3701d3a322960fe4d10f019a88c7bf9e11cfe07e4dfc0a6f8a59cd629fc40318

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ec42f44a51dfb0337e03ad693482fab_JaffaCakes118.html
Size

26KB
MD5

6ec42f44a51dfb0337e03ad693482fab
SHA1

9e36da5e1dfd37ab547d02a620c1470dd3b1a3bc
SHA256

3701d3a322960fe4d10f019a88c7bf9e11cfe07e4dfc0a6f8a59cd629fc40318
SHA512

5061403c5afd9d2d1149482db7a352a72466f908891bf4e2193d7684b07db83dee98db137d40cb4dcea55b96687b108fd65cf248a5efdc527579480a5a96137d
SSDEEP

192:R6QoA7pb5nOnQjLntQ/5nQie1n+nQOkrntX8nQTbnKnQT+W9m6CrtgcOQl7MDnFn:EQok5Q/KVLnaycpC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{77AD0C21-19D6-11EF-A585-5A451966104F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422721306"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2572	2296	iexplore.exe	28
PID 2296 wrote to memory of 2572	2296	iexplore.exe	28
PID 2296 wrote to memory of 2572	2296	iexplore.exe	28
PID 2296 wrote to memory of 2572	2296	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6ec42f44a51dfb0337e03ad693482fab_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bcfed8529fc432c929681b3ba102234

SHA1
82cbeb54032af5672bc7e6edde6dc6cd995ccd7b

SHA256
6807a8671657cb766a61112f183263c9599a6ba9d0995400c4946e08e29243ea

SHA512
73cbb72890773f052ca80e00f44702e974324b294a111c06299821ac21b8a483467ad0314e2464de66b6ac5ad5081007f44ccf08b1ced15cb2cc0b12a6cd9ac8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ef56c177cccad71d84ff67b82cbe7a9

SHA1
e9cc5fc4a6396301016ad188560c266c474e3846

SHA256
7519b32db10f3372f83ca9234b685f5f02b45647b8c5d4ea1019e0dd6d2d5afa

SHA512
76f83529f7ebb5806b4c28e2f42916040491e9784a1e98f1b8beea5c38a530e0362969a33a7674bf9397338b9eb1576c4598825b1ac828011184f2a05688f27f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8b8ca6d39a48f87ab3430abf4352fbe

SHA1
25fe00bf2c77c022cdb703a5c488f72d0bca8844

SHA256
0fc9f9c4aa895348cfdc6274c6e4b9e599beb3135854c24b225480ed80d09a59

SHA512
7376132ec12d3d7699481636b20b7cea920c8b17e3e99c0ac68169d2a91b7bc645f71142b406cf72a4b87e50fac7b7dcab6123c2bf61932b04e9c6b0829bf97a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54b9f8375d63792e5cf9bad29ffbed2a

SHA1
1361c0177f0db96ccd5ac9f9a211d8168571f458

SHA256
93ee0ea798f66d5b292974bcfaee8dd52106b4f3210b839bf4b05a3ab74bfc15

SHA512
6ced31e54e3bc41a71f8ec5578de4b9a943412de26c1400e6e2843413112d5156bc5fc497d466fbfe931eddeece49fca73066141cabc8476fab9d16838095a72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3a85672adf6f2dea6326464372ee9b4

SHA1
1a54820c949eea3f208355033f4f8644c609874a

SHA256
5a725af0a64029f18e03a979db0736561236024a8dde1189aa0cf2bb2de67dd7

SHA512
ae7e7e69d7aef3accffc8b36f6a22d1a8a7011e50069c721d34c8dddc9bbed0b20d014e8c21155754aa5ab3c80802cd8828273eeeedfbb0147390313f6ec323f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f167bd046e9ace686f46d80ac679acb

SHA1
592f437a0bd8f8662f3b669ae6f565c435bba583

SHA256
f6f83d0773032e055c7039df98c92b81259fbcf5535ef2f69050cd298ec2e539

SHA512
812dadd8988ac25bb42be76ab4c52df5e33021c9d94ce2163af0910a607d4f0a04c80b0664f46c0d9aebd002e4608e86c8c375dc6fe2b8207696523d267f0aaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f579913de8b1ca0ae4aafc6e2d3ca679

SHA1
ff0134b5605063254694abcd16fd7b4746bdca93

SHA256
563a4114dfe847a737afa22d2a2eb1b160a4535a0989f9bac953dcd585acd7b6

SHA512
329850dd9d1b6afb50f6b4104a0cd0e111a8e2a6ef64e1257d7f6f0cf9158e3f81860a950b3ca57630e7caffc0581d19c18c8cbb22d82cd3678bd6e870c90a2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d99018d9075432ba3fe9bf54ac54c59b

SHA1
6aaf4b369d58285e24fc7362735686124cb8e67b

SHA256
b697ee7b74ca483d30f70e8e8a3cd308d2245754a3ff5977fb0ee2485a3c6486

SHA512
a1fa74166242e6110bb92abfafaf84ae735d5d6db2ab4472d39941ae90f1cd51f0be147f1b770df2c722a67510baa564ff402ce14f3f0041e41bd1ddc2540517

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf148ba26c800a1fb536c481aba74173

SHA1
ad561bebb09c401e63d6075ef54839561419330d

SHA256
214b70af5df6d8a724e007e588d6c28d320e5dd8bf0a6903d54b48217a1f5b65

SHA512
c5effbca372779462a31caa4effbab4cd1b711ff5cd8ba092c78053c16e5d7453e2e726942007d4279905d1c84f83d0f40095b3c1942b9843d3e3c2dec38d37d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabED0.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF23.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit