bc32debcef72c81cc57fc2ec033a3347b15e46833b9772ba93181438ef392879

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a42ffe1bf256b75091b60a3ef757665d_JaffaCakes118.html
Size

19KB
MD5

a42ffe1bf256b75091b60a3ef757665d
SHA1

55ac05ff0d12516a551007485fb1e447b3310f70
SHA256

bc32debcef72c81cc57fc2ec033a3347b15e46833b9772ba93181438ef392879
SHA512

6f363b4ce5df4801bbc1a1edbb23dc4fb82580250445ecb158edcc69d98f3d87978634516fb51cf3cf802afe5432c98ac7d0a9a4a91b1f3f75ac229004143226
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIWtTJtETktTJtETwtTJtET0tTJtET4tTJtEr:SIMd0I5nO9Hdsv/axDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424421751"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F48A6F1-294D-11EF-87B3-6E1D43634CD3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1752	iexplore.exe
1752	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 3036	1752	iexplore.exe	28
PID 1752 wrote to memory of 3036	1752	iexplore.exe	28
PID 1752 wrote to memory of 3036	1752	iexplore.exe	28
PID 1752 wrote to memory of 3036	1752	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a42ffe1bf256b75091b60a3ef757665d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0f2b79668af1e5bea6496fd669581a96

SHA1
f4af23ad34175fb7ab3387ada334a04696676a7f

SHA256
be6b082d40374c809712b5841e80a36d548385ba61a98f9f555757555d367c8f

SHA512
f1822fc0c07e53eb696456b5fa41453ea117e573285d3409500c6646d20bb051a7b2ad6a9a5ff6d69645fd4ad80bd938b13f9d9bf5a83460f0a5348522996454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c2d623f58091c81b7c9760404bffbee

SHA1
4dcf7af8ec3501d90f171f8dd989c40e5f5b9b58

SHA256
894cdc438a8c67f38fe74f3716db51d1ffa614dc46591cf2a308d5d39622466e

SHA512
7928ae95a91d2e5a05b35ae436d28412cd77e472cb567ed87ac30c96ab057c6e182729da0325d9b688f987f834d1ad258e0401d7a49788e6c4790a10a80c40f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0575f62d476727141d15b19ca5be3363

SHA1
d32ffd3c6bfb618a6bf4a2debc4c3a7e779fa902

SHA256
50c18ae1895f3c887b376a357db6ab7db23123432f6488f6e543273eee02f80e

SHA512
2abfb1131411820d1a1d4fcdf05a325672cd4cbbcb7689bb56830b7216a034b4605826a839506c8fb1a90608ea5ca1b26d5447ff6bd5c804ddb92d061f9cd5cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffb8fec1bcd745a03ae5a7ca3969c7ef

SHA1
46f640dc0450d52ae0a2a602d31cc0b4c035b958

SHA256
826d0fe66ee805875d6936dc8eaef4359800ab96b06689f6c0b10f6a988dba02

SHA512
f69c028733c894399fe91802f2f9baa05bb5a8625c0147a11f28dacc37f370af69beb9d4e195f2e34055002e9c088940bf2e1850c203927cdc5bd23142a3c7c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cba3f19e60b263733bc60bc27074cb3a

SHA1
826a29490ff538f2211e8d532169148a5838ea50

SHA256
4523f8dd6464f7c2b1d23196be47c69c670a644ea9eeeb4adb00176ce52efbd4

SHA512
d42c7aedc445e2ef54b2e124c3900e2f9cb7daef97bb9f30287a1d7ae46af1a37a7740c2e2fc0a42b9708967e4f7e6af63673dbc09b5c6d65cbc9c14d0ced0d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57e4adf5aa4dc2d5fd6376923639ad7d

SHA1
7fa4a521c0160a2f197728882bc8d327dd77fa32

SHA256
b557e9bbeacd5dee171853ab5cd7a5cbd5aac726f526391b0b86ce000497402a

SHA512
233f95c53638d5294fba98aa6a32a284bba811138807be6033e07e688ddd22b808cfd8a2b5ea52780200bdf45ddb772641f36bbf30de0c84a1bf3b5f76015811

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a74561e9394f32f914aecc1cc5dac8fe

SHA1
91bb5be0106671e73e7fb1e34c807e87d460dfe6

SHA256
45a067f90f40f6302c598f9991619573938a75cdb0da0fa794097b9c3bcfb562

SHA512
59bd85ea24d2084a6829fee0a92de4b275524a2893bc1f8e0a62fc26e4732acefccfda910f7362f97b763be0ca5363a3ab5c4f859d98c38229c35d1702d4b55e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da69d12f6a3209e863d21d33ce69bd99

SHA1
84d4c2fe54d82c783c20754fa10e3a36873cb161

SHA256
ac8e1d41746c93426a3316cc0dfb6f853ffd9c2a9d98f7f54d1f11d4ceadf039

SHA512
61cccedeebf6665868e6d622083a1cbbe2ba17e0be72796074e6064edb9ded60a183c3b4b8fe4bc2ac1fd2c5a4febb413eb2c28a2142957f7b750a4c2ef2364e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb769e014adcb8929bf07e71b4fc9763

SHA1
5402385e5070215e38d1a8ec9efad3eafb2c2d0a

SHA256
ceae3f8688df9b876c4245d884e0ae83866d5daee64675dbe9a4651d0952c5eb

SHA512
9a351b3ecc7366903479194c22e68f6838897085450e7c9429cafcd12a1c66b98742ad76f4078d2fdf1d8788f0fe6b1cf33cfba5c3299ed4e21a799669b51d98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91652b3fb885b71636afacedfc502e10

SHA1
89dda74d20433cde735398fbdaf29e524d5a5787

SHA256
a3de20b662ddb8d5c5d9accb4464decdc73fa13292c85a822e4eac7fdb8f00a2

SHA512
9a9a42cc94cbf12af91a2bac89223fcec4d8b8ad91b233d15fd2344a409dacd821c0c4cb116028c262a8425d8d2d1e4d21eb159ff259741ce5481be1289920fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
883cd7333c8d8d8ae7e200f1dc770187

SHA1
92b1085e13bebbe338433779c930212dbf538f58

SHA256
eabaa7c37130a0a19538f0da647493c575b6be3ee3c42e1808f316c7cede81c2

SHA512
efd8607a0f971cb3839c347d3c29944b51fec0af86421c1a96cbd5772549da3d122804a6f1aa05251e02c8b55e37bb78f5f37970345a8d37192e9a3a97b5a6b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab189F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19EC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit