cf3fb770a03401be56780fa67bb41c8adc3fc300b344c443654e0cc9a8da72ea

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1a733868e2a9409f9d74b5b8c267411_JaffaCakes118.html
Size

47KB
MD5

a1a733868e2a9409f9d74b5b8c267411
SHA1

dcf164ce62434139eff81b5b3d67eed5ca55e32f
SHA256

cf3fb770a03401be56780fa67bb41c8adc3fc300b344c443654e0cc9a8da72ea
SHA512

5d3b3dc0c5bcf9622833ac712ad4234150eec950f8462d89e54a4432e4601872809ffe233d2a525b25012930e3ea296e0f3be3589f2916b7f70187a8d356b51e
SSDEEP

768:owWn2Y5Sjj7kid7fHvh0Yz4FJsuSZI0c+:ow62Y5SjkixaVfsueI0c+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6030C9F1-28E6-11EF-9F07-6E6327E9C5D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424377407"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3064	iexplore.exe
3064	iexplore.exe
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1984	3064	iexplore.exe	28
PID 3064 wrote to memory of 1984	3064	iexplore.exe	28
PID 3064 wrote to memory of 1984	3064	iexplore.exe	28
PID 3064 wrote to memory of 1984	3064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1a733868e2a9409f9d74b5b8c267411_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
779eeeae8150034f04f76ecc82766348

SHA1
2466c369f8d0f6c730d1bac72d1c25e3f5b7c030

SHA256
3e3c1dbe399f83aefe66718868cc48e7faad1df391313c1d8e3f39e5b9adce0d

SHA512
6f325c6295751783bd1c30a4f22906bb4f05ad1af7c19b249e1d4e3d69aae7de619284b5dac8f517d515037c44af0c69518c647b0ec0d7f09c28761b90bfdbe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1f5529d4eebe3db5a639e067105478e

SHA1
6473b300ad6df6ff6869a07573080cbda5718013

SHA256
9316afe546d626b0459124216bc150e4397f134574529ff243fae36fe0d3c3e0

SHA512
afd684211895835529528fb3da91fe7547762e60f995b53e2c618a1eb1d6f9b2a075c81f7be6a8ce4c3037938c7e9ed7ab5b9efa80c8340fa2de66e8a1586d56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
405be003ce8dc0078e1e01643a3ce118

SHA1
a0a26401570b5cfd958dab227f1e78bcfc4cc7e6

SHA256
2c5dd22d12fa3a8e0168bfb74f2a49cf9bc8097ac2f34f900512f2368bc99373

SHA512
811dd9771053bc3f0dd2a954189a2d80f05bf77d9ac01c38f3eb2e005041cd7e9d64bc16a56601bb6951ca21b8f2b4884623d4539ed1dfd370f50747c270ceab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a981d5a95e1fce5ccbe52b3803bf7d2d

SHA1
df0723eb20e84eb030a99e3556fdfed29428799b

SHA256
ca1ac07c8c34b6f4828dd1f250e3423e2e6977fc42d08b665c4246fac77d6b2d

SHA512
eaf06dcefef400a87f6b6d1cad09f501242dc355763dbe9d71fc2803cb1f098d6faf0810fe62dbddf7f76aedfe36297a56b72bf7ace594cb976a43f0eb7df0dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffa758c7b78b03b9c8b436863ec46277

SHA1
b51108b1daf1487ab04d20c041120a15f0c8e2e3

SHA256
05d22916f44096a95f25ee66e84d698fc8e57db59165a52c1908abd0c3005f71

SHA512
21dbe8ab182b96afa6cd08d045b58208bfa792d4eca2707ba5bdb44855393be38f64b6f51f57be5959ca45384c38a4e2b357b051a4af84607b492f584152f421

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7558d52de996a3b7f0f7e2b1725c0f19

SHA1
a44e47d67ac5a28ae5cd0ca0e26fea681943cbba

SHA256
54461d75ee5fb9717bb947ae427ede47da4f3a0f8cd560a183b8e22636784ad0

SHA512
974d6202b52ec495df76525636b7d1ae5be6406ad7f4f08ebe69afcbf74367fa59875abc1826aa45ceea4b215bba50e8db35a2a5cd47dc20169f4e469e5974c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c1422ccb69f0bf63dd7e1174e30037e

SHA1
5325dfef7d4bd94c8077bd4d68846968f6594c34

SHA256
096a5c85b354044ae5268e356a0ac95fdcb08a267c8af5fa92b5f67c4cbfa9cb

SHA512
f0eee7fe249c0450012f7d7889700a39676bcde31d54c0af1b6b1bd3ca147202bb314e675bd4488e098bca9c1275ac6a040735ded8442762e8ca13aa4783e00b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27530f0b6d544b3ecb1b2aa69daa584b

SHA1
633182ee9caba86cefeaaa1680371dcbda119eff

SHA256
6387036c2a0d9e5369397cb5757d48aa68e1332ded646b4f1175c12d109f75aa

SHA512
8237ba27285b81e58629f2f42d9433ef2af8be740fac9d9397aef1379a24f14aa6e82f80b03347e68242fd65dcb80ceb71f5aee1574f0893ec5553704d2c2ca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89e4ae178bdc2708d712a0fe9663407b

SHA1
a5e1a8d9549054a97957b848bbbfa0c414fe39ff

SHA256
473d4e54affa2a98ad59cb1b3a9ad9dd57f4b3b8922df4635799f6956c423a77

SHA512
11c608d5047851c786f9f4ba69640cdaddd4233902a6682175880c4f09e9fbf638ed206391510c71d0c5874f158e1e750d993124c6b99fd3a203b2d33622508b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD4C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE2D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit