833ed73b3607b34a8da00bb7f672c5b9156036cbcc5001469102b100ebf814a2

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 23:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a7231e59f5aa3e7eed36f5a4e35a52b7_JaffaCakes118.html
Size

19KB
MD5

a7231e59f5aa3e7eed36f5a4e35a52b7
SHA1

836152cf87e2f1a6e56e5e9843a13a1308a24603
SHA256

833ed73b3607b34a8da00bb7f672c5b9156036cbcc5001469102b100ebf814a2
SHA512

633e194edb2d9a54c7e27138d7fc635600fa5e0001625794b853ff70f070608503d9d56152871ab0479520343fc1efa3f8927cfc74da98b26d409775d1e9fda9
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIq4EzUnjBhQ682qDB8:SIMd0I5nvHPsvQ5xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3049611-29DD-11EF-8456-F62A48C4CCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424483739"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2044	2364	iexplore.exe	28
PID 2364 wrote to memory of 2044	2364	iexplore.exe	28
PID 2364 wrote to memory of 2044	2364	iexplore.exe	28
PID 2364 wrote to memory of 2044	2364	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a7231e59f5aa3e7eed36f5a4e35a52b7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
01b667a4cd588e7b54c014c25de742dc

SHA1
1ff09519e3f7c0c14bbc71a86f82e7fe3817c10d

SHA256
737dfab6bd8a445c6693709181ef08ccf96b489275608385703f6827c15ca585

SHA512
572227f5a64a9e684e708b0f9cb8a9fc0a0d8cfc739b021585ad60dff568109977289a7a713f4b5c257fa43e9d756f869896bc40ecd512c6fc3b3091df948af4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04595f652d907b20cff5f488ce54f737

SHA1
90063d3ba73f157949a49af647a93d2a8178a478

SHA256
35c4d25e1be3b492e76986aacd9e3c68664b561a1b0648070a3ef83fb6f8e35b

SHA512
4c29b17647c92f0e8d6311f0c459a162b5fe36c7fda5709135898274364feaee84ee5a51605169ed650d300251013218871f26940baba039ca8609f06faa0896

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3f798a9b041fb9bab440505992da38d

SHA1
69fc3a513bbb50b9b09485b56e8f5d0a05d5a9b4

SHA256
6c3e7687e79c9a84ac958a87c773ac17d7a988a2c26de063eb32283224ae5bca

SHA512
828e07c56a49b2d593925ee8bbf5d42e1183d2064c05af6fd8f15de4728ee1ed08b57693c043bf0ff4030d193e1a3f0fe1ea46b485364f8770d2594ef1cb6872

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6592e56e9394cc3a076ecbe1e749cedd

SHA1
f01fc8607f3d92aff849bff7c406bb1cc3b2d7ce

SHA256
6824b3f104f60cd8be4219d9073a5a62c34d355fbdc48c30acb07d2b40df4ec6

SHA512
18d70cae602662adbf428cdd5799863dbb289af9fbfd3ae4ff48350887f60ed35868dd855fb3ed3ad3661151fa224bfe1e5acb8d1bdc94ddd00fd2a2dc12f0d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0f8dd01e9086ceafadc821980afa660

SHA1
0e0bc810e40f3b3dcfccea139da68c28ac45d06d

SHA256
84eaddd0d1991e42e11af857aabbf0485993e5236a0e77cd22ac96e9e43909a4

SHA512
2096ca08508aa1a195663adb5b21cd1ec3da8e6e2d8cf1a2f7260198d4b01cad0bcd8e185e078566ca6ecda2f0e091080b353e316deb302f363be78bfae02338

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fe672b2549266dcc8f026c913b662b9

SHA1
1ca7fc3f25965df3b817d266bcfa120df3e5eeed

SHA256
0f974343ccd07ef47774d0c05c35f6404bab08ca9cec268592ea4ddb6a5c8303

SHA512
fc4e5d957b0c8774a2f90bc6693dda51003d55aca0521405d2c573d68346179fa75fe7a00008593b83ef553d98fb0faa4d3cff67c1ff07bf73e70517206eb5e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68bc000635143d3c58e215c1f49f8821

SHA1
5b296d7d1d8eb86f9894d29024a08b46baafbeaf

SHA256
49f67c0e5d36ed95c5db771a39e950a368a3b892886d677480a9c335ab6e73de

SHA512
ef5ef39858061733bba3a18344547021d6d8e278a468d5ae237248256cbebb67b33c25bbb2806b9034374b1006e22085fcc92fa8bbb5ef60c64c132ab6d7bb21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12c8b32fe03116d3a513c74fa1de2479

SHA1
7933b665441157bd8e9f57d478b865d645a3f62c

SHA256
7f93c28a81926b5ab231b1db4bb9f6cc644bc9c6c12c67a38fb2ef4e39fd3027

SHA512
9463044a683b6eda265c028912beaf5b3368358f05398b88d6dd98df0f0b2e80d780be211b9101986c853c6384a7f41cb2cda743fc2929b47e0b8585d69118d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
596609f5501ac57e85f2ef27f9b62f3b

SHA1
968eb3639ee06ca0ee3ddd9030bc903948fa036e

SHA256
5e8cdbe2c56cd3d4286278a9d02c4e02b5e0785bc942e1823e1266312991d317

SHA512
cb598d91d7ea500a6d6e44134b3066b1b83218198bf75abd9038eae5cbeefe3c9d24f48b3650cc3d33737ae46c640c386f463cbce4ebb564daec20815a797170

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1c865cdc099719440d9748c46b9c0f3

SHA1
0e4840d9e4683bab8d286c4e140b8bdd4913cbff

SHA256
88d841ed8c2421135565f80c4a59497a2896d6b3d9ba0ca9fae93fbdb1e527ba

SHA512
d23723b160a8adb927cad4e709223ff6ab806763165b7032171af26e92f2750d17d67b9259f3cd6bf0d5d165334f4cb2a969b41551be5f004940d010571e19e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c3a1d1c95abb041f8519c892a2ba97cb

SHA1
f357c5d27700f1c5ee183f7a9e116b38cf815cac

SHA256
ecad52ccff696044d33925b24e8c6f5ae7b50d217ce8cb1819b0c1608bd4522b

SHA512
0572125f5f204f7e8c454d5d5479911be4b3ad6cd42be9a2c31d55447573d11fdb0c71579d31a2abf4e75ab758b3ececb4a63f50fc59d1632a2ce57f68b992f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA23.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit