451d2b4d0cd9a896a28154a135fba1c481b055d6843bd3cb22fbbee3a2e31594

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a1c5fa44ccaaeb1b4aaef01b2a20b0a_JaffaCakes118.html
Size

105KB
MD5

1a1c5fa44ccaaeb1b4aaef01b2a20b0a
SHA1

658eda2df028cced99970680ad51f2ffab409399
SHA256

451d2b4d0cd9a896a28154a135fba1c481b055d6843bd3cb22fbbee3a2e31594
SHA512

b3169ab0b1d38fd69f7305732a677f622ab3f3af5f895cdfb156cae6769cdd8c4412eb63f20982f24ad7d243052735601ad92359fba3c3cdc6e266a9b64e574d
SSDEEP

3072:SZy7W0Hmhygyqop1/fi/cxwWhj+SPRP/LtREhqzwdZ5I:SZMUZ5I

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A2DC5481-3549-11EF-A293-4AADDC6219DF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425739453"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 3008	2148	iexplore.exe	28
PID 2148 wrote to memory of 3008	2148	iexplore.exe	28
PID 2148 wrote to memory of 3008	2148	iexplore.exe	28
PID 2148 wrote to memory of 3008	2148	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1a1c5fa44ccaaeb1b4aaef01b2a20b0a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
629167fe6e859bd860f667979fc6a637

SHA1
1c64232bddeb68ce72a6efb29cb93194edf2443b

SHA256
461d19ccf3c1a1f5720c4d882d178664ca6810625dc460f3f34e9d8ab97cd746

SHA512
607a0533f8533631146baad79e253ad61736958c58275f7b221f8016b468597d2eb6a7239e5a8012b0ab8a197f81d80b30b3744e6ed8453456cd8d635297a800

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caa8fbe4311602f0d979402432ca972a

SHA1
7ea8881a853ee99bc0ae0cc5db3db0b054963e28

SHA256
5ac72af35cdb2920381c49759821a9d385157048ab9e1a39f8225c71304832ff

SHA512
fff7aa378e2967bd000783217dbdb8f51ef25e63f0999d799e21106c0c17d5ea629125b8cdf5689b79e5acf9c3664ca12048ba5841c4b78dfaba80b7a09ee50c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
880a1e7f39891c53d72fef5afc189ca3

SHA1
d93adadf0caba505c3a0c2f0cc4eba542214f415

SHA256
490b654b00a60bb18f67e7310e80508f4ff8ec769dd1ae51493a2d810636e0eb

SHA512
e592aa332ccac1e4d32896f3ab05b64b7831f87455dfed454be263a530924d8d26b15795096e8494a98a9d0ffe086ccf5ffb6f1e70d0cf04591753fb37d2d778

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e242398d1a5cd91c9d4d08d2b2f34ee

SHA1
70e343d422f52fe2ffdb63f6fdffb0a1e2814b5c

SHA256
d5943faf105b5d488e8af9e6576ffc6249f7c10ab7752ec467413ea795286fe4

SHA512
c86244ce9e3cf986931ba1b1624f1f66279103dc82c305dd3d671c118c2f83a2809e7bd249ec6d458615101ab3bd46501b5b393e83110799a4c2626cfa0588a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da2603e5d3840071129d86807656e8da

SHA1
b55cbfb3393db1ebcfa4a3dbd40082af2a6c4c30

SHA256
75b8d5e78fda47ad5664ce720d358400f294d9b03cf1cb0c94abfde735ef5a8c

SHA512
ec21fd6dc429c0be7d8ab9b98ad2bd59a210b20a0b295aa9b2c77729113ae5d391f40c8f6afb362775f16d9ef90286b46b06eed670d43a16c4c1727e6bbe7c48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
587565a08b9462ea039716c4491cbb0c

SHA1
7bc0e182dd142c509111c0b0b6e0f63ccceff63d

SHA256
0741de88fca65c6c1df1fb1f526242cc588de6f715ffd7eb4e5a6269374f88d1

SHA512
8cd37cbd5abcf7bd8380c25c6277ac5566700610a9b303c997dfa033288a5a429adc31f2eaf3b54ebb7f408ada9c4c4eaae66dc171a798f2dfbce874503f6a0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a435380a644484841cf7af331f1621b4

SHA1
dfea3683280b5a447842635e4b600144245af263

SHA256
c46d43ee021179052469f9928686acbd55a8eb40b3ab66f32891b60a56d0b8f7

SHA512
92d80a6f3a98e48bc344794cdd7970e8236e29b66f253857d4ce54b4accd9c4e09748dce47e5cdd2bcf3b438c909a37b7eeaba3e9f8cf53303ae94d9168109a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b89749d9abbcb7f4e3d42474d466e04

SHA1
423734198f9787b89024a3b7c387eb8bfa655ec2

SHA256
5b3149310259834abfbb6198b9e99960784480a33c336280540b35cd80de1ce3

SHA512
6bdf1e3fb29304e4afd2fa8cb843193bcb5838ca1a3d2204920ed3ad85704b4379828714c8906e6d94dc7068e0708fc308ec14f816861567c5bae3ba52fdc0e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13A2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14A3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit