07caee9960817ad952572b28e55995bec0b5639d56b9c318a9a37641fa111de1

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2f134713668ee868145fbbe1c1a4d72_JaffaCakes118.html
Size

34KB
MD5

a2f134713668ee868145fbbe1c1a4d72
SHA1

0bf0ffdaea385889147a7c576ee105c56924067f
SHA256

07caee9960817ad952572b28e55995bec0b5639d56b9c318a9a37641fa111de1
SHA512

585f44cfc4c83f1ca0e9141e9f64ba477ed64ad7d4df89f51dce579f03a30fa267f3ff2a4b61755997f62c9384851a23161b060ef96e809b8ae7959f71b9c7b9
SSDEEP

192:uwLib5nSOnQjxn5Q/FnQieYNnCnQOkEnt/bnQTbnxnQOgBcwqYIcwqYIcwqYQGQD:RQ/ptca5GQUb0unJtPK3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F9934371-2913-11EF-AA16-D671A15513D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424396992"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2576	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2576	iexplore.exe
2576	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 3060	2576	iexplore.exe	28
PID 2576 wrote to memory of 3060	2576	iexplore.exe	28
PID 2576 wrote to memory of 3060	2576	iexplore.exe	28
PID 2576 wrote to memory of 3060	2576	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2f134713668ee868145fbbe1c1a4d72_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2576 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
033f49f3419eb9a86764d4cc975200ae

SHA1
a86ff12d6aa2f29d5acfad458be8ae779bee4050

SHA256
a37219790aceaaf302e2da74d5409137932593415c08fa7480dc11f729602760

SHA512
1753ea66913d4a838eef224182bc738bd24fccf4ed928788c390d47b076ed321a7444e5e04f037e5a3856ff9fc9cb8807b7b6943467f32e58469974b58cfb480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7edeabb4a370bfb9c8ad0afc7c1ee73

SHA1
0881721eaac3e8a856605b46eb16d6e7b12f6b36

SHA256
7dd46edf9ef13f7e9a42ed1329a8b4c2597d70513455eeee3580d7ad9e39796a

SHA512
06533b44e5e36c3225963b6695120719c10d258516605767a5ab1ca0a14f6677d26b84040f1f8ce24cb356752f0f1ab17480193f897e7a52fda96b59d327a5d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c790391bbe6a6b1a49397067c0551f1c

SHA1
1dfb855ead68e6097483c2090e1d542dcaf73238

SHA256
ecb2bcfcbe704d5a3a3fb6a912ab4464f9d6b83674c7cfe8dd0863ac74ac9399

SHA512
1c433082fd36a09d51fe994d81fb413fcc8a64c7da1cf9b556e4f21684d842966ba64b7351ca28ba8602a18627e7eedd13410499aa6dd3609489c76c001d8222

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
def9f435409cec55da550b8b77731e65

SHA1
3fc09da39a0588d89bd18c3d076a6117841ea721

SHA256
0e162d38047a12b80360d85adb6057673ec6c7befcd22c4824a43ea40a4e7f21

SHA512
d9dff011e8948b8d88f301767e274e17d730697786da001349048d6bb811f3a89da36eeac831fe6e13538a30d62e567bf3431fb0e34582dc408f1d47a3fff2f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bed224ead5087e0413b91ad2b41c6de

SHA1
f3a50158266b745eb7ff63913697a4cf20b92f02

SHA256
d4f45d82c631cb5a498c7da0bbfafb783f6018c4989b2c3fed14b9b0da571851

SHA512
44c7902490d22e718ca3e329368c0fa12e234bc00517221a83e6c02e5af2397af72303b87a096b8743a28416b30ce5aee9d3b04a367f2c67f11138f565f246bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b716c74b2dbde2fa13e870061fa23b8

SHA1
a143bc78d5e22ee64a7a1920a09fb3fcdf765c2d

SHA256
114a70d43223d3281182df3d246f6a70d2ce7d224bf3fbb9ff8cc9a616b8a48b

SHA512
c4d1028e6bbbe20bf2cbc9f1b6632a4110ce4317eb2191c170b934168efe8a29e723dcd6175c2cb80ba43844f9902a16005b63639b4921e3223323fbb2c67c46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
948d46296b7d5224457f7ea57ee8db9a

SHA1
a0c264c54833bbf284de03521232abaf63f1c954

SHA256
9cc25ea3f0a62e5fb757d38b53fa40c6969fc7c6679f6bca14e7c8cd41ae2085

SHA512
c393f793102149c29952a623b60d297b72a32077bed979adf2850eaec5e4923c9eb0c57c59fa4ca5a1678f78541f369d1d2ab0ac4f8f45a16c577251a76bb4a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4333150859e89090768f55b95e53df1

SHA1
7797a509a44386f1cb2eaf3ff3f25a49d5b8e5ee

SHA256
7c9c3c3042d3f1acfc4e04713fe7c5cdfb105396578665b59279784ddce9ed7c

SHA512
fc56a7f65d77a157deade3fdc609f8faedc2d65ccfe6bbd187b29d2823792d6e188ddd15bd0ed261a12dd3e9139697ea07ed94f0bedfb7c686ff05d9498628a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e77ad1bfb23360540248f454397dda4d

SHA1
b096262a5fa4bf7da271daad7d03f34a3e8261d0

SHA256
96b779fdb133ce7ea1b87381d5b939fdf28b7f2117c6bf01675750c5bde9b227

SHA512
497d3454a2a7f3efd087c0af57e1d710bcdef54186575862c949b4b5cdeecdb80f21e975f70b916741d099be16991790702ccf9c9458eae5d7410208a50792ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4590b9812808ea011b245848b3038fee

SHA1
77f02ca095d21ea7bf65fce261c834734d309ebc

SHA256
5018b1b51f1f2f1340c0db58fce8c83bc36dc6296df351c00ca9df20bdaa17b0

SHA512
ae669ce3e5093e45d8d1279d276020d2c39d3b313f0e8e2dface0d36f138131f10476d5c88e334e9bc1e22158c0ebecaf645c970d99fb17e4fb3041743b52f87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f551e52bd6406609d16bac724b236381

SHA1
2bbbcc67e8cabad14d454b25d53f379d01991993

SHA256
6e42d9297fd30c2d25ead30d33b86f6e857bbc1af95c0017189ecd55d6437ddd

SHA512
7f6d5909a5d0e20fec5d159cffe495f77a7c14420163f1127912c9404bcc4e105040fb77d545d34aa5d2eb72a4ab83e757d82284372aebc806b0d63dd542bcc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6E9B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6F5B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit