9e126565e2165e509be2fe724e59df4c4d017cf00135a5f492c8cfcbb1fccc30

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687cb84ce48cd6c787286d2d1102706a_JaffaCakes118.html
Size

462KB
MD5

687cb84ce48cd6c787286d2d1102706a
SHA1

dbc56cc400b2d0ae3a1e5a8cf4d84fde398f2adb
SHA256

9e126565e2165e509be2fe724e59df4c4d017cf00135a5f492c8cfcbb1fccc30
SHA512

fd585b529944e28bb8343b758406f4667135540404f097c652a3d7d4610be633cc690830d050f60683b243122dfe885a894b2da667d76f7ec3851476b324af57
SSDEEP

6144:SbsMYod+X3oI+YsagLbsMYod+X3oI+YOsMYod+X3oI+YLsMYod+X3oI+YQ:A5d+X3g5d+X3i5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000037863e8d59327f4cb6c7453061b5fc61000000000200000000001066000000010000200000005df12928edb260b469a8543bb4d6cba696714deb911be0b755f646a8bec4922b000000000e80000000020000200000000995e525504fb2222011c21199ccf4fcba67426b55eee6226e1c98e5ec4127bb90000000436831c73d6e048603abfd379d621628a6fd6b4a44a13de0244d3b3cc2edc2c0ecfe25664530fdd73f71ea0bbcc700a6988b4fa61cdaa3592ef4196d46eaf6e639b804bcadbdf168857d2607ab128ec3038ec88e7cb2837ea84733671cdffc5172cf17cbb25f6840b1ba25e45812a5baa7f3ce17a13a7cfe747a5e03f20b7de2440a4d6f64b8f8e20a569049138056a4400000009b5a7496dac34f8879b09d94498bfa123728db468f181724a3a262ea5c7eeaf2ea3f13b4651350bd1b3868487865d0bde8d76ae2531d3c52aeced7a6a5b3f8f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a0850d85acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422570874"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34D03851-1878-11EF-BEEC-D20227E6D795} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000037863e8d59327f4cb6c7453061b5fc6100000000020000000000106600000001000020000000de2a160d212e283b86613246df655527fda32acd4169644d7395eccec62a81fa000000000e80000000020000200000008533a34d64bd7583cf1ee61b9576cc297f4b72215f6b79e2d72d1a8cd6163ce720000000f893f6923c45c05276adb6a5f087e9c1ca3029338b19ff10840737ef5aec93c5400000004ee7bbe5c542df93e310571f8d9952c5e7857c4bc40db2b28cee7d97a73f608d6a76f8b7a1cec32e5033fccdf2a646dc5801ba84699aa734b3988166aa4f9539	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2476 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2476 iexplore.exe
2476 iexplore.exe
3012 IEXPLORE.EXE
3012 IEXPLORE.EXE
3012 IEXPLORE.EXE
3012 IEXPLORE.EXE

pid	process
2476	iexplore.exe

pid	process
2476	iexplore.exe
2476	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2476 wrote to memory of 3012	2476	iexplore.exe	IEXPLORE.EXE
PID 2476 wrote to memory of 3012	2476	iexplore.exe	IEXPLORE.EXE
PID 2476 wrote to memory of 3012	2476	iexplore.exe	IEXPLORE.EXE
PID 2476 wrote to memory of 3012	2476	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\687cb84ce48cd6c787286d2d1102706a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
883f228b24c7d229d41fd8e3eef975a8

SHA1
744c8b88477205e7c7364f06434a47ed99cdb326

SHA256
d5c09e551b94bc1046fefad317c11e685b374bd7a1407955df6cbd35e30a24d9

SHA512
a657b482b8e5e7fbb6943d67a1388da2c4a2c4e5f80d9e94d0ee74b5f4729cc4019a3d3d0ceccdf8788c1744318e860ab7952d8fc5e1adcabbead633c0937063

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdeb1afbdef6f7b394535eadde62863f

SHA1
59e97caa947612a2f2176b1a0c89eb9f5c421a1a

SHA256
6e8003e151566d63bb4d1955d1fdefba344676a673aeb38b836f2e7ecf165d4a

SHA512
6e7023192dcb2ad16bc75e3ac9c35b285ef913db2ff3226c522eb25ba250a5933a0e6fd6c036e0f7a349d37d0cab985f46a4f7c1e40b1624b1cadc7ecc73f2e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c07eeb6b7bab28e3749af14397e79f2

SHA1
74d9d4e26663021e6587710abf3b4e6ec7545b6e

SHA256
ce0fe39cd2c316aec4f11b92e1b82896fee44fedcfaed17b9c0be92ed09a3e55

SHA512
1ce530b0c9338bfbea9e79dc3e0bc48eba6103057b102a9ef0dd5d80f9aa136185bf92445323020e6280b8a0aebb57cadea1e9002f7e12dae40ff14fb96cc2a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38b774240da3051ff330f356d0a11516

SHA1
00f5a9722a482311d69be96a7ed59b81cc88da98

SHA256
12974a170fb0f71f1f2ca32a9b39fd6277982d5b635c7f06b6677b00cb8bf964

SHA512
0d3e935c62f534ca000d6c57d45b070892bc325ec9b56afb6ebb71117170e46c6ef8e44d1762f042ca9e3b401aa9ee9014a9609a08c1fdfd597f22cd743b1eda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d6fd3ecf67aedaced511c7a1d1ba820

SHA1
8ffd48e24c0769cc63b6722af53d0eb17641ba6d

SHA256
1c33345d9170cf0c66f25ea4885b867f91327f536668b7aabcc255add97d3632

SHA512
5de0959d13e392d8c514a1377b362585afbaf024228d8f79882c95b35a58bef038bed95f9c85b5b39ca556bbf513473f922e65518cae8b075f0e154e817f4c9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc3d665723fb0414e5ff4d512d2eb123

SHA1
c65b727715fb61938f3dac7a626d27bf0d67ece6

SHA256
db447a8ab38ec5a7b4556a6c2c9a712e2b9ff075bcba087a624d849097fbe8b6

SHA512
6641113862844dbb7d343254b2d4deaf79a96d0bc1336f1eb4e44e898e299882a3e9be4fe673188d48702ffb9863817d3e713a83694e0dd82868842e37309989

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab47CD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar494A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit