d7eb7cb711adf3bdea48c35455a7ac74a558268e18f792e203a42157c8c032b2

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a10615161b7c08e75ef396b1a6be7f31_JaffaCakes118.html
Size

23KB
MD5

a10615161b7c08e75ef396b1a6be7f31
SHA1

f94997a455cc7078a3004fbbc2ebfe97519e81d0
SHA256

d7eb7cb711adf3bdea48c35455a7ac74a558268e18f792e203a42157c8c032b2
SHA512

2696e1d26dab2dc420fb4d76b57459c446f61a8647d144d4cc311efb3c03de16fa66b30887a7a014ee103c92195727c9d4283dbfec8fc808e3544646e8941a48
SSDEEP

192:uW7Ub5ny9MenQjxn5Q/EnQie/NnSnQOkEnt8+nQTbnFnQ1CnQtHwMBfqnYnQ7tnk:OQ/KL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD829F51-28C9-11EF-9680-DA96D1126947} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424365135"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2604	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2604	iexplore.exe
2604	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2560	2604	iexplore.exe	28
PID 2604 wrote to memory of 2560	2604	iexplore.exe	28
PID 2604 wrote to memory of 2560	2604	iexplore.exe	28
PID 2604 wrote to memory of 2560	2604	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a10615161b7c08e75ef396b1a6be7f31_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1ffa9f39688d84f8d4977ce7e3bb8a0

SHA1
abf9dbf468edacd94596a1eb80f39b0399f72ed4

SHA256
61a1a9191f54f1f40558d425a7b19ab72059a9d90f7aaac0d0027c5c3f4c6608

SHA512
563fcbcad8082d7184943692fc937eb37e8f87ae127114d3eebae9cec5b6a8a7cebb314de4f079af53dcd6a1870bd48c24cfd2ecef5c57b1e66ab364b5e29fde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fcb8ea94518741ab709954628e2270e

SHA1
2c0d9146995536b6f4e0048f93863cd74eadc5a1

SHA256
75fb990905bc3aed1f5b6d25ebb418edceebcf6e33f081aad1df8376af1e6468

SHA512
08eb513736a942e144f3ae23aae71148983c0e3f8c961aa783d33c546e844a642ded947745cb7a568481c08a192ee222aae549da1030a4ca69e8d5b8fccf308b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23da6c8716ad824002e744805cdf1e0f

SHA1
6c4375dac64bd64459e428d405ee8ec7271d29f3

SHA256
aa30a3358e1430cefd0be169b0e9fa9aed1fee9c984fe6533ef2fd7680f17057

SHA512
532c93f8164152acd9c3505fc06e21e80b9bd072ecc7bf980dce1bba6088f50fe6ba2075b56acbedf8764927dcefffd4d0a9736824d03bb6d9a68c95ae96f5b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
569d500fb49f412f2135db60f483935e

SHA1
b907cdafa544df355f1ae09cbce04d2c41143bc2

SHA256
d7d987d6090b257213a096e2f6fa126d22573292aecb8a75f6c2d9ab77fd1a69

SHA512
e2c74544b718e5fbeaf1224d1873c392b8ec6f34802b09bd5438bd1f17ac531589dfbea1f162fa54d96dbc6218f14fa0f3dc6f2b5666cf94e6512f7d1ef8fad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51f6d25fdb19e3c70b82da09790129f8

SHA1
0ce8f0d639c57e43b1d84d2385603947ff2cb835

SHA256
bde1f96e69ff42a1cdaeaa60fe8de9e4921930aaaa853691fc6961e7ec51f6e4

SHA512
1816198b1c33abccd02e09c44e52e07e745a76d8295bc9532758848aadafbeab8a2b15fe697c4ba62db04b2821c2048de9821345f699b0adb7a1194c68d2b86f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9d81dffec2772fd1f7752663c63cc4d

SHA1
d47976bd2a5a0350ae4cebb597167e702d0d5b27

SHA256
d09c8db08fdb8e5b6dd8649df34f6866f7e495fbb6e1d45194e65cf6478a8169

SHA512
a7739a6029a35aa18123ee40cc1134a4fb8c0576b26379d633b452b3e0dcb6337b278945f6ddb4e8f4b987f3e5a637d28fc0bd6ed305381fb1887f178c572d11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d649d94db243d0c6c0515ec29bc7451

SHA1
afcf5f7cbef56c37d75a83c086f3ee37c7ea344f

SHA256
30b276b07f0ad15b3bfdc957cdf0ab5e4435c7c8b85fce1f5d2630add9fe8576

SHA512
b9a62d536819a5aa364ad1905bd05a13eb94b696140d8c3337cfc6322308493ba5406f2dc5dc63ffb67bfaac6399e950675b4780fd7b51fef9fe500f6bae07e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa72b05343ec0ed17639d4a6f1d0904d

SHA1
3f8c3fa5f245250b33b106baadeec6b05af72a7a

SHA256
a5ab760d589bccdbe73c114af4629eecc7f9f92ab5403aa134db5c0cfc1ab51f

SHA512
1018832f4c46bc85824f4d8fe0deec2e4adf1a067656d8ff977a876183e8e6eec1c76e7d339c3d0ee16398ef152fea0b157a51bf16998e5d10fa9bba98ee5572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d01d0b4be43413cc9fce71aed35e3b6

SHA1
fb25b9a79b2dcd9c1c6556502a73d417c6c41870

SHA256
243fbb128477c94e7754eff23e55659490c8a390a2c8486d487257c9e9ac61d5

SHA512
31a666ea04d29431f68806f03f01262b0b3d5b8b8ddb650274414dbc97d7317acd800bf0cea028da6d48e79fd03a77ae0eca81cf7009c1ef6f56cbe0b0463b49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2731.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2823.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit