2a00ca356690fb22bb440a7219acd0d7fe0b5273128b19c4d1a21cca8333c26a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

788a9ef9bba2a5ba15f4bae3bec898d0_JaffaCakes118.html
Size

105KB
MD5

788a9ef9bba2a5ba15f4bae3bec898d0
SHA1

87c38eea69c8ea870c6255bd601dd4e13692881b
SHA256

2a00ca356690fb22bb440a7219acd0d7fe0b5273128b19c4d1a21cca8333c26a
SHA512

51825e8a65e595f4e1fd446849e3b5391e62f0624985d5bdb5ce917008cac57b8f2bab8aaf1ebd16f9a302ba225af6552c08a6aef491dbf6cb3e5bd301a652d5
SSDEEP

1536:LQ0gTteplAKlTE0S2VWhXyg9w/GFRExIuTXow7KHCBSZqlmmEWmUMkT:WTspTl8yy/HYMkT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C3C9FB1-1C04-11EF-B195-DEECE6B0C1A4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422960946"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
620	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
620	iexplore.exe
620	iexplore.exe
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1964	620	iexplore.exe	28
PID 620 wrote to memory of 1964	620	iexplore.exe	28
PID 620 wrote to memory of 1964	620	iexplore.exe	28
PID 620 wrote to memory of 1964	620	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\788a9ef9bba2a5ba15f4bae3bec898d0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:620 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86ebd818134688124db64c15f02d79ca

SHA1
1593a8c8accb694c3652fc5e681894f961bb9890

SHA256
639883fca83f70db6c80a743270f5d9f0711236b0f64cf2b22805874d67413d8

SHA512
6c4b4de274a295a232db11c7cb2dcf717c8ea80bab1ba7d65aa44e9f952b7c07497d0aba7d24fb79d2039d8f934183f1c3a53e9f022c893d7663cb162fcb3436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8381c5b6c15602a9888f65808b8d83ac

SHA1
d702c6553e2e92cf367615aab151ed047ec69886

SHA256
2a10b2754b69fe7a27090af92a4d20d5ded33aeaa16d077ed1ee4e0d7e4bea60

SHA512
359db61912c4d2c698efc53f2c707031c993de66ceec6f1583ae94060be92f484baddbf86350e2141574d331757d0bed2297b3fee15dc214629e01f1c1e1b2d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f615d3fbf3c2a2a5014b4dd2e810fbb5

SHA1
1ec37670dc4704f29f9d24e02f1deda40a5b64b5

SHA256
d393a5e99ca7d3b945136d88ebbf9de82bc7caf467c3b9edb7c79b540a625ad2

SHA512
339cc1192d2d77b219cd79003544db6f1bf3c299debf510cbe3913b32bb6a8f8f42f9b61496ce5eb27af36b730b2e05f2300e0c8e5b784dc77615a3dfa08dda5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2856a67dadef7335546dc6b6c8cd4aaf

SHA1
3851193e7a92ead855f0d4ff2c1f1f720b783055

SHA256
a082a254746d0f481198e3cfe80f342f3f128b1b215f48a8b2e56547c6a6bbc0

SHA512
254969e42cea5b86abc70848a53483e7dfddc497db65a7c56d596e583c6940286493448338a969f971863df288be2bf52972f913dcc0043ce4e1b234444d07aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e12a8f7af64523fe9b2accc6d3485d07

SHA1
ef2012311cf6177601be04d52224e68cb1d8042e

SHA256
98810b290f9309bb596696215d5022fca306d11eb7752d02dde76c2adfd6c47b

SHA512
c824ab7f551a319b89a28a70f5cc1a5e99e79cf28d58274f9f6aea6d05b3f44d94194b1cf4e423545f7210490caf6514d63fa6e886d4e5ed2ab1d3ea18af2afe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55aefd197daa1667c2ff6f282f82975e

SHA1
f6eafb87a9a794a15576429ee8cd05da611edc76

SHA256
2e3000ae97e880d3a9f6972bce67390c28800543dbd094534e5bcd160b6a216b

SHA512
da626350f1a040d438f484e3de885feb03a311b7b25dbad229fc24874b678b2bdd995592258d175ec5701e76a29bc726c3c2f81381e48278407da408ba4ab1e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee89df438093d0d6c9f6ad5e98a020af

SHA1
cea0721008fc581ab4aeef3ac2ca49d52d37e634

SHA256
4ac213631850e5cd09a50259cc0cfe39481a573e0b62957de0e296285df1e04f

SHA512
9733e7920d0c2161c8f3a0f66223a93aef5469c22ec4db507af7322ada10f5fc566db7d4a5e8b1aed6f592bcd58a891ac710d1bbb1c152bc7ac35a41a6745f46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccf2d09c6aadb680c799d864de909901

SHA1
afee96be3ecd93bec85de4d998b034d6ea0fb7ed

SHA256
1561bec982b1d47cf39282dffbafd7e8ea3d435c11a9042d2c77b4a8c216f0f7

SHA512
541476aaaa284225b587c06df7c24d83ae1d2e37470c1d094911630f0df543b94b3f54eb30d2ec264ce976c482bf5ce6d98335074c494536ef8bf0f6183f690c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d531893d5fc5b76e681b83c40331253a

SHA1
41e530c9ae09f1466a416df15d6a4a8df91fce42

SHA256
11aea5dbc800e1535297a1b7658effa946298fe98f45eb37ee59c2723dbf9b8e

SHA512
e006f49c91189e219f466d9316b31681804a59b1d668f2ff1e73717c43ad82a52445174be6d42a116f97522a30c7d3ee39235f81bd325d060557ef1f76d50d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22AF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar231F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit