c7fc570fc41fcff59a8317c95409b4e74defb8f554a2dd9d3acc6055099994b6

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91076aed18a40fa8672dec032244364e_JaffaCakes118.html
Size

18KB
MD5

91076aed18a40fa8672dec032244364e
SHA1

f6feb9f2043c05143927c315ee690b12693e625c
SHA256

c7fc570fc41fcff59a8317c95409b4e74defb8f554a2dd9d3acc6055099994b6
SHA512

ee268c7db7a827b04e9154ed6357d7f6ee1fb15be3198d8e6a0d71721f77aafefaaf2d02833eeb7c44a3c90cf51a88c14f293a6ac707a452dc72c22f56edc3a6
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI04ezUnjBhCk82qDB8:SIMd0I5nO9H3svCnxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DAD78CD1-217E-11EF-B7D6-72515687562C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423563287"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	iexplore.exe
2348	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2892	2348	iexplore.exe	28
PID 2348 wrote to memory of 2892	2348	iexplore.exe	28
PID 2348 wrote to memory of 2892	2348	iexplore.exe	28
PID 2348 wrote to memory of 2892	2348	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91076aed18a40fa8672dec032244364e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c3c0f8d96527f24a4526973f6d0bce44

SHA1
e9ed4b77d01a5c12ae7707d90a05bc98736f3ce9

SHA256
0fdb92e0fef53c365ba938841530b6d012b40ee51f233e308d0251dbdc096bf1

SHA512
fdc39ea944894fa96d8ed00fd869adc9846892b3d9825c9a94d707cb5a4cda38ead7b1d26c5b9609687da852289d455d6d1a051b33958c2f2966e800806591fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaaeb025f7ce0eaeb268d0118cd03636

SHA1
9399532521e6dafe06671a96d680af7e4a23bd22

SHA256
0bedcfd0b9495f369a572a287b0fdd7bbe15dc00983c478c8a492490f5b0d81b

SHA512
43f0d023983f6d87edaffd5956f9026d480950c7dc11e775535f67c4008570c42de98e5213c51ee378de232d778d7c2a5e5ffec5cd41c90a6a02214b6f78ff24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1f1270ebedfce254be114545bcea645

SHA1
ff03174b1f2bf8c87fae13ffa3bbb47fd5bbbf95

SHA256
8810783159ed1228a5881ec3e5ccb6e012c4f96b95e36a1e5937551a8b2ab131

SHA512
09bcf796318860e1592395ec2a00612fdc16419275a3402e87851269389e15385d19642710e562b5b9387ed0193175e9b520b5a32a267790adaace3e0b368b3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
430b1061236cf0aeb4e74c055f2da800

SHA1
70e67a8144f5c332e6b05a210d5c936238f7906a

SHA256
b11926cae984afa9a92552b1599fc8f5154f7ba3470ccfa70b923e961a4f3a96

SHA512
763aef26564d3762ed443f9118b91fbe4a7e94931abd442a9d51af8db237b648a263d16829d7793639b816e99dcb4955f320e080f1f37c88861574de1ef669f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afa5921ee5c07901134aa4f003c53872

SHA1
49da3eee5dea7208c2bd3556e552df345ca3ef94

SHA256
60cab2ecb3f7483465c4fd6787665b9eb7d705a1b5bfbd35f7fa5e28caea97d4

SHA512
edfce948feda576e3e02d294ccb16d8bbc1994f9baeb9f8c978b90f47cfc8a01928cb16b993e8816f4783532e9c79142a58e63779c0918be1d629af47d48731c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8dc660e3417deea52148cc7922eb26af

SHA1
e5aae3aa5640eb833d6954a71ba8b49d46b16f46

SHA256
14f0a0a5b0c54838dcc861fffd1167491dc602825ed94b4721832600e23f25c5

SHA512
46020544da809df4050df4e6fc1f43da617be22b0e880b2bf6450e14581bad0d433429105427f310edd76657e04ec82d0bb51f4da3ad7a5d54cca72071e06197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fef9d44c8e69bdfa497dee9790ac4b6a

SHA1
57c9109b9f1d689648e3557158fb3308de9099cc

SHA256
7c96d9c393e6f2f0e42d515d722c1f9f4151a26c37f6380dbebb76450c52769a

SHA512
f3073a09b3f1dbf2ad12cc6b5b68e2b8bd9611407cb175ee25db61bc4566c0c7b43477dea08b0d635dd1482eefaed1aff2054b5aa31f61b50c9725670868313d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d7460f1860c4257d59733fb2eaa5917

SHA1
8b91a7daa67056c3ddcfe04b200b178f48005bb1

SHA256
b9c8282fbcc7f1f6d2441aee72f6f16266a4e78aa2b60ef5ac238a03e3331e9a

SHA512
9f72599226296dafeb29c85a2a2e60152e1039ac9ed74b7a113612d24a15d4733b691fb2c08b9bcf6f1f7c721edccd636a0ecac7a01a22b2a3b1bc41be8e2214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3bfe180e92d33f61560c259dee0b8d9

SHA1
fce6a05742b90e9936a1135b42b8be598d7462cd

SHA256
57ef8de35726d93952e0f60aaeea85c00134a04781ab4ca325e260243ce72e12

SHA512
b571d7ac65ffb4043ae1c2e1dcd6c01ccd92d8722bcdd257e24ea7f80092255699eaeea17fb727991f7eccf78987cad7c03ff4f38bc73d15f59125632baf2d45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
990d7be65de348939b7b5f5d0fbb6671

SHA1
815a0c06d5c39d0fed34e3e3cb1520061f4d27f5

SHA256
5531da6d4634ebfdac27fd7812f4b5721318aee08c14ad9ff8822715c4bb031b

SHA512
e3a209ddae9f8a7b462438ac75c2bb16a0851f1db20b971420e15833d53ce3fd3cff34f77f8ddeb911caf4a052e293af35e61e925329c705799de2c434d8afb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
0a951965c1325575ddbea2aa84b5d7c4

SHA1
a71deaf4d2817ba2e17b0ae0c513c79adf72765a

SHA256
4db45b6809a871a412d9d3442d1c9eaa3fcccfb77a938650d11c565a95377ba3

SHA512
49e47249bbf65d6f803119b870a8cd412435eb969b8b94919e4dfd11e49682fa9823caf51a226902c859ce519445c93f11852b9f681385136771b184d20afaaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar775.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit