8e6c9f4eefbc1e1d683eb4a534edda820c671e7914740fb4d5c2d55a301df352

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69756078c670646288d7b334131974e2_JaffaCakes118.html
Size

21KB
MD5

69756078c670646288d7b334131974e2
SHA1

120b3d50c6270f4681265d506337e8771b651f12
SHA256

8e6c9f4eefbc1e1d683eb4a534edda820c671e7914740fb4d5c2d55a301df352
SHA512

18485376a057c6de65ac535eea7506c8757ee16f3c9a144b1d8883541192069a11953eaaaf67228080a25a46d0b75f282981c4cbb52023efb6817aa54c2b55ee
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIg4yzUnjBhm482qDB8:SIMd0I5nO9HXsvmLxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1980E01-18AC-11EF-BDA8-6EB0E89E4FD1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422593440"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2932 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2932 iexplore.exe
2932 iexplore.exe
2980 IEXPLORE.EXE
2980 IEXPLORE.EXE
2980 IEXPLORE.EXE
2980 IEXPLORE.EXE

pid	process
2932	iexplore.exe

pid	process
2932	iexplore.exe
2932	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2932 wrote to memory of 2980	2932	iexplore.exe	IEXPLORE.EXE
PID 2932 wrote to memory of 2980	2932	iexplore.exe	IEXPLORE.EXE
PID 2932 wrote to memory of 2980	2932	iexplore.exe	IEXPLORE.EXE
PID 2932 wrote to memory of 2980	2932	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69756078c670646288d7b334131974e2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2980

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3e83c0344f850702955b49ecf74f66cd

SHA1
dffec93c65c624934c9b00480e4ba0e740b2993a

SHA256
ca3abe7d4fdf152269c0a13253703a60f3dd08391a024bcda0c7ade6d679f33e

SHA512
1c60c91948fc746c7035e8b8e60c13588f9a65a5bf0d78fd68699379c2408e0fb59481539ca788eb357c3771da82a4610792f393f6517dd1c67d13f34f700022

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1bc998a8c1660d42dc1a4dcf19f93b80

SHA1
bdf04e7d9c8bd8cb2aab30c86662f9243719b4d6

SHA256
8c80bb78516c843f7bd8fc9ead35f736931f17be3586b5f7c58a5d6e4960caf9

SHA512
3c30d618c60f4022a87e450bcd45a10d0d66ca24b4bbb045de4edaf03245e0913cc37c1cdfffa91398be65dfa4486b17407177a7ba2d84eff7c632b6b47b8770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
99489d24ff43c319c30b144a86130b12

SHA1
b3c2726c1537f5634e19d871636ffc63fc796b03

SHA256
d8ecf5e7dc131770affbef454d50d434554324afb085e61ae615663dd246c42f

SHA512
1f6b6b1efeab799e23c9a6ba9561d55b55b5e66cae5010b8ea81793be82a7a40e80aa778fda8e39a0ffb9f55ba9c101d40232927c2afa798eb8a4ec7117baf34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
10cc7ea814198e9b80158ced23548431

SHA1
a3ec495b7f5fcb152ada6eef42d25d454bd3f4b3

SHA256
ddc81dd06d22ac1c988a462546d453e0b17214cdbb2eb8c6c72aca6c588c6b90

SHA512
e79e0965334d4a7683559dd34b423bc13adca251e0fb1076aaaac2bd75da54552e416c45f8224b854d989dac037916538a702cde61eb24e48166f88ad3be1243

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
89c1e12a48ac1f9500f5cdccfb17827c

SHA1
051df75003eb6a2ba876021be1a5ae60db25cffd

SHA256
3134b4fcee00ee9d223ecf50f67aa75cf4325f8986a36ada7e9832657e16bced

SHA512
1e8b798f3c91160a47a5b1e33a7c13c196870c812573c1ba25adf3c596d0547bbc0b7edd5d7ff2cffe0c4ae6d88e40ce905a40c2714f2f7b297c494c5b0e8d00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
314e287988f81e53dada6df2229a8670

SHA1
2393a824faa126dd6a19b462c9d636f6e16d173d

SHA256
c943e64af184b187e91700f18ecfa5e33ce579a9ee7a9ef022735a865229208c

SHA512
1b12c0ad4392367a09c131dfa1c26cb77c3daeed1c8fd4b24c13236e9c56c0856e3e5176259a058f5ae9a7d288065a56650e65e45535bed95260603dd2b54a73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0e24b320988ee89505c0644e8d098255

SHA1
3c8ae1fd733ca482589977b556d65de7e863a92b

SHA256
e8109ae8c57f309e010bcb8d2c8e56f83376f1874e3a340e2576d672aa8773a9

SHA512
a3d089b9d2bd6bc91af2c95117d3922290ebf26ed1020534e0a119f2fb9d8701b96a4fabeb1cab4c4060daeb172498c61803dd0fbc6419854d9e90a27c082eaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
23bace09fc6f912ced90862d6c94fdd9

SHA1
85274d68e8e190a952c339353c5ba50029cd772d

SHA256
77cb276660e9660ac4c7fa966dcdf9b3e592c58c660f52a243c5a7c82b4d4c66

SHA512
6e418c1eaa35cc3818dc2a8d1b9c43e847c1a69a53282b21d2d2b41647db7bfa43ae9c3705e75f0c18449b79003236fddfa60d6ef4c8eb103273a2f0eceee918

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
21b0c430c1e2b239109ecdac756d5e5a

SHA1
2490ae47d778719aa379a3c4d1ec6b09e7ada94a

SHA256
82920324d87e6c2f9074e9a024e4d53e4d811b9fd5d0132ef8a8a9d8be23122f

SHA512
44f0fa7430f9d8f881fefd2ac2360cb4a71486bf91efe367feb09968add8547d65428c006314b7295763d7de8af088282c3c6f6a5bab93e7c8e86d1c56cde1e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab195C.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19CD.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit