39ff43a89e1f1c8fbf98ec9369e2bbfd036c0e45848f4834ee97cedc2495e7d1

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bd8f1c1cb6ccd6251a634d85d609d23_JaffaCakes118.html
Size

23KB
MD5

6bd8f1c1cb6ccd6251a634d85d609d23
SHA1

e94b88f24fb0434b6830eccb0f9be59ab0b7c1e9
SHA256

39ff43a89e1f1c8fbf98ec9369e2bbfd036c0e45848f4834ee97cedc2495e7d1
SHA512

80e98554ce7435e2fc7a336d3e290a1ba8b6c625aef548f1d3d9828d64ca28f86f756c1a0579b63947054c04816fc17024768051acfa19027dfb43289cf6d181
SSDEEP

192:uW3gb5n33unQjxn5Q/GnQieNNnTnQOkEnt2MnQTbnJnQ/CnQthwMBtqnYnQ7tngo:EfQ/Vvo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F038571-1931-11EF-B195-DEECE6B0C1A4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422650344"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1832 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1832 iexplore.exe
1832 iexplore.exe
1964 IEXPLORE.EXE
1964 IEXPLORE.EXE
1964 IEXPLORE.EXE
1964 IEXPLORE.EXE

pid	process
1832	iexplore.exe

pid	process
1832	iexplore.exe
1832	iexplore.exe
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1832 wrote to memory of 1964	1832	iexplore.exe	IEXPLORE.EXE
PID 1832 wrote to memory of 1964	1832	iexplore.exe	IEXPLORE.EXE
PID 1832 wrote to memory of 1964	1832	iexplore.exe	IEXPLORE.EXE
PID 1832 wrote to memory of 1964	1832	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6bd8f1c1cb6ccd6251a634d85d609d23_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1832 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1964

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
450887993725333c6121c3a84a66547b

SHA1
f18fb76a72e3383b26c30275e4ffcb99f314d7fe

SHA256
f1b9a9cbdecb19c2fdbd6bef4fef4f1b4912284d1bb8a4ef7377e292094e9df8

SHA512
ad741988d5f7845abf62b11fc08747fac0ff1f1f9559881ff0aa5fe7a7ba1f81c7ff0c486bc5c8e42e2623de9910f69b9bc8aa149067bc625c70954fdcf1c657

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
fb09dc23b54ae3c22f6b83fa088984ea

SHA1
50c2afa26deb86b5a4184a404558ed564f58927d

SHA256
be98fdf6346ac19f3ceb05b7710d469ce5ac7dc43e8d6cb37e866857e32141a1

SHA512
061e6889e6615bc6c20409866ad8f4ac89316d8c4ac64edfaac5a827dfe28ee884512e75a65c0d704465c90b4b8be287b2a5a5bb14a34085ad3e574b1576c249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
40709cc905d4fd5a4e461b26d15be2bd

SHA1
be01e7e438db122aa45078123f9b96bcf1274244

SHA256
19473fb4ae70a22eff18f32e4f01af9f747e2a24c8b656984096da5cb79da075

SHA512
696e87efd37bb12030fc6cd2d48a1195a6b45dbb6d1d0207f002a62ebb835a47514d6e527fb9388c6672b7bfb1529a4b8cc748eafe1aff8abee7331b0dcb72c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
13de9e74b4b830db3db4c49ab779ff27

SHA1
93ccc9f6bbd55f54d6c170cda9f07c091aa14d86

SHA256
3fdb58bd014b58b806e5f839a8a9b3baaaf2b3c7b2e363f2791c328fc366e1ea

SHA512
e179c113e079ffd81ae3bb397abc75a16b1e9ba88f399dd2266c114279c5ea2315aaf7deecaa8f839e98c8a13bec3d0ffc6111c9f83cb067e4eaf0f3a86cd604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cd7e89ddfff9a15a33a56db762bd828d

SHA1
ffa0f447dd6dd7ebd94a2cdae192682962cf6802

SHA256
f7875734c1eb9ec883a714b0144e22a979f0ec240778ab570b2b3c6b5c168030

SHA512
e321fdf80ce4c0838389e793269a908991fa0d1d0e0bbf1a168a990981452066b7daf3d5c8f162fc2c7d44623f623286e4416a17c9bbfd2b21b42c4ccb654224

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bb145305684004150f9110c011e5aa70

SHA1
90a06b4cb8a63784ecacca08205be843447040d1

SHA256
e9c3e1e8cb34dfc5ad5742c59b180ced4552b53013a25dce05ba8308d6d943be

SHA512
5d19c13dbd759c872b39521e91312205a6d55793779fa9d47a17f34a61bff82d4df2fe05bf4360b77fa64c3031ad818b69758923450f4e9ca0ba8878ffe3e48d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
92c18730fe1602216ea105b0e4d66187

SHA1
e62db21d546b134326ceee74cc15830cfb4d73c7

SHA256
866d360522392effc900419e009d6ef932e4c496adfaae7827de62f4353528da

SHA512
303482fdbec71de74d34cd1ecf75230bd991fb42bc43759742bb670ac699126f7d0b3266f043221f179c25def583802560b43db9e10eadffa20cd65eb44e60c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
eb63facef8e44fc677f32cdd3dec489e

SHA1
8907898e42bb442548b85d43a9471531761ca827

SHA256
9659765c6b0e54c4e85a36b06dfa76c89510d00439dfdf8160e6fae72014db86

SHA512
cdd95601e842a4b73ab77a0b2742490f377fa4769fb1a23e926a0da3286f0dad85ed9ee0ef755704db9ab3dd41c6b73f26bc518c2f186e967e9270910b044258

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
10350cb24da57d7b73e41131f47c1bd4

SHA1
56c9d598241782902190fe2fc8213c6174183a87

SHA256
29822ad292087f52c0901b5a919bcd700a0501a59dcb81ac0e9f2f20cb0e8faa

SHA512
df5145aca3d5716c0e976ce89107bacd3684802e578f8acf9644429a9b84f1ba333aaa36550175afb22ae3431c9f8fb82d668804d819fe0741bb13fb9adea44d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22BF.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2300.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit