cb986f684be8615103330d87fa0a223da61f9e162240fcf8b910ab59308ce8f8

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

735328231c88a46925b4adaf177bbea2_JaffaCakes118.html
Size

26KB
MD5

735328231c88a46925b4adaf177bbea2
SHA1

d6f02f75ed69822faa84adef5cb06eec0a7e262e
SHA256

cb986f684be8615103330d87fa0a223da61f9e162240fcf8b910ab59308ce8f8
SHA512

a9e84fcc1563ed3e6b27244b14d9e259f4b7656e160452b91f78e8f79e26650fe2699e488c69f4218853531f18aae4a15744dff7b890eeffdec702f300a7211b
SSDEEP

192:uqq3LAb5nWenQjxn5Q/NnQieoNn2wZnQOkEntzznQTbnxnQSCJVevo7NtjFo+NzK:ngQ/swmygc4KSZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC81BEB1-1ADE-11EF-8D12-66A5A0AB388F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422834917"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	iexplore.exe
2896	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2372	2896	iexplore.exe	28
PID 2896 wrote to memory of 2372	2896	iexplore.exe	28
PID 2896 wrote to memory of 2372	2896	iexplore.exe	28
PID 2896 wrote to memory of 2372	2896	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\735328231c88a46925b4adaf177bbea2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2688698c1725b1cd5a6c2e5b29e981a

SHA1
eaff400d562df5e8a30542706b8ded955509b546

SHA256
6312f448687615b31bf6d2eacff3a8b63359aa3f5befd5e8d502f1d108e4beae

SHA512
e26ddde9e641a5da599932d7e8734b0a8f034047e95680af33e2c99cb2f721ce2cbfc5f71bb343f00cc8c87f256a9b5a44527b3386b0ca28dd03ca105a6ba252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f23290e1bbf1283ad0ac7d5bff66d20

SHA1
2d0475d19ddac09de599fbc1060af82a6ac126ec

SHA256
449dc3c7a10e9a54f5c46811d6dbfe1a67b0267dfdb55e2e7cdb8286c2120668

SHA512
f17f4c92ce498d554767d964964748bb16a3a523f239fea3c6054da809426700479e73882f41af4d1a4045d773b10ca94703860872d706ed4fd17c93aaec3001

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e6d9282fbef305bd4a3de66e2966d60

SHA1
2e515a16d5c64f2a2cabb6805dc72148f63d62aa

SHA256
091cdf9759d2abe4c579ce111266a3f93a04c24536ce5dd51468695e48152cb6

SHA512
96a08354f253aa5e8488c4c055cc898fb5637064d3f138e85d53a9c6f74c50a4e9f3355c9951bfe10e8db7985ad2be730622d3795d421bcaac7138d69341e1c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4498b7da8ba95502ac896d812d469883

SHA1
c20ce6a069cbd562dbaa93a85ff04fcbf4069bdc

SHA256
f5a2fbc7427c954d6da70d993c3c97125f94f6dfb491caeea71a58950187a4a0

SHA512
e5e89bea393838b3d626b4f87763affdd4b2807957a01931b09c01d21ac4d03780238165ff7bae04633a014aa01d4e93ed54b284e373c519cb0b98e69d52be7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d100531ecbd0b3a68ee691c361e4d3d

SHA1
047058cde13ac7e4182b4a286b71ac7b32a6864a

SHA256
755972abce274a3343b483e8b413f72e7a1b93af10eeed3152a8016d8e239767

SHA512
1f22f8e405baa67a847c8d2c808f760a6ce86523d3f1444686c3ee1e8042765a47e31194e9b8fabaa50be6fdb080dc7f9312df1590569ab42349eeeb7d67aa8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e030580f1bf50193b80e79261b511e7

SHA1
6f8c87e11fc0413f2963bbc7349085229dcb0e08

SHA256
d832dc275694af1a9fa28cfdcb7e711c639f2acdcffa895127fa24ff1ad78746

SHA512
d3ec389471aed4d0d620b75b0e34c1037eb2c6b5b98006435db56e07e38ca6decfb31a9d67aec0daec10ed3b9d3d5795e7a6b193b3c08e74c9f30fb9d6e0bed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4847c89c7f45dd7b3a0cc61ea544ac35

SHA1
7a64c74e6c54df9cc63b8d124f26eaac15dc1e91

SHA256
ace3b5ec82c1a4a4685e212524f947439505244439a798a2e014ceaa20980d3f

SHA512
2804e0d629833821f8e0b7ff56544b425ed9b91028b4779343b22c3fa92d509372c9eebed8b4d8aba6273cece6122b0f3099db1598e4c3e43b0515497c7fbb43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe458ece7893723ca5eabd5af972a845

SHA1
32846bce7874c8e1fde3ffaba6a1705ec49f577c

SHA256
b769cf7b4680b881a2e9372a49ec153cf2a47093db7f1f2ab647cc12d93d93f2

SHA512
b65fb83ec0a742777ce5bf80baf99c84665198e853417f2a01a0671ecfc3193823f88717d73ed62ef09766e5712c2df7781baebd2d956803c9a95aaa6e68f33b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4229ccb14eafb82ded5ba7e78f61da8c

SHA1
b092a0149fed05b916ec6c03296efa8b4ad801c1

SHA256
d92eba0872777a725984318f3566bd0c4f2a36d8392143cc838350c4e2c13d07

SHA512
4a8d8f844bff02daee713135e53de15632c67422a538b5ce3ca889744feadbea937dee86a1c83b8c4689887eca8fe9d82805a3812577a9c761a63d891dcce626

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F46.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1FB6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit