1723281592a62f3ecc1d5b494da1ae2916db53960e399ddde525a7fb7d15b36b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

704a4e14b8231722bc4280f4784b3a3f_JaffaCakes118.html
Size

26KB
MD5

704a4e14b8231722bc4280f4784b3a3f
SHA1

334431bec6846265caeecb3110afbfbbac997d22
SHA256

1723281592a62f3ecc1d5b494da1ae2916db53960e399ddde525a7fb7d15b36b
SHA512

18a150a4fb08532191f9c9a25b5dd8ab41e13d9ce543b1d8d71991130c4b64a7d3ae3960a6258ab72311567e09ee4dd4deea4e7ba21a3c300445837b8cbb39cf
SSDEEP

192:uq6f7Ab5n+2nQjxn5Q/dnQieYNnNnQOkEnt7jnQTbnxnQiCJVevo7NtDFo+NzQ4v:nQQ/AygcYKCDO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422758813"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CAFE61B1-1A2D-11EF-906B-FA9381F5F0AB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1796	iexplore.exe
1796	iexplore.exe
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2252	1796	iexplore.exe	28
PID 1796 wrote to memory of 2252	1796	iexplore.exe	28
PID 1796 wrote to memory of 2252	1796	iexplore.exe	28
PID 1796 wrote to memory of 2252	1796	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\704a4e14b8231722bc4280f4784b3a3f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0351d2ed144e54324894544314c97680

SHA1
0f007599a5ecca54b0e3d40931d69a91a8161f12

SHA256
29dfdb398d60bf03d29a57d47fcd44a02610b9677319f0a66ac594204ec26b05

SHA512
3b6fea3822e868a00e97cd12fe2d18cc896d3625af216d3c096bf4567f0442282ebb29b0209e3804380455b626f47443a00ddc89b096397688e4e533cd4186b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bd26f2873b5372944d8c23285d3b399

SHA1
ea293a1caaf4641e7008c2c4a14af71081ddf29c

SHA256
bfdcf0a405bb1520b87b670fe820dfe5c1c6f6d4afce336d9ea45c47eb2fe0f9

SHA512
98280c98a00033125ba2a173053b4f2f15321f14f2a64b7feaa8c33c3e8745d2e0fb5b034584104e051daa2efc68df6702011c22de42d16739c67054a7c49465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5c0656d197a396c775422e9d5b98c79

SHA1
a9f4b640f2982b61246a7af9690ce65fa397ced6

SHA256
ca3d714a2e2c3880867aec5a1e1b80126d85f6807dde20d5320189eec5de9b42

SHA512
67938344e06bb360892c89f3e8f1a1d9ca7582a6466a2b571a3066e59fa1e8de96ea25dbce97987d4c00d2bf4e2ce7c6c8f3a28b38947c2dbaaf54b0e5fe012f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f10d10553ba6ac173248389e99ae72a9

SHA1
6eec876810492b4f58402c3905da6c29d4d0c3ec

SHA256
43ba972306fb9f91a6e5ee6b6713eec6dfb5e63428b54095018893f859c4452c

SHA512
cf4002cb8ec486c54685dc8a786e13abe8ed7c9d1c00000a8a3550ff079ba9e29d501978295bdf4dc650e08262f17be3d4f703d73a42b291a8f3f82395cae5a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9fd0a2478d7be084d94e615f2492714

SHA1
b2fad886f350bf18e939400043bf72d21c28ea00

SHA256
423bde87a697b7f7ed6aceae3c728c977a7ead936138770db9bb94fac7526e68

SHA512
14c994081db4f5458029e2203b8f9528e4cbb53eccdf49c9ad48ea3d201ed58a129236e5c48100d84511a7e1eb59627ca36940ed883f61fd4e0d5611e99d2b5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3db45ffc65467eb776e44f3eb61acc6

SHA1
c87203430225a2a688931f636da226a8da71f99a

SHA256
253181a4519ef3fc697a30713e7affdf9547c548cbebba2092519d73c900a837

SHA512
cf9073f0cdeac3fbfceb709aabe489508ce7331128609b16e18dec55c5cf9b6dc2d603a388ac6a53580bb66ca78b0b2524dcf744e8852b8c233139b632513329

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f7c956670d0f95f644ab1f77bd7acee

SHA1
8ea116bf047cc6cc18c51d875d070fcf8141ee1a

SHA256
9bd2462992b7bb0fc1d5907d2a2fae0679eb7306b568fde9f51892d70ece5b31

SHA512
7227b5060fd93a1d1217d6da7fd2e25daf315ac92827ac060cf6437f40a1d5828f258f184bf7016e686f150cd7adc3d6dfb56f2709cb500fd3360946e2b3003e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dab290497f40bc2f70625dd253f715f

SHA1
4b3f2c62154e18f3522f239c48d27e2509d90b3e

SHA256
7dcdb2533a96aa86182b06be6df3f7c27aaf8e845622c30340e8641e6343fe09

SHA512
b10a3d4e8a09e03c40ee5b986551126184a3968ecb4abd5858246dc48255f250e8f22f90856bac643f73054b1e16946333b9d6dc42a3608f6e539a3ffb62f1d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2cf4e85dda6d6575a7e69d66858bc61

SHA1
61255a34b4456321fd4b94320bbd1c16953df5ab

SHA256
9c671575c08797522a11c60e7b39cf2c3fac89d6b6d799894b9421029431d617

SHA512
132db98f27846690b175d276825d09b030d495b1694eda5389fe3483e9b74f1c7e3c9e41c354d99f44bb8b7f59835aa69943d71fc8b30baedc718088bd5441f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab20DB.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar213C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit