a36ce7109fd6c638927a06a9daf81ce915e814695d54a4f4674493373a7abc56

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 21:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a259545519077cc4da67d344cdd54982_JaffaCakes118.html
Size

214KB
MD5

a259545519077cc4da67d344cdd54982
SHA1

b84494e55e2a4168bc72af3fa1e75fb356ec958e
SHA256

a36ce7109fd6c638927a06a9daf81ce915e814695d54a4f4674493373a7abc56
SHA512

107884f401193f048f9928a18443d28487898b57f01ecac6f4c3e0d92fa7123e9cc88fb3e06cd4da6ef9f6effbaed606e643620d69771738a3667ba0700a4ac0
SSDEEP

3072:arhB9CyHxX7Be7iAvtLPbAwuBNKifXTJL:yz9VxLY7iAVLTBQJlL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA05B141-28FE-11EF-9D87-62EADBC3072C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424387973"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2344	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2344	iexplore.exe
2344	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2300	2344	iexplore.exe	28
PID 2344 wrote to memory of 2300	2344	iexplore.exe	28
PID 2344 wrote to memory of 2300	2344	iexplore.exe	28
PID 2344 wrote to memory of 2300	2344	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a259545519077cc4da67d344cdd54982_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f58e900bbce10e0cbcb5c48426c30ba4

SHA1
3fb2452c05c01e89d46fa8126c5eb07b72edc7d0

SHA256
c73b70e971774e375b65cb4b77b9553d7901cb845933ae16715042d332b21922

SHA512
bae0ededb2b48db4222555dec2f176397bfe5197de4769039821b86a48088611c65b734a05392446a45cbc3f0d9dc23729bbab4409635ab755cb85895adc4f85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da361a94b8e4732648f64d9cfeb6118f

SHA1
1b4776cf626a85f13b14e0bb6b3c9e0621aef11c

SHA256
b4012629ab3540e39a83aaad463e1ab23e7792ec4c6c8038ff05980bd58791c3

SHA512
ca2e5794b1dbc4ce2b9fc2f7b47de8194d1557d3a426c9591bb666af5c5e092ce6094be7c8823281f8c65cc2491479e3330d8b2794b0b18fd1e5325906136e99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25b2df7c0794136365ec442507eab98d

SHA1
963a63abd3c77138ff7925c20ca093762239086c

SHA256
eb66e915e0fc04a439766c072188145f1af89ef8c8cd372831e5df0c1c533c29

SHA512
2d6f928a138e731458f2d7eacd099625f43558bec6c569fd4876e79df615ea45d248220986f033d753281e64dfa5aeb91b31b5ae29b3b8f243c9c207dff0d29b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dc2f145e33c572e6ce7fbae60daf10a

SHA1
39a9eb9cfc88b50d3710e7568f39e13cb6bfef20

SHA256
10302505c30cfae8805350ccb6d7b662d07c0462f56ce70442a7c6ccfadc24e8

SHA512
b2e7317188db27186c2906d7cd5f75dab81d6a0597bb0c7128cfe44dbd838bf63777c64a8390becc10f9e954716cb20948448a465a76be981e5cba802d8b2a8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b7d44047df06b5d7f8f5abede2473f8

SHA1
49dee5e075649b6fc986e939b96a3903d54b3ddb

SHA256
05875e5e28c39164028d24c7e40c205f19aa27d4127e6f0a79f3319fe19557dd

SHA512
c786906a3259dcc9c7d0b58828bf55e4e4df2108495e6fd9ca2e6f992e0fce4c352b90b7e8da9923a38ef9e644e268e40bcd082a06c75eaef4d54ec7196cec15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21cacd4296458551aa1136aef402873d

SHA1
5211738f33615c94e06485581868ae47d0b650ea

SHA256
322788416a14b5b959cc56ddc8263eea003f1d5495fba1c20b0a76a64e8dce0d

SHA512
f7703729ccc2bf57ae1556578e2bc9b5a6c72895207a502acff6b2664b6f3ee70afb324e0a3786e91732de565229c388a8678288c02150c543bbd7c3d51c472b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4063d61434aceef1c7ee064a74d76ada

SHA1
e3163ba9bc410f6e2a7b9fee3973575254e9912b

SHA256
950746b6c94f260e4e3f6722517da1b04c18dcfd502ca4194d63eb93f09b7f31

SHA512
4d411f2600f2889febb8a9be87b8544c61ac900b6f86d2d4320b4018cf1882b3a0dec5bd2956778461d1c7400e8414be148aebcaa15b42c8d1c6d725687ee1d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
185a0110920560c7422fe7a89b4942fc

SHA1
1a1b2ebc4b7ab0b0d8653cc31590c7f311cf4224

SHA256
6aadfc739c9b13600e30477cbe5888653fb547b3989aa4e90eb5d954886c0257

SHA512
95bafd5830973d451328cafb6d5b33800aefdec95364a5a302584d4c441f51d0b5d6e1d345f019a9809f89439a241297ee513376be82bb9b3d5d1e2af244c786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf562f876194d25878f16d392e8647d9

SHA1
20bceb3ec06962e9307687e08783415e0c912eb9

SHA256
9175a4a572ab636d44fc1e0a5baf7607ab9281bc063aedde89d138c3eb5141f4

SHA512
b062f19629ae23145d9ad6974fb8832407793b7722d597334b0e6bed6b2146f814b023b5fb2fd61a54ec4ff706872559ea11caa1e3c0766db0cb453a86c1d966

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab149C.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar155E.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit