a123e10ae2be81dd6e3b574b4b116e31e99539ed4d8866dbb59f8d18fb2dade5

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0ff4b5645254977fe57f3fed48d8180_JaffaCakes118.html
Size

23KB
MD5

a0ff4b5645254977fe57f3fed48d8180
SHA1

852a85a65e58ab2f406620d76d76b066255375cf
SHA256

a123e10ae2be81dd6e3b574b4b116e31e99539ed4d8866dbb59f8d18fb2dade5
SHA512

84af7a155117162821c800c8ec90884789b37beb6836b73ea32647c648bb7a2e6262c4605a800215d785bc8db0081e0f43ad79d03139310a09161b4e6c81bc51
SSDEEP

384:hZtqUvSSrLHttJrlQwp7x9Q/K6Tu0KMfvgLuOZ9u9M2dFKTSEYf:O

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424364463"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3CF59B51-28C8-11EF-8A7C-66DD11CD6629} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1904	iexplore.exe
1904	iexplore.exe
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2868	1904	iexplore.exe	28
PID 1904 wrote to memory of 2868	1904	iexplore.exe	28
PID 1904 wrote to memory of 2868	1904	iexplore.exe	28
PID 1904 wrote to memory of 2868	1904	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a0ff4b5645254977fe57f3fed48d8180_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1904 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3e1d96d826c93d616c8a018e0b6d87a4

SHA1
bb9702a75aed0e581ed457319f225a73c962259e

SHA256
41510e4963932ae3046e27db690a143bfa3f40e95c764852a5c5fdedb8b82cef

SHA512
a8051e996e4a4866366e2d408bdcaf96611bb7caaed2f329e20b4de93f48730aafffa7f138a10aa63934fd16f5e14cd7b39ec7ad2a23cdecc08660c666abd1a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7bc7cbcacd338baa6d853831477bd7d5

SHA1
13289169bd0ccbcae3e507bce46f8dbbd41aa8dc

SHA256
eeb51fc0343e8273afa48d09489d35e58dbf135c73484153a734514ea8cc2055

SHA512
481a8bf6a5b012d90937a5b450ab1ba42c8ad9dde63f1818bad58f653f092c16c1796f59bd919c6eb3af58b858d24bbe6a1782fd3599a3123c550acd0d9a5e02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6fc3759d1d702b44db11944fd08c6c3f

SHA1
23d49c0dc200a38c253070811abb00023d695988

SHA256
2222b35a1dbb86952c4807aef6e84b02b04206ae4632ba5ecf3bcc1970de0f05

SHA512
5e539a3f83b97818ef6c5353ae9c7ab3b55353c9858a0c97bc79e70752416ead44039dfbe16c03b5613ae5f23cefad18457aa987feebcfcef24f7de29ddee237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
36ada1a764c93a7a775ca591c952c60d

SHA1
0014f49287d2d88d24b8aaf605cffb5fc1f220e5

SHA256
e3752485fe60fa0735ceecdbbc7cacb6aef9c5bb570573337bc5a4a16518df20

SHA512
8fe4c9f9af85535eb8cb7e6a75e94560381c2fdf18dbb2aae10cd247a743cfa2a1191c7ee5055b39a16fc961f53dc8dc1b02722a49eb0eaa25507796980a5a6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
546b0c8245edad7b9c834e03492ff79c

SHA1
c24c8d0c035d16aa0bdec6811a24ebdc9e856ef9

SHA256
668515b9706176e1579814300f4508b1659c8d42d4d1ae7cf0ed376bccc965f8

SHA512
60ff9dbc4f5ae24fe060961bef566d4aba62ca2568686515343354a20d4b9dc9e09689f1aecb49552a8eb38e87ec2172081db9f8383edcc1b6cb46424698edc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c2dc930387534ccc5bbcfa5ada4ace46

SHA1
062142240618ad28531b46d790f2dee131ebebba

SHA256
2ba1759b8c33b31840349a07e8b8d1571fbdae883f93a95b137d35c97d9b3653

SHA512
01c9b7ec0ff269c03ff4134a5b0a10f6ff4c385c465bdc691691e242f5134b2630ebd936f5c664d7117cdf1925141790ecc3bde6406e72209b94915f7e9a3914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4ba6be4d07d18c6c2f83756b5960e3f3

SHA1
58cec222e60992496bcf7ff34335930e9088c10f

SHA256
d0d2d6eed187fd88534d338826be3c1f8e8c28e8b200400f06163e97d20808f1

SHA512
a499fbed829b21c19081ad529a8217b29787b8ef27f638f6a60869a20289acf0f775e5ba2d105eee31ed077f20f6024be270b4844be9e15068a981035506c04f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
867bb45ac6c0d946947ebcc15bc6e010

SHA1
3bd4759ae9ff2df19ecb9e59d006f83d44df049c

SHA256
3478a48c2c3471d01d42ef4ed10c23a53a04ab6cefe0f289b68a4dd25c1feb27

SHA512
9ce844c6b91d8f604b6bacea2bba898288b6897b648ab31153aa35a56b945ac1754ee5841c8adf796f4a3e49d852e9500e89fe39b064c869bcd32ce668cfac19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bda4910f0593c413aa3a989ee467f820

SHA1
b05bce672da97b33535dc2529a73cd432ee7bbc1

SHA256
b7f174387c36ae8fd73e9424136e0e3bd3d8fe68ae0190cf83cfb45cb2ff1f0f

SHA512
d9092ab2c3de8801f16fc55ce6fac8a828c445081a96bc8c8e5f061ccf59877604c1ea5dc6e6f0898289ecc25613c46fa68748a555ec16e16ccce35d59ac6cdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabABC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB8E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit