2663d599cc03923a482027497178eff817bab942cc833d67a6a141019482a339

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a0094c699afbb0807acce52b391eef8d_JaffaCakes118.html
Size

64KB
MD5

a0094c699afbb0807acce52b391eef8d
SHA1

6dbae82897a0e0405d0484caae4d0b6ee411f5a2
SHA256

2663d599cc03923a482027497178eff817bab942cc833d67a6a141019482a339
SHA512

ee613e7689f3ff00c6f922e571ba4b7c790f9ee073993aa5c0106e4f9e87d7966aef408825f589f0da04b80daffde0751cc9bebf20341ab07bf4658db2944e6d
SSDEEP

384:HQ/sPPP+h4JlLDSpbiF1JvmP2DHIskDln+5udtaN7subADyfntwewX4cjfekgLw:f7LubiFPvmAeQD7ayfme5cfgk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424342885"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF801931-2895-11EF-85B1-6A83D32C515E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2728	iexplore.exe
2728	iexplore.exe
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 1216	2728	iexplore.exe	28
PID 2728 wrote to memory of 1216	2728	iexplore.exe	28
PID 2728 wrote to memory of 1216	2728	iexplore.exe	28
PID 2728 wrote to memory of 1216	2728	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a0094c699afbb0807acce52b391eef8d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a17220ee2df2b6f92f806e935e91787d

SHA1
29e8d83e35344bcba912cf2bc77b92cdf0e9063c

SHA256
7f8e1adc22916222cea7bdd5a69cd4b8ba20b8d7f12b27c03daa1f8525c551db

SHA512
e136aa75f9df6d982a40b20e60dcde0603c2aa4b7a11cd705051c4502a005dab2c215adffe4da39cdc7c0129707c2c0c6f4cdbb17442eaeb79109c1dd589d1e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc1d41557688bd35c263794d67e0b825

SHA1
0f0cc54df414d797f6dc8310ad0e458375f7e530

SHA256
114183c8785831b802336f6de435f83b25819e42e7f601cd57ab10c1d6e6a06c

SHA512
c14b0877f0e7de0b4a583cec56e98fe6d018eea6720a4d809bd78256cdf04443a0718eb664aff189de06b385defa33c9a943e4e2a6d86aa5dc66e77090ab2c5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7b01c19c706304b528bde02660781da

SHA1
cc0746baf0369a23fc063a10ca3c2d11b42ca962

SHA256
210f35d49f0eca628daff45fec9ffc719ac8c633e76b564a1925dc62435d4904

SHA512
b7d646d20a8ffcf099e174dd4dee1789ddcc4e5466fae3aa20c68d499303451ba017104ad926fc4eb98ee0542d0aaf14306ce7943eae0aca69ab74d79b73d47c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f13fc8cc7feb936ac97ebc3d13fee61d

SHA1
920efe447d366fd72edca7359ed2dab6a16d1fea

SHA256
1dde86bc3cf11e6d1e228a2a70bb42d54c8666aa11f97b242562936eb2ee12ea

SHA512
6ac53e8380b90817b08b43646c69db9ae7be1874bdc968e027a2cf818a4fc6fd758b3699cedebe0688e71797d775afa7f2cd31d4e1b09a731133d22edfedd774

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93b967a413409b63cfc2c74a40649462

SHA1
4413312c066e75cb70c74f99988250fc23160bb7

SHA256
1dfdf2117cbf73d500cd922c32890a488867ce96ce5f7626ee78de125e2523fd

SHA512
98785aadd13c75249ce59e70876ded672f2716e20111ed2059d46c489198d594b373200b4ef2541484815ca070e6cfb3d61f3f9f25589979796adfc0bd556962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf397f4f74dbae8f3d43ee55cd0f188d

SHA1
39981fa7282d6cc47659c200540250b0e77e3360

SHA256
0769ec837fe62d4ab56ad4e43c6b4de96b55bd40c45f783993da751097859745

SHA512
fbd7d0d460c8adc6883c07f542c84b87e5aea77fab2ef5123c2b087c0893473c1cac952a7924ff87d77517fb0fca571e932b211c88eea1785ee385c8c708c75e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06bb2376bb665c7cbe4a2e141458ba6d

SHA1
f2349720df321fd0f12496c35a032ec4acd81037

SHA256
ac64a5a604ee7be2527bf060f67a494e9b836adcd36a23b9c814b9fc86c6e630

SHA512
4b03e177b516bf7f2c6b425b1afddd458e86456cf9fd8a31a327c815312a03afab5784c67010a37a9dec521db4acceb0fc38572359097a6baf1ab42dc96e446e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d73b92a29b96c8ac57f4302251cb5fd

SHA1
5802152510901f99c0bea94ef6e2f2049ab3254f

SHA256
2acfef8135a3221c1a1d4a3d558d6f1569e942c6b64e4a1073007a4fc9572df8

SHA512
1584f95255e79c7b532a24c2ff75cd73bd279d94d1c0e434aa06be96ba7dc2bbc212ac7a5d7f41891d01d6380397e050eb95d58fb64d63439273bd173fc76b64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
143975bba380d783deed4677f443312d

SHA1
f350845b2abe66f091773cfa71f1314bca9264c8

SHA256
e39d3739903481496031d5d9a8597bc5ba280efba128b0eaec93493131b35595

SHA512
11156e0dfca690c796bf0e6b8a6080efddf7f4cd5fb22eef848292cd50c54a79575802b10c1706dd46b3ed5a70b7a4b498564dce03d3ba4f87a13fc50e6638b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2BD3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CC4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit