402df

SHA1
4d5877c902952780a8a3681287f81b91c71474e3

SHA256
5c051112a0e1af4acd914f55d3140b07471b31e0726a316b5baafa8713a991a7

SHA512
fc3beb9c7a0b21bf572676bee2bc337a6690c011d872bdd5213be93d2a03090af3d828f31338a3cb26a54e41cc5404023f5399bdd07c524d5f690eab7eb5120a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d9f8acb591cfaace1560b4f6d699fd3

SHA1
942c27e9bb6a9db3ed9a118b4adc5bb5c18693f5

SHA256
daf31fcb72bedd995e73ad42fd64203bc374c0de3ab89067a17a79ce2c1cc538

SHA512
801dea49998a731b437193c75b87861ba148c601ce2542c1716fd088f5bf15c8f0c6c7b20526af14a96ddf51ad1431bae13b992edad775dadb28d280e8067a39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4bf60116f769e5f08c0b43570980430

SHA1
209901b4189a2c6e2bc3d119b7931cb6b5128bd9

SHA256
7748e909e1baf8b84e24b1b78404bf7b064466211093f8d0b312e6113a192785

SHA512
53fc0d84c6b5a6c5dbc0640e458ff97b317d8ba14ef1cf457ceb7c3c10bae1fd1a5f1be90a6a02c218a55d9b272349dd06d55b281e68b834ff7d20eaf824e2dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f1454c3724ef2f40835de2b1d12ab12

SHA1
790d828a92e646edd791b8115191a059b097f535

SHA256
3b5d29e04a1db89b0ce6d4efc8b7145592ced475d1c7b399c7b7dd8d75c30704

SHA512
1614949476aedd3ecd3be9357a96bc75a659ae376a41a1ae2c4cb2c11e9881ea05718d529c8e0b9bcd5a6591be09d617e74a44c13eb1d6b38afad92291e0a9c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee94c6845010fe9300436972a2b6250a

SHA1
b7ac1cfab835a82ab2b230d6f4e814ab918950a6

SHA256
f11625d0fb0f6a94e6671c51feb2d7cf1757e411de5d9aeaf4ba645bd3046eaf

SHA512
c771c5b41e28fa50eb9221dbf787d445070efaf700db5e953d75931ce621ea57d64b8cd673952e083dce4ee80d4337048b0e935fe90291fb1be328797c1be13d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3812becd6ee8962cce43c1999c07669b

SHA1
e42ae146ccc78ac000a532ef9982efed968ce7eb

SHA256
1afff409a9d127ad9ecee978fbb205c732bd603a465ff1671630664598f699f6

SHA512
056dc5e6ac40f7502241db46e42a6bcebb20f51902a67fd671829bdeda9482769f9edaea4b59a4ad6caa01d1cb9b7a3e7791ff0c88f1f9e9e070789f2af7283d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6712101d09d1047b3e02b15fbc0d02f2

SHA1
fcf2c73d4501757d798e9310a037a7c0ed9fa466

SHA256
b5d0fdbd3687bd5ae64421220bae2ce20dbb542e39969d9cfc0281e5c8482465

SHA512
72afda6d70414abff67431eb2cde69bb5c879fc271ad74fb13adb70693554decea410404034d04f5ceb9bff1e052a836835c770626ef41c0472b5789c4754150

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab172B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar180C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit