5bec7d50f0786d2100fd9a234768cc1450a797e0637e46b52c9b3b6c3cb3c156

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 10:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a06193124e95337f2946429d8ef4cf3f_JaffaCakes118.html
Size

29KB
MD5

a06193124e95337f2946429d8ef4cf3f
SHA1

b78bff6e160fec0d7e1049c42fe43130a7bf78d7
SHA256

5bec7d50f0786d2100fd9a234768cc1450a797e0637e46b52c9b3b6c3cb3c156
SHA512

d1fde6c4bab7e19245082d052c364317e32dc07aaaa9d62530ac37e1dfd1ce6ec517d4d0c4c84fe092757189e94a1e97bce6431269aa6ac99e0fa6aa4fd764b1
SSDEEP

768:3suF1nsyNH+ZYG48XueLUJF+3+66FPc5OrY5de+FF8RhN4u2:al

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{37D55A81-28A9-11EF-970D-EE42DE2196AB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424351140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1720	2004	iexplore.exe	28
PID 2004 wrote to memory of 1720	2004	iexplore.exe	28
PID 2004 wrote to memory of 1720	2004	iexplore.exe	28
PID 2004 wrote to memory of 1720	2004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a06193124e95337f2946429d8ef4cf3f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07f46a3e43e0149d52dab619dec001c2

SHA1
72d9eae2a555c7ff3e254b8b87e2712d3119554d

SHA256
3ae72dbd3a5e7c89b145a730d8a170c88c1116ce848d61fb9f8c14cc24c6172a

SHA512
809401efdf2bdaaf82595510b37e29aaee05085b3a8e711777e98467408c9040c5c8a58811ac8520d000f50ebdc41d9cc57242764b16d690a4caeb9878d56144

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd926ffbcb9475fbcd9c92a2d95e7898

SHA1
eed3730305cce73664eb814a3ebae0e3038c6ab9

SHA256
faba91d0aa2ed4dfea5364442d6122f043030ed2b60d843e7cdcf6f9cb055e1b

SHA512
271de944c11f2c5ee038d56fa0fbf01715cabb49140d078404497a1f33ac28da05ddf54c74983acae5eab5094810ee68e5b03275c368cecfb8511fd9359eb157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d1050431d9b03ec935882e6b932a392

SHA1
e4b2cc3887a9e0f0515218945c87872dc1e3535d

SHA256
3a8415637215543259542f7ef36d893956127e7400ebc55b99fb829a84447e01

SHA512
10f30e0eaa1c7a901eb47a9d1f742ebb69ae11e64594d6b736c7589a235e2a157fe1e7268b11a9fca854ff1b558dcda63d4226b5ed38b638dec04efd55a49c06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4820cf12610ce5a85fca0fa3e994f9ac

SHA1
6406663b45f0a3e7d5c5750e5c2e59e31aa6eeaa

SHA256
a1ea0bddd435368d3a0beee5ff9846f95caa4b1c823058a0f98f046248f65c09

SHA512
2b3955a4862fe9f33dca1391ebc3238223c1b2cc8628e427b49d6498c767243aec3c3c02d619124823dd33f827652b04c6b0db496d9513d7fb422fadce35d420

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
610eb07b995d4e56ef211d8ba174f9ad

SHA1
5feba9a07ab78a300f1d35087e2c055acac79960

SHA256
23ae139b250d28356be496420dd6706349e18f62da6827e1fa45374a1d4c264f

SHA512
2d06d16afe50ac844f6da209e751ba0bfd5c9387b4a4d60bdfa63c0ce64c4ff65fb5c13cf65b1544a8016894b5f61c8b7d42cc2addc8738255f077fe1b6e9c9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e728a2b6debfa632b7a84d9339e5a7e

SHA1
acfca3082f0357953e5f8cc035f161f44dc0e868

SHA256
285a526a3eb2c1bed60d6320cb4371e7598518db5973d9c77cb14935ec35b8e7

SHA512
7781977896a3accbf02fb9b11bd184e65017c660467095a4744a0c16cf5204aaa630a9a7794a112f0754608eb75cf7c941460120541c3a61b610d3c5145f7238

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdb058cbcf0c741f135569d44d922e77

SHA1
597c502c972227dc29e9b41f62e152ce831ae3cc

SHA256
0862874de3366553046fe1a593f77fe56d2548f50b6c4743b9d5d3329295d6b5

SHA512
922736d30a65aa0bc8c1d34ae3d9723c48b9a0b8f3e5f451fcee7d09559c3c93fa6ab4e190ef738c132d4af85e63e450292a0608867bd3c8e47cfcb4be4f458d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f80504fb34d39c9881bce6b75cc9fa46

SHA1
5a7db40b8c5432d2dae186db8f757787c344107c

SHA256
6194532155fbe98d220524ab31f66b84c0d90e45ad095e993266eae06f2d9b5e

SHA512
6cd60094e9d3293ce8f5c7dc46befe99bd94a21d60d0248316456cee35bdf5c5fcea7b20480eb275962e6e4d8f216687e3de344321b1f28d75a3b9c6cc6a7608

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7DD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit