4bfa75c3085b1de55d656132d5bcdd4a9049212d29016fb96692ed85a4be5c63

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1340cf4dcbcf1401570f201def5641e_JaffaCakes118.html
Size

161KB
MD5

a1340cf4dcbcf1401570f201def5641e
SHA1

5492a5484c613fb58118eb541f052b2141e586ad
SHA256

4bfa75c3085b1de55d656132d5bcdd4a9049212d29016fb96692ed85a4be5c63
SHA512

72eca559262abd49be70fd638ac4768b335bb0030e779571ba7ecd0b2cc971cc8ca8c345e2815930eb3a9234446cfedf994e879958c3bc4a0c29fd4ca1515604
SSDEEP

1536:DIi9cuwr0f38+ZT7xa5SsfssvqbaANtYlhed4S+e6DuX7d+jWhJU+qcWvGTRgdDh:DI77yqPm9/ZYqS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C4340751-28D2-11EF-AB87-5E4DB530A215} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424368986"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2764	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2764	iexplore.exe
2764	iexplore.exe
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2960	2764	iexplore.exe	28
PID 2764 wrote to memory of 2960	2764	iexplore.exe	28
PID 2764 wrote to memory of 2960	2764	iexplore.exe	28
PID 2764 wrote to memory of 2960	2764	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1340cf4dcbcf1401570f201def5641e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c953374d18a4f0bb5af52df50ca07c0

SHA1
cfd9115a171bb90d83e8db9be64b5d0c4f5ee3cb

SHA256
c88d279e1a7f37c9b797a62afd46db5cf778079c3cd447f3a11b10e38c63a0df

SHA512
37b13be863123f762b19108cd35b066bab9a2081e619daf1bd4dfaade6ac66a1ecc0f1de4d30a2562325389954f957a4bb556af9709b94a69818f5e98778f8b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6e4dd1cb3df6217981b91062dea51c4

SHA1
a0a22877ca119ad61eaaf7cee9b95dd67113dbf3

SHA256
34eaede709f2f99d044d0bf5f1187680cd1514b1627c90c18af5a6aa672fe97c

SHA512
df88917fd3958ac00ee78aeee695b95a5ff2979780ced70c28ebb910562da01cbe62a85fb801dbe5cc95880e4fcba51dadd63499f1efde598d1232870152f630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e52c830ba153af925317d027872fb190

SHA1
bc94c1334c7d23ac0f2e0bb0c2f8647bc731d9db

SHA256
a9d6a5a684bd6a4db7b8ca4c924c922d67a91fb896e9fff5c4cab6aa4b82ebb5

SHA512
42646c55a11dda6b33a8fcfb99924db47b1b4a8129676f9688f3ebc1686ea15853c0d0e6682fede06f7dc408c9c56a4eb460c44d4a4c3afd9492696a75b01673

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae3764f7d660317723e54e9e7b6d8c0b

SHA1
445eeb0fb74db1e67a8d48e29d06eaa5f49eaa2a

SHA256
6f6f1078985686643946c76a8feb8915194d154edf25c52452feae433717d3d4

SHA512
412c8bdb43afbc64cf01e7ea1309b0130d2b753dc86ef15ec63c63e15e3e994d7b55be37a22ed1c9f659aac3d0d6dd4c9ad676f8fe2be3ed72ed04ed37eace34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cb0171bc397d1e0f4dc29f0e8d5efbb

SHA1
3bef9fd714d2644ebb7daa133b8aab062c5d84b7

SHA256
87009dab7ddb117a006b0846a1ff162b0343a44be947c926525cf9aafb29c154

SHA512
50c53a860a964401200ae5479869c6fe63034d155ebff6a1129f14441963f09d98d775f0a68b422a61e4d947b4f61541c61d3a6e7bebeeddfd11d70d1bed1bcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df38e5c94ddb9a02eae4b391a9da7b84

SHA1
648dce18e2e71e31ef439d86500e38316577917f

SHA256
4bc6064a20e2ebef61908d80b40f62d879a84203494264e592939779b005a8d6

SHA512
10f64464812517a9876c24a774d6676ac3dbda28c91d003eb4ee36b4e096bf4e88268d311b6156e5139d561d372757ca961d230a965a4a40c4ad70739f667a2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d13eff5389942dd7871c246da108f4a6

SHA1
2d52deec8ae9a703d4fc65a2b15b748add4954d5

SHA256
28324147baeee6808b001f710db8d504ebd5fb18535fe9960f234ec22f71e2ad

SHA512
cf5c22edf530e21141ec2335228f3282c048e99637b74ee403dbc75963ec44107c7e2fc640dfe737a500e4790b60686571182699e136183d69f9bf4d3031d115

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70b59c46db88fdda5aafb4104f52ace5

SHA1
4ce3c03ca2865d6a1f9038c64df9fe82794032df

SHA256
13e2af498773b5ed0d82ccae373126686313164868b381c3a5045021e3de7241

SHA512
4e90efaaa12ef27b6f5efa579bc6ff9c13782f2e68012a3fe97647a487d3e037facaa965d393eca493ca8f960072e931581c66b12f927baced67e43c975f22ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2b05ef2f4234769790eda1d4ea65535

SHA1
9bd6f01b59d23f927db671217ddd12cb158bf64d

SHA256
ebac1b7ee79394178ec253d888ee91d06cb6e8b9fe82d543cf8bae0b8784e0c2

SHA512
b660943233226628d0e960367dc50992a3b88fdcfacfb1da5572a5cc04b68793fe1d107ef4e68013c4cff07c1fd545352ff4d122f69a3badf9946d7643305c4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0f6412bf917a310953ff8eeccaa5ba9

SHA1
cd7c51da688c3689e5ef3eeba112e217f7351a53

SHA256
43de50914d9d3294ab3374ed3c09b930b034503c92372f4b5db1a6632f7d532b

SHA512
f477e0298abc84721471e02c82847e69516dacd7c32543ae867c18468da5e8aaa2b229a32c43605b86355a2cac812d84af13dc3a0f144e254de5ec28fab008ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3db2696c57dbd72e3962435734a97915

SHA1
928b041cf657a2c0b4ad38075d69b918e0520bb4

SHA256
0b48dc352cb3d1d0b46dd36794c543678abe8f1ddbd18c491a4c130b0fa8ce96

SHA512
5cc71c6976dd201fa8d7b4818a1f814b2426a40017d578e8bff451552d1c5351943e86dedcf634df56f989037c8ddbe8f1c7a7e2447df30d6c26eed5874518a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5A41.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5A53.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit