180345a550e1c560932e8adb56e05a7d5f82e3090d72887895d8189ea5110ca5

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 19:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a1fb6a88468b75825e04ab80724856ad_JaffaCakes118.html
Size

36KB
MD5

a1fb6a88468b75825e04ab80724856ad
SHA1

1356a89fd5321aba4152ac6371c311134e08f8ce
SHA256

180345a550e1c560932e8adb56e05a7d5f82e3090d72887895d8189ea5110ca5
SHA512

112ad0bbe84b85bb4dde5172f93f485d8ba35ea9c45703ebf045fda3aead3447ea238c71dff51e2c82cc58d81011634faf4f5a075ff68e85c23388c9d9ed704f
SSDEEP

384:BQ/lmWYRbs38nkTS+6X8mMGmeyWOQOMpsJ:kmLd48nkO+xGmeyWl5psJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424382392"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB79DE01-28F1-11EF-AA09-E6B549E8BD88} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1372	iexplore.exe
1372	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 3052	1372	iexplore.exe	28
PID 1372 wrote to memory of 3052	1372	iexplore.exe	28
PID 1372 wrote to memory of 3052	1372	iexplore.exe	28
PID 1372 wrote to memory of 3052	1372	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1fb6a88468b75825e04ab80724856ad_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
3864fe5fb62d7207cc4e16b5163db778

SHA1
8dfe8d5688522175a4d3a7d92d27435d72e98bbf

SHA256
32829fa23e8aaf80ebd2a06a8006aae532052cd5d9924da7e4b1cb2118e55128

SHA512
9e48f10ed45343b8b2460bde210c8bc92d530ed68517b0bed83861f97a73787daaaafe3559811ba6ff21e77b493d953796350cdad6214ca8289efe0debed414f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60d96a196348331116a60d22c4dec0c4

SHA1
ed87259f1a26edeb245251965959ef46025770ee

SHA256
3aa533386f49578e7de6670627b1ad0f4e0ef7feeb06dcbe4eef256c61f1ad5d

SHA512
b06228fc126c4ff1717b41f63df61573f485a163b6f6a6b95c9e27832f680f7c1c91e307907769a07d1788475b38917aa5b314cb8996dd211fc022dc22e663d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6ebf68e06c3066b3b3294b359683e07

SHA1
df9fe05e9c087a0978ff1de4d23a9909a484ca7d

SHA256
14ae03e5f2d35bc7a9ea295078ace207e3aee0952b2f2f8583a00f9b7e18c8f7

SHA512
3b27c23a96c81ec73aec2ef0d8d32a3eaede82d85e47b5d5b8040377a286d48d37fead85afd2d1d9b7f452eb36b9d3a37de8fe5638d21e470d46515508b63c96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc90f1395ff8768434198811071dfae6

SHA1
549335d55e0d4961bd3b47339274687a50e232c9

SHA256
2c8c9f255e44fb211da3e6fe76f80cf2df5d4d19dfac003df8535832671815ee

SHA512
a379eb111e7113dbaf90388cac34b05e6ce40fa1667c646dc5396071931be36e08fe3a22905363342072ff6313c65992364db09dea581607c52dd9277bb9312d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
168889daf5e3a9ceb17d19e49bea0f0b

SHA1
e9c8040d11c8b52f7a1c338191dd5b02c0694d05

SHA256
79b9380f0f4bd480f6d8452408b25ece5096c3c6a5a58009d101e092ba9f45c7

SHA512
5b18e334676d9b8e3fa2bfba5141445b83093cc9719db26769f35bdc4ea4d2f2bd2d829c3af605670e955d4ae05e87c1f603c3bcab47202ea53a690e00d1cda4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
631d23d6edfa371fba901608dee29d07

SHA1
3b9114029279d9c57106254f93a28a390189d436

SHA256
3f348637bf7dca286df86c620251c41de6ad0a1d013af4790fadd8076522f898

SHA512
34fc835f400fafbc68f7e33561b76e734f94e428b12015b0f7853efe61c05fc8e93d300c37ff760d8c38fe180cc698b66e95b3a3530e9363d210c3426457684c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0686cf8504b652a2af05bb9576f0a692

SHA1
91baf3c59b63cc0e6e6c1cc24078e136ebe791c3

SHA256
0135964cf12ab7c3b78bcefa1fc4be5c5f312e123be68cdde1206281629d7b84

SHA512
ddf2a31a9d166652abf23f95fd8afe375240cc55639969d0cdecd21ff1abe909dc8d0b5856855b8816f16af980027229a615ec638a1891dba56c51865b488e8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68dde8a765d7818fabf4c9e90118853b

SHA1
8d22c2f5ea6cb8304ab75578efd1bf52f2e9eb46

SHA256
e1824e90f6678e7f6488c86be1ffcc912dbda571fabffda7542b3f8baa6e24c9

SHA512
b3fb5d8fc436f8d8e20412c1f4c4564c5b4272b153925db40515cea08a9353f4aeec38c1e622abff357ea360412e4e783d62a81a3ab03182edb15d8c26790022

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52afbf74fda402fc2c32e921955c642b

SHA1
b308055febf4637dd6654d9acba359cfd3cbaf62

SHA256
2c10ffe8b2d94db9c061c4b0e027d58048d20c497f99da4a7ea3985f595ca056

SHA512
4917332f6b98b2370174a452f36af97e6035a250ada25078a76c22db857f02f88e7ebb1be8440cb3a4b2f9943fbcf571a8f1c7fbf69056a04b4a9354c4336d31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d616573025b347a36a03c926d683ed0

SHA1
e8bca76771642b3832517c512657729b1dda682c

SHA256
6aca085d4c2183920a4a60c4784e06a7450b63e111a2d72928bb3c9421df8680

SHA512
12a22283bc19dc9c52a420733145a97b8a12d71c6a4b0f9d2e91dc2c09437381dfcbdce799edb232474f6206cf6afd8e2273889d5e5fb1381534320204e46397

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6c7bff937af66e7eaf2e27a505203e20

SHA1
c79a620958ff7b97623c0ae2484dbb6d243f1261

SHA256
8da4a535e89121514b5501dbc468daf57867ac0ef44ff2d1891793f04240a974

SHA512
1f0d180268ae1eac47f4e1753e2af6e7bdbf8a4362f3cd8cead1e5c543acb65175c6aa8d01426a1faf605d5265f90c395f5f327ea2e31312e944f78d38784f8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6C9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit