6f243ae80edfb606a26495460c68a4c44e63cb38ec049137051d7f81223ef7d5

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 18:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1ab6ad5007d52da4f55f71efe53a414_JaffaCakes118.html
Size

19KB
MD5

a1ab6ad5007d52da4f55f71efe53a414
SHA1

ccd7562a29c890289d6816985fcae7bbd3d09964
SHA256

6f243ae80edfb606a26495460c68a4c44e63cb38ec049137051d7f81223ef7d5
SHA512

50f50c33fe1fb11bff7bf654c2957bbefa837eaf7d515a2db8e5a0d46c7f4ce8abc37dfde11e77664fc5b1f5ec56624aed4a98a7598bd2832cc5a01d43bd8d29
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI34nzUnjBhJD82qDB8:SIMd0I5nO9HZsvJ4xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC5C6F01-28E6-11EF-970D-EE42DE2196AB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424377669"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2100	iexplore.exe
2100	iexplore.exe
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1720	2100	iexplore.exe	28
PID 2100 wrote to memory of 1720	2100	iexplore.exe	28
PID 2100 wrote to memory of 1720	2100	iexplore.exe	28
PID 2100 wrote to memory of 1720	2100	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1ab6ad5007d52da4f55f71efe53a414_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd03b6a9e924cecb4923cf208a1f7100

SHA1
20a2ba5067012c9e0cf1c263e9c0aa7fc8bb233f

SHA256
9a3ef5d82a7cf79f6b6c037e29c3c4a39b618c465f38b5ea629bf3cef868ecaa

SHA512
03b1e6952a7fc2fd654ece4f295cccc040b6e7aa88fd477d5c3e600ff1a5dc270de081895d3e18c5bb030c83ae308f8b7b4f2c140046bb29691c85063744eddd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45ed5b9ef9bd2802e801812100f098f1

SHA1
fc91dd30e9ed4be0e10044712a4b52d1bcd49554

SHA256
31a99657931c97450874c27d0fe3b6570a2bea991d33b1fa70f68b828c436b80

SHA512
240d9c107da14381b428f5e6288ef60679b430c71516bb47429f6911f035c6d66a4fdc16d6144354970c3331051779e0a16c432412a3c5653ad8948d61136008

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d49f5cf9908da89585144d83abc7e43f

SHA1
ab9e8ac84e37b173d9cba5277f0f439c410b3366

SHA256
edacf888fea30e056e9e9716801cf6d5a43ee271248881a78672b0e69af1a3b2

SHA512
9ca1de8b8e2cd920e34ce195ea2800bf173620ca02a5a50f7f8ddf00fe9dbf985ae30f871bcfc3c26c3906742123f5d898623882339efef2d614b55a1b48886f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2f8c6bd30931faad5d6274e4ae9ae8b

SHA1
af9d53fba35fa2f8c33879b5728f8b137948128f

SHA256
a3488aeb699ebcfd2eefd3b79648e64cf95393ca62cb2cea69ac67ae62b084f8

SHA512
9579655213802ceca5499e7a9edf1a6a22ce43a4c0e14d7e50107ad1d357c22a75ac5416c923ac3b6241c17e43e5bc902e447364cd7ef1d4f1ee323b4f127fc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5624dcc004d5bc260d215ef22e604a1b

SHA1
f7c756a3141496c7825e18aeff8488efe9a2a8e6

SHA256
7ab201a8d4d86a52fd062325eaad8fd2f005459e3ee4611c430f913003457ca6

SHA512
78606fe5fbed2774fd4f8add666b572b9753118af73f90c9ffbb72f85785d9cbb8e81e37da242a448aa1d83a7047a0c0caa677d5d2d00e6ad8e5c3879392aed2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f86836701a09f1bd2f23d6c03a88e34

SHA1
efc794d786d5bf922929a2d950509ad9d0c00b49

SHA256
6c950a1d20f03632e27577a8c61a5b6f6183560bc7d0ca5553b6ec1a1318be9f

SHA512
845997da94ad7a4b69d5d79afa989d93496c9696733de46310114f9decee4b85162aafee83961fc859f5aa7e13976f7b3312dce1212da7821ddc500f7a70d894

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a874156c0422bd0768657d2e25817ca3

SHA1
fbd7564a71aabd4b08234d2d95a5043bf85e3738

SHA256
f81cc26c420998d3ea738d8ab0f450af9188ac897da061833c56ce40311edb7f

SHA512
05159656fe15688370ab2c590ca456fb74ae99c5650f5dccc1bc680e739d35153d4fe54a3ed1b58aca4ecba6138eb53469ca811631282306a0b3fcee814d00e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
832abcfbe8fd211435ccc0deee746d39

SHA1
221e7218e827cc70580c9b8549370296c60c748b

SHA256
91ad1b3aac2b8e31eb751561946c632177fce700c6dcbfeb9a4a23afda548c08

SHA512
9c2b43cc598bb2f06c7b675fc4388ec602914c907bd078dbd235ff2aedf4f93eff2d6740cabe9941b21e4c8ecbc41d690b7d302cf901fc51249856f8ad035da7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
459b140965a139c6a99966bf9d448818

SHA1
78015aef41927fbcd1f247db9c81e0ddd4bd39cb

SHA256
90cbca73e8e92a52d0ef35682328dac70843e44fde1e215be719c0017c2d3793

SHA512
ea57d055b9fefc9e47f6e6b42e7451c2b5ccb807ca4258f535386c370ef1870a2d5bb584d0968513b5a8f8d7ba034ec9b7ddf18004fd451bd2ed3ad33d3b0fe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7CE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8AC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8C1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit