2a8c567d25dd16fcd2b21cd76b8707bb62cb132700487c570fea7a6ef527ce2d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8515610b392dbbd117fe0b3d6a6a29dd_JaffaCakes118.html
Size

30KB
MD5

8515610b392dbbd117fe0b3d6a6a29dd
SHA1

a9393b21c3d3a964a09d5fe6e937fe91128d25a7
SHA256

2a8c567d25dd16fcd2b21cd76b8707bb62cb132700487c570fea7a6ef527ce2d
SHA512

774a9fa2d10f5e796ff7aa2d5ca1632385e3faf3da96a0081e07b69b629a94a3688f90514be9e5c3d3e65e77043c632c8e6d85acb577ea7a734396b0cf6c4e6e
SSDEEP

192:uWL0b5nSNnQjxn5Q/FnQieINndnQOkEnt3jnQTbnxnQBMCUAnDn253gbiYxYJ/d9:iQ/Hi3Q9xYpyQ3ZbDuOT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423269119"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1A763E1-1ED1-11EF-B837-5AD7C7D11D06} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2872	1740	iexplore.exe	28
PID 1740 wrote to memory of 2872	1740	iexplore.exe	28
PID 1740 wrote to memory of 2872	1740	iexplore.exe	28
PID 1740 wrote to memory of 2872	1740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8515610b392dbbd117fe0b3d6a6a29dd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1003ea82e61e351dec7ce9eabee8a410

SHA1
983bd6fa9bc361b920c5ef375fc77364d2cb592f

SHA256
a188879f268a939adf2fab35af4822d64d87e2cc205d28e42d2ec4400395454a

SHA512
0ed91517c1c8563b8de5d2cba2e3aa514f0ef1e3ffc50d73a85b4926a69d96354eca87d18c068fa6e4528339dcbc93f49000f049f849c4d9956d11c2b08e622f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16b565f4bc24a0ad932957ab1c05b757

SHA1
3be918d8a82504ca9afc72dcb85587ecce0019ab

SHA256
97dff51e8bee801161883a685b59d7d43454d8c01031c955530076807acb5dad

SHA512
feb3a170545b44054ef70b21ea9687a419895386d6e9df15ee6365d0fe1adb019e564bd77c446e97f2b415daa7e7ae57e89d8ce69db9f74dd41ec597322199c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
134b02a50b5ba16946ca4ec76ca80a94

SHA1
a5c016e6e06e1854a7cd12184bd1459c16c0a1ec

SHA256
39d3dbdfdbd68b782ece506b43eb12829f412541a55ac6c6efac75c070228b4f

SHA512
57fb69f4540646f97c514d890fde706b0c3947cd66344db50eca9fb216c61e5902b2e05bd657a9315453e553737181c2eabc1085ed8669b37fad0c0985007072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
161023dc92a2e098136ea2eeb7bfa56f

SHA1
98ebd74856ee47f9156d9f0b719dc275e1f34bc5

SHA256
7cf72a12e7a624d0adc2143e711933f8404d5c259ff0def5ec8946c4e0f661c3

SHA512
b8cdce5c93fc84657522b2a5882986a2f2715d16e7b59a23007f838274fd6876520be65397c817cb47e6d58ee43be934572ba5a426d066fbdddfac1eed4e70be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8873c81b7c4bdf58f65888f86b032fe

SHA1
94cc3dda66c4a7c44d0efc7f22dc6ceb35bcc1c0

SHA256
e87aee00fb330518e9d504a44308b2cf4573644f036de703ed10a49c25d994c8

SHA512
c27e81672b01dea8440ce41648c2e59ff8da507d261eb284bfa9328945921b7593a38c3873e4b5517c67cd804739d3aec00656f79ebf31f201bd4e4184eaaef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d8a6b2a4ec59257efe912ec29256c43

SHA1
b4d4d5bbfd4fea5093303ad5de0070880cfea6c3

SHA256
94e2dc4a8476bf18f47c6e52b273e2154e304de0736b45db83b062f6176bc70e

SHA512
b7e9798fba68ed78b3f286620826a629bbe1babbfaa8d4ab98c5745d04818a5ab1f3ff33a264f70badf48038c12cbe23449360a7b30c53412a4919b16b85b77e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0af716ec9840f340c232310ce70f227b

SHA1
42e61574278913b342331d7c0b7277066b75b43e

SHA256
c31c5fce23295256aaea795dae95ad60e72f85e0384214c3c1b137ea4d8d813f

SHA512
ab9ece9e5766ff610287d497bc9bce7f365fd443021dcfcd3d6b638c30f7e143d31d2c40c37f4ee475d06fca9bc395cd0214cf33e35ee902da4517c45e053560

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8eeeaff02fe4b5ba0b9a20a088ad1aca

SHA1
7142c1f95781cfc0a3500929faef93d0d99e5b1a

SHA256
f26143f854f65a20213c51736292437e9b4f8fd9b59c5b217efb45a9e4154560

SHA512
b13385e478db48fe11c5edcab6e8635f2761f2fa29215f5430c2195942a36f1afcaf5646e3ef76994c30c94b7724243e246a0a6f4b0c167efa65c046a4b0f1d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab9d07748e820b600b72a96a4975b116

SHA1
88d0895462431c06098d8e2c05ad13564a4ef0ad

SHA256
2b480d4a6763489fd20481d3e8d770ec87b4291ebbdbfae18797d7b75e4d6f54

SHA512
0157e27497ec77a5f154d90dd7f36d75d3491ae380199df8e921acf4840c43e2159bc9a9fe399ce9076ab9aaa64df8e935092bfbdf7002dafe4337c47c5fd952

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCBF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD43.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit