c3a6b01d08df278a0ff7b56461c673badde5949d0838ca3b09c90e3f9e669651

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

784b33a39e45113dc5fc4d631897430a_JaffaCakes118.html
Size

23KB
MD5

784b33a39e45113dc5fc4d631897430a
SHA1

99f529389df670bbb1d491bf8ce274713d61f020
SHA256

c3a6b01d08df278a0ff7b56461c673badde5949d0838ca3b09c90e3f9e669651
SHA512

0bab95dc4806f06005cb765c8059e5d5e3c24866970acc86967d11b2383f530de7547076c3fdf76ea41d559fb33fb439572f269b44e3db34c7f57c720380044e
SSDEEP

192:uWrob5ndavknQjxn5Q/xnQieENnG/nQOkEntTfnQTbn5nQiCnQt+wMBkqnYnQ7tf:1Q/ARf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC4CE7C1-1BF7-11EF-805B-F637117826CF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422955471"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2436	iexplore.exe
2436	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2348	2436	iexplore.exe	28
PID 2436 wrote to memory of 2348	2436	iexplore.exe	28
PID 2436 wrote to memory of 2348	2436	iexplore.exe	28
PID 2436 wrote to memory of 2348	2436	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\784b33a39e45113dc5fc4d631897430a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91336ee19a8a0012644fd26e37464146

SHA1
168ec8547e3027aa3e5a3ed27611b7e19a7ae854

SHA256
47ac15e78213f81dc73b523a0fc96e1bc7b41572db8adb7b7d5fabe81ff96870

SHA512
e115b6d013bc024ed37c81208938838ab33d9301cc423976703659da2801d20f9dfd21cf11f940d59009e892303517364cf9b185628c1cef53b878677cd8dc45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc9a424a9f1779478dcb2cf370964913

SHA1
32159bd9c2b5a0b10a4bc6492f51da9743e98600

SHA256
da909a84e70aafe518169c4f470eaebcfd2ae23549ad0e75bec5fbd52cfb2e3d

SHA512
9f8d52c2f0da212631287a0fac924b13cc9a1acd075d07f1f5817999cc1b00e1247aabfb1a31725f016e8dd7dd43f0b2570a5f40c13089ba1cf77dee1a199d86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d7b10891d62b4eb87ebe1bc951b5746

SHA1
356acea6b26e2dc788e22d84d0a9c719bb69bae0

SHA256
e2dd4b34d109f2b4bf6219d66f61c0aab2c8d0e4186b224b3ba478d2ce4039ad

SHA512
ed9292286360226d86ed036ec3a4768970db8e93181580b2f9126df67e021d499f21d1a415bb4ffcab9eac650f0a8affc9827de979cc26efd433d8d3e5ef1e32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e2f8163848ac6a53645c0a9313df83e

SHA1
2eea53a8e03661ba22df125bb3a6da3578065353

SHA256
7f27c7dc010b9d24a74e7c9b9be5749cdc0cbe90cffb2dabf7a59b87065e7835

SHA512
27b10ca4b6d0c4ef2cc8094f72e562e2653538cea2e9c5364294dd561d1e30f98412127ad0617d8f3e23359983cb07503f9cd801bcaf77c0093b4fc96b7b821d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42deed4adbaeb355cee3d808a6b4594d

SHA1
386e19435bfdc8602c853057ff6425df61bdf241

SHA256
e75617dd95d4f3176df878531dfadb89e0c3288cdd4a6950baaa18083597e0a7

SHA512
a40d8fb0af5abfc32e1aafb03d2c4001b261d1de948427afa878d986369f8fe1b2aaf1238993f739a19857f5fab94070570243e3fb726959c360d6e1a4b15dad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99fbd0a2453ab8c24d635ed584732ae0

SHA1
85b2b7c24d06d0f58048d74fcb88b8ac668a5aa3

SHA256
180f0f59442d52f4614ff7cbe9dd3b01cb95a4ac1e1be6eb7808419659f30117

SHA512
59c9f38e094a452a36ad5979b603b6b1b66004237b435816edbedd9c04ef6e4724d86fcf6c489ad3df8267bf224b9f06617922d816728d6eca1beaefd2cee268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea1dc73bb0e985ac9139251ca2b4f72c

SHA1
ccebff3973af4aebb5806d4026ef0e20027a2876

SHA256
c1d215ef32342e57e484199e19d73f735721e25b8183f234047a4c3c62d119d2

SHA512
e035ca40aa960bff92b86dc105f0699eda75381ca8e2ee53f15f1495a6b56123a11770561e67b44443b18c20a8917309b78bbc101c9405f1226cd8f8efc86e6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c24cc08cec1859357eb35d0f2ff1f6c

SHA1
8caa44f216861960991988b0e6bd15649cce169a

SHA256
30783a96e0bf61acd0d5ba14e44ed1f5af38381841b3787e09ed36ddb2d8d5b7

SHA512
202a3a1b60111a79917c4be9b913804cc8752805dbcf8e38b3290a04b94c8efd26cc473da97e34a6186d66b6ff370eb0d04bfb843ce68f43d729f5babf9ef038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14e731f0ad1786ffc04b14584c49f351

SHA1
d48d253c986d19328e323bda34befcaee2ba2827

SHA256
7251ab75a79bd55b0a17050d695b7fee0e2d6850574b56e602c56b09cf2ce3ff

SHA512
2acc560e073f1abbe5aa3bd731e6c66e15a31cfdfb1d067830d65b7fb4e11345692a0b104345a2dec64fbf95328a4ba14ae04315a261cee1df16677651048fea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11ED.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar126D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit