ca7057c6f566b68be360b464ab22d72eb03c4387f279283b4043179770a00b50

Analysis

max time kernel
113s
max time network
144s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27663aadd95dcfe339b726f1aaa5ead2_JaffaCakes118.html
Size

20KB
MD5

27663aadd95dcfe339b726f1aaa5ead2
SHA1

9e0ea6936120ceb6844022618d31b9b1c4311c3c
SHA256

ca7057c6f566b68be360b464ab22d72eb03c4387f279283b4043179770a00b50
SHA512

2fbb61f435615f3bf8e80655e12377c47a4eaeff0f46805ded799a7dd61e39122554ff3c766a2245c2c5f92d6de4c1a3a007967e49f1b53e523a080d3ac4f297
SSDEEP

384:eZlIc2th4hRGTHXf9QG+P0n6Z8H/gbbAguLZ:Wp8fgnAxLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82FE2FC1-3B58-11EF-8FA3-EA829B7A1C2A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426405551"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1140	iexplore.exe
1140	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2180	1140	iexplore.exe	30
PID 1140 wrote to memory of 2180	1140	iexplore.exe	30
PID 1140 wrote to memory of 2180	1140	iexplore.exe	30
PID 1140 wrote to memory of 2180	1140	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27663aadd95dcfe339b726f1aaa5ead2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1140 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43db45e6c7e13b9d76aa9d5e9ea23a0e

SHA1
eabd85e6e04a88cb6d32b61ba129eb9732e23b5d

SHA256
00df57023b949f7b96b4b279c3ba7623989d441135e85dd49991cd5b1ddf3c93

SHA512
863fbb4b46aaf5a0ce53921b62882c6a1f5470f3b7bcdfaf60773a5df4d4c8fba305d4a118bb7a20bc4b8e6341e6027c95c76365861f4cf28c086da7592560cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c152056d68ec6fafd4c6cf5112068476

SHA1
00d553c84d297c83f6e3c75f75ab597cc59f92df

SHA256
d2d28567c39dac2f44405dfd582d2bd021b6837aac2bd48dc5e12c4f625417ea

SHA512
f3f0d971e66d0763ac6d4469c581d4b645cd6218b4465b46648b84cf8b282b481caa700f23313ca5a46a2468167596d74f7be8ff4a2b35b24bfad992e3bdf02d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b1b7c3e67d4ade93da5a373d98220c0

SHA1
dda5e5a7b52352290759b89a86b172cae6308312

SHA256
9dc00f58d52a72beb7f89a1e4ec91eeadc0f11b1ac8c519029dc7e660a8d5962

SHA512
4524e40d251fabdbd40442468b4f986f7b7de88719b9e0b65d6e03377b8999fb7359d6c744a47b3e0adce5d660e1861ae01ba6311214e85695e57b342e44f1ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8067befeb57bd2f513374c9cb2ba924e

SHA1
cc75d3d517cbbfea6511eb1bcf964210b0f169bc

SHA256
1ab8d8a97a2388249fc3a0c64976aeb6d3520f44d1073196619abb9264513b96

SHA512
331ef5fdf78e457ba6ce329783ae2b7fa4ef5ee9bc66dc53ed669efa1909ada8dc8f2190b4f801848789e3eb7f94871044744e14ddb91c7e3d02fd6fc5ca09ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65c29c8ce7c5770b6aa4c14eb75ee709

SHA1
9593dc3dac4c6e9be42f5028aaef1b28a975eec9

SHA256
0cfc1ccffbdbaf5ca2f2b83a79261cc9e89cb32e868ee45bbab1798ce3b7e275

SHA512
b53ce2261805ceca8678b486748b6486edb4e0137f52fd7d7a2e45ea8c6fa99d7982b98ffb77d172ba997ac1b4410d1fda47bbd01e3b400685e205d6e7a16be1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09362f8c948c17c86d96f5f0c8f1cf09

SHA1
8217a0fc0a05a90e897f88ec24e4c5e67fcda532

SHA256
4040afa4284f65d9393bca368e72ded70d4dcea25fe843892313237d91746cfe

SHA512
a430f9c8e2ac9f8970410cecb202c3e9145c3b5098ce9ff41c495acea32b56b035aab1d99a50013edad11dcb42502d74b137039c782cee0e58f1b65b9a37a262

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e07360be01f908994ef4c199513764d4

SHA1
1ccfa4eabe55b642bac5f7cc49d09ccf72b2e17b

SHA256
e03e8180a1f3e4f7843405161474ffb5b28111dd23aafeae047b35aa9cf4c282

SHA512
93af6e0af9b8675928da9c10e892b907e355a2f175ded78795ddee609206612a9e7fe51fe4362c447c35d5b6e457dd5497a95a331a78ea9b0f4669588ce3716f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52438c0ff38c6349997e522aba1d311a

SHA1
2fb2ad81ab53e87271d76890d4915aa0e5058778

SHA256
417914d875ac5e4b0c3008e858dc6f7b6b7b210cff80e1daa8a6e7861f99d83e

SHA512
96628ea315f598e10bd2693d83b6367b0eb294468d77d1485c54cc915005cfdfe9056dc37b18384fd85107b54c0c20e34899bedc3c35e06e151c611ad14b37cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b95c60299b35f15c4bd50a2233af982c

SHA1
aba18a4960c9b153e3ec2aee727b38c46db255d6

SHA256
ddcc1762dcd87faab5a1595ea925dba3889b31b17a6997d2670f6b0105638067

SHA512
0cd6846b89b05e3bd03a607142d9c0f6a4c69b945db008e75305a6bddf8f706b626116b0f5c4f613f4549632e7667bea1b2b4a7cfac8ef7b0f35aeeaec211dcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDE6E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDFAA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit