c3e3ce9f73fe12eba8d76033ed1152d9a949ac1dd9a8c8b8289fa61681a5ed00

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 18:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7dfc6681a51a0cf0c8034279aa5fa0b8_JaffaCakes118.html
Size

31KB
MD5

7dfc6681a51a0cf0c8034279aa5fa0b8
SHA1

05b62f2f90da5aae12b1935c632d607d59522af4
SHA256

c3e3ce9f73fe12eba8d76033ed1152d9a949ac1dd9a8c8b8289fa61681a5ed00
SHA512

80d20954a84ef3e72372d1458f23d67c294f549beb8f254a943827ae09318f61f04b390194046b588c1beb0bcca28b80638a9b23a666041ec48487da0cd66cc3
SSDEEP

192:uWn/b5nZ/nQjxn5Q/EnQieXNnFnQOkEntwunQTbnNnQ/MCbAgRyFLqDxcYLujZQs:gQ/HdFyFuVpLkZQiKJqCrOr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423083590"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F7F2B761-1D21-11EF-9267-5267BFD3BAD1} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
284	IEXPLORE.EXE
284	IEXPLORE.EXE
284	IEXPLORE.EXE
284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 284	1936	iexplore.exe	28
PID 1936 wrote to memory of 284	1936	iexplore.exe	28
PID 1936 wrote to memory of 284	1936	iexplore.exe	28
PID 1936 wrote to memory of 284	1936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7dfc6681a51a0cf0c8034279aa5fa0b8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5762b42bfdbb73e41a6f8b1b6e03f94d

SHA1
9dabeec8df3360ee13bd2fb75429cb2eef240b30

SHA256
b662d915e976114ed6a52b061d9242c167168053164a146be110f19d383fa660

SHA512
a8c8067b3032383a2ee8611d6dea5175fdad1d464412ebb8fd4d50d541fec3c1d437b22dcc70fab0d57c9a4ca1fa6c09ed6196fc29d1c4a6917fc55f3600f540

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddf2d5e6f57da7ca231d14c90ceac6f8

SHA1
b22bfd5e9bb106ea1db2c147492f6546c33311f4

SHA256
d65461fe71178ad36180947623f6c188804f52271494042885416b3d0d036daf

SHA512
e7afd3249752741a2b9232522b0c4acafb90951226457cbc64221621c75f16e7f995554bff109decd5f6a929a2cad5ab5efecb6b8408a5b5cf64dbd35443b795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d30e5ca0aefb780a5ceef169ac9cd956

SHA1
37ef8a673ec4d18881d37844d954ac0c9ddc26f2

SHA256
2ed6d495004c2e43892d52d552edd9d5d5ca6894994817f9efd1871b123b8d74

SHA512
b7952bee679d13e2b35b7eea28f8958a8a6be37bb653ca0c94e2f22a9105882a8c067cc0f23afd0fec0275d44f5cbb81a1d34e93ceb034f99ce0573495f0b889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49c0a08a1d2d75768557d2b2272ae151

SHA1
41d7095bd10fdfeb8a9bd0ece320d310fcfdbcdb

SHA256
089760ca176facc3ce177b946657e830aceaece2d7ccfca33b2eeac92431d501

SHA512
d8b4712c4afc989a8cc8d8b00c3e3cf86a5d8e349e396ed3758359ed1e0393ada7719fa5f283b9940f3ddbf71403678fd9862b0d1c163a399bda1b6f0f9eedc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49f7b06801b58d32e4c50d6e9d34c046

SHA1
99cf395eca7e19fb29b83022083526797db8d852

SHA256
c179bf3a2b088e0698d2f427b59d699582cb4f816dca9bb1a0ded439abc089d5

SHA512
1ce2d87341afe43cc3abcd0a1264f718797709029544ffc8fef3dbec32ec99625f7153c7ab1b215547a11cee1713b4c4ac07e57341f65b7b9266bd0ea3fc5c16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec565c09f01b4b79ebaa6a3ef198a78a

SHA1
101670b305abbd1166cc62c44f70aa6df9850306

SHA256
302896d3a59c855ba8d830c456a27da0f2487d1272a42bafe9c3b88519530b4e

SHA512
cd86d5bbe81b559d6d6302252bd38ed80e6153ecb3d26c0f42735977a4866bfc2ed48b85547609288279258961944d22301561f1aef0d371049aa6bf469479dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32320fc5723360afc05373d6f7a8f657

SHA1
6e092b47970de086ae274d1bce1803d209174776

SHA256
560fb05d27916c0e77dbc3cddad01999e6e798e065a7ce6246caf15ec339ff52

SHA512
8c640243205f8eb0ab63ce22ba0af195660fcb2f1fe4c24dfcf7f96062878ff33a64f3e9b579f9fe4f1e87d252b4e3697a030db1c82c4d726630c831a78e673e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05307175b154c4a2a85fbc6705c8c26c

SHA1
e2047faf6e5589c58b5e21fc9bf872c5cd0460c6

SHA256
d4f76148b64a07808380c3053babebd2f137aa294f0caa536a03de6d5251dfb7

SHA512
b5dda1343f3fafc371b48e72295f9eee0844a7da261b34f3f9879424c3d32ab218cc33b7273532864c555660e696040a509f291c0a67c51d1f83ff8878c82fde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1affefc063cfceb1b730e170fb2f2dc5

SHA1
eb793e8be3f8dcfcef0d3ba029bcaaddf371409d

SHA256
93a12295f0d36b81429faec679b61e67646a585a236d33decf030a4a522e50fc

SHA512
054a93d9a5973bd7d8ea709faa526cf8ec6ae58a7976e2af6ef743101a0f4ccd24b8c0cf648cc40be63fc66dd698d619a531e06130fd605f82e67eba90cb8b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar10F9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit