ce411ed117b243eb1f90ef59321267e3f4599e1a4c7258c623867e4d85629ac0

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

864aab3f47ca00c7fdde9e447fe6d5c7_JaffaCakes118.html
Size

20KB
MD5

864aab3f47ca00c7fdde9e447fe6d5c7
SHA1

1bb7014cc4762c3e518629e25e74d284845162f7
SHA256

ce411ed117b243eb1f90ef59321267e3f4599e1a4c7258c623867e4d85629ac0
SHA512

f22041426d4d00d03f8367715df3e666edce356ef8f1a39fa19ac5137be23c4191bf366c3e9797452122abbe8c412756ceea08c91b06b83ffdb750764cc32b15
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI04kzUnjBhMW82qDB8:SIMd0I5nO9H9svMVxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423302603"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E714E441-1F1F-11EF-B9A1-EE87AAC3DDB6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
624	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
624	iexplore.exe
624	iexplore.exe
940	IEXPLORE.EXE
940	IEXPLORE.EXE
940	IEXPLORE.EXE
940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 940	624	iexplore.exe	28
PID 624 wrote to memory of 940	624	iexplore.exe	28
PID 624 wrote to memory of 940	624	iexplore.exe	28
PID 624 wrote to memory of 940	624	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\864aab3f47ca00c7fdde9e447fe6d5c7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:624 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
79f4d4388d715714fdae779903575fc1

SHA1
ed8908c8785987eff684bcdfa20c2b0b89abb4c3

SHA256
eef6a0b3f1079e717e9fdd89c2af2909e102a9a67c6c1add9232ad63c8b180f2

SHA512
4687dafabe343f6f7f9df9b6b7ce19d6a7f7f1a710fa7de9e9779a5ca3b546ab90dc7202842df8fde45163dc6265eb4b241228c0a92fa938baf94a1af11761a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2eb027222a1cf3e3fe5b8b94cdb1adf4

SHA1
87f85c27c2ac56fa13b4965a87d0266e5fdb0dfe

SHA256
fc92ecd54945e19c9002e2dc31f46ee48a351dfb34d60b04d9fe357639acfb62

SHA512
a71852d68fa26887b55704b5bc67aeca6c1152b96397fb9487a8354e7bdce5429a0dc007ac247ad051f4a52e661d62ff4cf492787bc83a61ce4146714acb878e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0c62524f458d18e27669c48c8659343

SHA1
6f7856db4c1c672907604808bca5afae8c04d298

SHA256
4fbd90cf2481a49fb4fdb12cb319a5c18a0735768790ea1e6f21692ba5aaa07f

SHA512
3c9af5e1e6331b788aec4a9512f66f07a185c024003bdfe9ba34cfb64197903ddea18cdad0867067ea870a705d6a1a746a654098eab4da9ce018d851cc83b85f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a3f87018cc2c9c833dc7c4880b016f6

SHA1
7931b3553d5743c8c9568001ce3ef0b8fcd7ed13

SHA256
81d05e13a0af0c03750279a6fd5973c5edbbcccffe596af2549dc553e39f5a27

SHA512
56aba9473e4ccaa3b8aded020871bd072ef273ea92d43f3d9063be959db9f056b76f6dcd39a48c7fb6eca71941f0e20dea5b5aa9580aefa86122abdfa104d126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4f5a9048a161e852d014bf85a7353f0

SHA1
754ec080eeb2020e32fd3c9b88bd1c1f20086a7d

SHA256
744fce5ea240fa27a0a7e61714fc87c748fb6bfb85f045874bb00ef04b07ed6c

SHA512
f9bc377fa60f5a5e76211cd780695aae22cd4d2db17af7befa08b81c24eb4df44f6003acb2f495e0e10cf014fed0ef916448f37f3084a91383d1d6107ff481f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dbeec1602073dccc293d86da00d4778

SHA1
0f78dc83a0c1e2e961c7ca545f2ff2f97140e7e1

SHA256
58186ef7c4040b3b4fb398a31f83c425e34729a14329afb2d5c0656b3fb2a755

SHA512
be1864b15c1afbb2b3ac329e51ccf6b941d7fae1a9709316f90eba2b577e18cb7a67c6097a1c48ee484983f85b1e13f1e374edeed8464171662bd3c552aa01be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d85d8669055ecd362c6e370b9c60eb81

SHA1
9b749097a5e3fd28d0eae5bdec3b0f36cde46e20

SHA256
f03f3ca7aea75b35d37b94a0a25e5391116cfa382e22c5f7cab23d0f42f93c0b

SHA512
f37b84d0685aeee4968cd04d2b6d388b0d419b3036361a4f1ff78deeaf2899eb29e88bf1fa0b4d4328dc090519deb389bd1a79d8f6dfade0743410441e7e1b68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5338b5a9700efb57fd19426e9e13c4c7

SHA1
96eaea74a6a914fb1efe85312450419611d69bef

SHA256
7f440917ebfff2ceee8bf17692b6a076da3d2ab4a5cc0eb291edae67073dd48d

SHA512
0085b8f22389a0f4847f4d62b2875d1b4961c3a283d9f64c24aed0311b140bf1c36ab9352a3cbd49f27bb92397e62a16ea8ec3cd28da83e1ed56e2b711ebda34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c74710c05c17d9ab7a71d2c755b3e48e

SHA1
8eb7462a8c15ae4a0fb34f5448573d9a0440e8bb

SHA256
f5d1294c8d33868cf478349b0c92423c68a2840f7cfa9f3e2f9da28bef2eff96

SHA512
3f357617b0b3cfb28188f56fef48c3f4a64286df7bf88b63d97d492191f449ac422a2fc727bf1f74ef97ed3c185ea2950ff5eaaa1683f6abaadfbdc19f5eeab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e62272132eb46437410c890aca81de6

SHA1
522fe57974e350845578aa01a0c8a303a7e6129e

SHA256
032c50b34e75a2f5988569f6bd5c87e69b27b7d3c13b952ffcb8be7403df928d

SHA512
e25a24ef1cad54e309c9770b2350d199972fd71d1b74541e2abf2aed17ce26d826680b28fe252273c197a40ef4baec584af113177875097880fd19a2234669f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8995bd0de4c3ee5f225fc9bf34931792

SHA1
4a7de24c363b5ccc77f2faa33162bc0147aea0d2

SHA256
cfffad22d266a9af7550f989611c07f46ad6945e4000eacf12843d467e21631b

SHA512
c5cbcbb3dc540d18e9f112957e2a1cc8e460930b339e525dbc7eead27892f362522ec38413ce0a8b54beb88470c9ec119b5110361cbe296e0b2d8fc87af477ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar121F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit