f08fc5fca350dbda2be697e8697f3964ce9654131724ac414ad87cdc8091d479

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1b87f914d4341d350bc0a208e2c69c1_JaffaCakes118.html
Size

23KB
MD5

a1b87f914d4341d350bc0a208e2c69c1
SHA1

f0cac008d0f9a7ead5a3a9358bc9f2e60ccb4456
SHA256

f08fc5fca350dbda2be697e8697f3964ce9654131724ac414ad87cdc8091d479
SHA512

2d0416ddb42304305a56069b3e26b19b0e0456d5b6fb588a55cbdef6995e04e8bc30abe4c468e1916693aaf258a8996236441a54e4dc011b74a4eccac9a78d97
SSDEEP

192:uwXdb5njGnQjxn5Q/KnQieJNn3nQOkEntOUnQTbnJnQYGLnLnQtJqMBpqnYnQ7ta:rQ/6GibD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424378418"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BAC466E1-28E8-11EF-9387-E25BC60B6402} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2600	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2600	iexplore.exe
2600	iexplore.exe
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2544	2600	iexplore.exe	28
PID 2600 wrote to memory of 2544	2600	iexplore.exe	28
PID 2600 wrote to memory of 2544	2600	iexplore.exe	28
PID 2600 wrote to memory of 2544	2600	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1b87f914d4341d350bc0a208e2c69c1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3353cb596b18d3560658cb81fb05ef2c

SHA1
0f3dd9eb4fe93e9bf9f3dae640c70894a3daaf3e

SHA256
8e96e2e4e1c6d680f64682858d085266a968e425c8ea680a33fbf45ed6ce70eb

SHA512
447fbbae3478db65a1c669c15dc8e2c13ca1913389b4100e9ede209e419106efa954a3411a67cde34cfe85b9217ddc8b3027196e626031a1451cc5e9ef784ad0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
534507c364724fa725923a2ca72ef8fe

SHA1
969ee8a14071e6579af7c5b88183d791db6ac707

SHA256
f716b392eac90344a7a8458fdb6538db4fab1d69ad7046ea3e967a64cf531347

SHA512
6c6023489078eb1f6124cf2a644e544e24c4c5ef5eb446996bb5d75e26dab954ce786da9827135b39982bc54a6a72e3c8ad76679597386ee7e175efc1bdcdd30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f7a2b4e93f2e11118321b17e1a63b40

SHA1
3f46b0ce695e33ac624d470c432185e891e5819c

SHA256
125685d26656f792230e919b3ce4a4b9ae4100d8fbec970d751aa41c9e1c1bb6

SHA512
8d7584b066002e9e89df07e54f467bb06ba466128c3f210b17c153cc719f950d8d35a8b3bc51f142c3283907ccbb90826d2a96a6dca8f4a2be39f99e6dc9b508

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b34ae6da6829cd919e664120aaba9323

SHA1
b37369acb6be8a643fedb9e22f81837d76c78832

SHA256
f797b2eacf5a84b418b11eb83c7850c824c13b1bb27476f50bd4861518449bab

SHA512
2cab9d979619fd4a2a5a91cb54cd01ae5bbc999c3b5cfb8db81da8015bc3ece1a4e8b51a0428e4bb453c04d13a9002685ea909a5621343f5cd83abed26f12982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb20b61e45ec00296f2ba3ebf5d60516

SHA1
c76582ec7b92efd0aaa4fbcf0b3e4d881225d124

SHA256
7690590b75e74dcc67deec3be16e10c118214525ba64db31f1a238ae3988404a

SHA512
dfe480cd7963556461cf2dbbe8fdcee3e636c0a6341ca77d55e9b56b2cf18da6acfb2c8e06b6df26c26be151eba626f64fc51c835946eae71961fc3fdc38d329

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a7ed12f94e018b72b65cd43b275503a

SHA1
e3573c9fe3527eb55cdccbbe44b6ef17cc3432bc

SHA256
be8ba55ca7a3b8393cb19d0a745c529c54facecec7e54d4fd59ab9f9ec50eacb

SHA512
aebc39ec9c4ec94aa793d0704da480dc0d9ecb2b88361cee41a0f458ca79c6be83cc897b06f2d6e06a23403764ca5c05625584978c4e3c1477e3738fb3485f64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a45b2797c25beee74551b8d0b9f0250

SHA1
4c1cc186a5f242dde6876f8886d46c6e474bd3e5

SHA256
862d094cf4ad95e78918e9e45eade16911b93036a347dbd2350b59cb9c5762fd

SHA512
4f542d014d99fe324366a394f65599c980d6e4755cb84b055d474310b333abc542b14af02f39db7ec824836a1208623183165f7cb2c2864efb67099b22bb1078

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cbb336a1231234f5e0519d123e7fbdf

SHA1
044508ec533ab0570faeb3ec624690f914134bc0

SHA256
ea08eaadec3941445dfa41f552430cbb4690f37dd12c234337717b93ff0ee064

SHA512
27e9ee25c443fb9dcfbc49c454b132f3da3f1c883f9b8eed30606d2cc80b4180b1e617404ebe33cb79c6181ec1484818e021bd9b70f667abdb5b0b174e167433

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE26.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF07.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit