c1c810ddfff5b5ce89ae83f7f287257a8d1fb977de99714f6dc23fd1d84a54d8

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

757778f67049e0e9daaf3ecfbd98589b_JaffaCakes118.html
Size

25KB
MD5

757778f67049e0e9daaf3ecfbd98589b
SHA1

7e56b38e2633a732a090ea98f74bb09e6459b82d
SHA256

c1c810ddfff5b5ce89ae83f7f287257a8d1fb977de99714f6dc23fd1d84a54d8
SHA512

db021204b02b5d9766e3b73c80d5e7f7fb4d130cb1175df894b4bb49c6c41b27f00fccc71ed36ab84bc3d4f43e8ee2f5a1dea1ecf5083b1fd8b9142a0e8c458c
SSDEEP

192:uWPY6b5nhmnQjxn5Q/tOnQiezNnmnQOkEntn4OnQTbnRnQSYqCPA2pdE+4cwqHXE:9Q/o7P3OF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A74F631-1B64-11EF-91CF-DEECE6B0C1A4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422892144"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2412	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2412	iexplore.exe
2412	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2004	2412	iexplore.exe	28
PID 2412 wrote to memory of 2004	2412	iexplore.exe	28
PID 2412 wrote to memory of 2004	2412	iexplore.exe	28
PID 2412 wrote to memory of 2004	2412	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\757778f67049e0e9daaf3ecfbd98589b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2412 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86f7c7af38ecac5d3ee87dea2400fea1

SHA1
657930e0f0dadf19036ce8cc6a088459055e918d

SHA256
8b0336e64e17f1d8f8c53cdfc306cf208a76d34a1d15500832a07bb4684f43c8

SHA512
7d730212b10a8a8a06ed51156af32244fba00a1df408bfe26bf9dbb1f1ea17fea9aa628a5ea1d71022eba045d13ac3b82c2cf7884251241f494a6ebd346f5c73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4b4f65b245337a0221f58b792a095aa

SHA1
b5b3ffc2b4ed0c195b17ba3a057272579989d5d0

SHA256
de9659c07bf5014a30d6e58a4ca987b1e4d419e0d6a387a6c686909076599849

SHA512
ae6cd007d36e86079e00faccd397dd0c995ba96b2217dfba21707295abcc0b419bf363646a0e895df99e2596ec8a46d92d54a5518482aa971c0887cd77e0e842

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70d9c9baea2ee69aab87f5d60a8713c0

SHA1
9b210292f77f69e24554221744ef11c381217ac0

SHA256
c57bda9ed17469ffacb92eb17a974dba299279f49cea1045f1d94964a588c0b8

SHA512
abbaaa924e1372a24b6e8d2d4205d966423a2cbf33948ab55442c45ac6fd86c643d83fd819def15eda165acb8a8f25e39e4f34fb4722c9528feadee76f7990a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ba8cb8ac931ad35c9ed0918fffafebd

SHA1
975a51695e607f4759d23e058bb79ba77bb00de4

SHA256
0867be1be91643703fe8c269d200862391221a7cc37a4f65a0cd351e0d100e42

SHA512
3089b155feb234c8ccaeb58109e9f3802ff65ab5a3cae55737fa475b715b79467ff6e675d0387ab253624c2505e4ab4f4101ffac3afa5e19d656a274d3f79ffd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac17c23e101d75045130be07fd3d387b

SHA1
90ddd8e422f44f63fcd066dd0681d4c016c7d89d

SHA256
410fc0bc9d52acf42a2a6db53b8ced66151b79356f4e98d7bb039cfc8ed8fc5b

SHA512
9747c6368a7626c4989d863f2f50b0b81863b5769dd701e7bbad818788f3e69156a1a2d8fa7f59af7ecfc9dc9c48a322575fd249efdb14cb4cf128b1f8b9ef93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47da42ad64bef1afa9e7284fb40ab243

SHA1
81cb138376ae6e1aa962337f792cdfd14ddc737a

SHA256
64caeadb59ae1153240c707dfc3ba5d35895184eae707755f6797a98d7a6b791

SHA512
77d726de03c3c7e58c362defd12769ffba5b5eeb38e88b46c1f6084605e549a2a03980e317f71d2c1fc8ca8deea93e16cb0ee42159f535847d916025c39230d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d4e946d6ad8e5f99da03b2c6c0baee1

SHA1
914d477c854a4d07166b9ea8e0edd5705653c044

SHA256
93d5064f423ac94388364b29762ecbdcc061e8b17d0b24ed973ba0f6d6771219

SHA512
0555622d96c9b26cfcc1ac453316de11321a42f48a0fdd91051704f49ddb760954c4ba936c45bb13cdf2c21c079ed7ff7cd3f0cf5b4d3e7e61d016ca4e918928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9983de6d1fd3f77c4096f129eb1b6791

SHA1
f61e2a2345c6da0a849111cbe6df6a2436445a11

SHA256
28a1ab158ff4cfcb5c5d04cbe9572007678b6a4169d71b305672272d363a2efd

SHA512
5757bf72206e8435614675ee6def4fa065f586b209b9647d91bb6c02c432b535f441eb7447baf88ccba48b032fae163e468aa81a32eb652632854dbe5e62a80e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1dc2e8b5f5814f0e13587ce563b557b

SHA1
9a2de7f36d72ac42bdeec42148f18ea85eacdb9f

SHA256
f2b1c7ba2f1a2b8802b74574c948f241abad9a31b0bec0f3e844cd526e2a3241

SHA512
0f422c831518a14b8434b4ba89bcd7b8220558683bc9f6426acd3c9973971c516ff94ceb10f2dc97ff4f7f4138c4656df1007e14ff4fb3ddb4ed5fb732e8c2cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1555.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar15E6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit