6765c5d29e40e8ef91835749cfbd26ad2206275f5fe700b43b5f56849c81cd30

Analysis

max time kernel
148s
max time network
139s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6f7c391b99b90043113e362aaebddcf_JaffaCakes118.html
Size

19KB
MD5

a6f7c391b99b90043113e362aaebddcf
SHA1

f12393468dc9baf11953641527491e281e5857f3
SHA256

6765c5d29e40e8ef91835749cfbd26ad2206275f5fe700b43b5f56849c81cd30
SHA512

51fa08494a1ace57945b5d08fe03e506415207b6828e08118005eaa6acc4103b7f0095e77cbcd4fbc0f56465e8e36473046f58335f565edc77c272c615863af9
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI84QzUnjBhE+82qDB8:SIMd0I5nO9HNsvEtxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{166E6DD1-29D7-11EF-888E-CA4C2FB69A12} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424480792"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1160	iexplore.exe
1160	iexplore.exe
852	IEXPLORE.EXE
852	IEXPLORE.EXE
852	IEXPLORE.EXE
852	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 852	1160	iexplore.exe	28
PID 1160 wrote to memory of 852	1160	iexplore.exe	28
PID 1160 wrote to memory of 852	1160	iexplore.exe	28
PID 1160 wrote to memory of 852	1160	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a6f7c391b99b90043113e362aaebddcf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1160 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
de8b18c55457756193810b1b9dec7fcc

SHA1
103a7cf1484cec0af71fba8b645a89813f4d3862

SHA256
b1cd0b07a8f1e5e590cd21991ee7b0822647d6db26553091f3960c847c1ee119

SHA512
9f863dfacba56a4acf211946970b786268bf53126aa90fee44e980fdf06d39a635b23c17939bcc5cd060d802007eaccc5236b94cab9a120a08622272deb66081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e691f60ee02699d57e77fb5a2bff531c

SHA1
5ffa5a6ed2851b8ba4b9c218b5a5bf905d63eacb

SHA256
ee63fb240bc3c3a9be3d989ce55f62c620e9e79dac26bc5e644358cdf4ed5c85

SHA512
7f77c568413fd44df97b15913a0dc515aba0895e169c1b7edebe5b4bb495c59bd45726e599b071e4b961bb496240d24086135de8cb9c71441a3b60e7040743e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55ac397b4e3982119a5b6f9fbc31512f

SHA1
a6617ced019e5b7fe50b4bbdaadf67b50daa8df9

SHA256
a941fe5530062dde13649ec279fb4e0560d003552610460e2db1e47ca1453c1d

SHA512
ccd95a1dbd74ba6dae4c4ff18f268094caed22a692cc124125340ed55c6d5e6acc818926b99779b952c23a5a77650a29445e7d5d825d4c949e9b4523598b486b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7336bd5d937323bc14591894ecc01e36

SHA1
650b640feb768649d0f6b29a4b1be16f6a8918a9

SHA256
4f1c12bc0434d0a7adb6531fc5c1913fc3aa366bba338a70674469ec1c924fad

SHA512
e2c47a0888c91ccbb5a5548cf4f7c5fc3a7f3f31653dd2b0fde05c0d5d7f2b3230bdcd6dc47ae007b80dfe0076a316a8e8bf9ecc06dc979a1d012d7306d58c0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b324ff051fbfba40535ebf538b9c44a

SHA1
9301b3c2587cb0920115e8139fe231627c4711a6

SHA256
6b4a4d0ab66ede7bf5b00cdd2107ff937df6ab80023a5ac3b1249a8e462394a8

SHA512
a7a86304c9b6360d1853e40b92b8522eb5da5f24d0aad615fd6edb54cae80fabac1f2ecc9ccac8f17d2e9d19ab5afca5c65848d2a166709315820d0e0209ce78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f4c9b847acad10987164fc006d86806

SHA1
fbc4a3d44cb3e0354c6616dde654b69624678df2

SHA256
5210624c7c3f05b13a9f06818c3b10d085c57ab1e6c65f944bede7d24d50ad12

SHA512
057ce80fbed72d786a9d29e984b96130ed4309fd1ca42883d05ba7f0794bc085cdfb09188a4b5a90fea132d9610db3f366d7bf876f4777225f95c5f117622964

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11b5e4fcf47a7a3fab8ca942330b0eda

SHA1
3510dd7bc94aa1a3599b173f675bad8821300396

SHA256
398d10fbb4a821283dc47afb5ebe5c70f3360e0cca87f042428cf65af9ac6a63

SHA512
e7b842bd206932cb0a0df403a528eb25e86ba4334487beea1bc29b03dd62ddb95ab9daf9743dd695b86a7f32ce900bdbcdb2b75dd95798fcbf4a424aef9cef60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67d9c13402e1ade6ab6b6d8feb6efab6

SHA1
2cf7dc0fb4b5762980077e082a33f8eb259453d5

SHA256
1607abd2871cf9dfbee96c1876b0e662e1cc656c9a6c0d1d4e038cf6e48c6d8d

SHA512
8ac7d029bfc774351a6cb6f3eac61ff1fb15fd7b71de087dc704ed726f988626c8c0b2fd45c433edc38073f87981c0adb68b135bbd00556bdda33642b4059f8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d9d37a67b78d5400c5a859ce468aa2d

SHA1
a6ffa5e6f5d06453a27555861c0ced412a197441

SHA256
a269dab03463cf6f53b16c01f3a73605bf1dc9627e8257fde15a08a84fc4570b

SHA512
37e8c8b2ed313c7e0195a6b5d081164bcdd0228427b3add3839b9c35ee52ceedaa74700d645bea8bf0462a45c4f83806b169e38e82b728a95f4e573bcf81e23f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
33481b01c4b03024cf7527c13f789d2b

SHA1
727059fda883b0b09854e3a12385e695215b73dd

SHA256
4adce6a41a486b6a714ea6cf61466c7041eea84f733f9ba3cccf7ce5c97793de

SHA512
2f86f1a8dc16356d25385806d0d5c23d8c5d891ad1683585c80c72de2d8d8efa2bbe581f73890bcabafda975e47211223556ee7d4e5a1124393a31ff9584f034

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1644.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit