daee4fd7803de191b70f9a105fb366e7c0730b07201739d4e5801ccf2c547a07

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6a8dc526727aeee9f4ff4d127804051_JaffaCakes118.html
Size

23KB
MD5

a6a8dc526727aeee9f4ff4d127804051
SHA1

2ec17446ea1e92ae3c2e286f2de75c56a7df1670
SHA256

daee4fd7803de191b70f9a105fb366e7c0730b07201739d4e5801ccf2c547a07
SHA512

8d36300f463d3318f33956fbc10192385502b21d73d38d213480fb78121c983f13833ec11eb3a7231c5accb88595e26af078dca0dd7fd53a8db995cb3268a4a6
SSDEEP

192:uWDMb5nUWnQjxn5Q/fnQie+Nn+nQOkEntdJnQTbnxnQUCnQtkwMBeqnYnQ7tnyYB:9Q/sAo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424476176"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57B75AA1-29CC-11EF-B9DB-4A2B752F9250} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2828	2020	iexplore.exe	28
PID 2020 wrote to memory of 2828	2020	iexplore.exe	28
PID 2020 wrote to memory of 2828	2020	iexplore.exe	28
PID 2020 wrote to memory of 2828	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a6a8dc526727aeee9f4ff4d127804051_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e06ff07f25c4b8aef53190fc5ef1836

SHA1
1b571c54d33782c89c16a8f797f1c8f105d612a3

SHA256
32014ea45ffd73d1f042dbfcf46aaa6499c58c231446528d894d19754a6ec1c5

SHA512
ce4e4f43c840a9928ce9282944e52891dfcb285e9861793a716db66361a939e433fdde66a2170e0f03897bc8af69b4f212db03127b5af04d0c35356f27cad4f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e1b408f13a9857511cc4bc3ee047732

SHA1
582bc02fcc4ebccbbb9a4c466f6f1fa102fb03e3

SHA256
4b96687bd98a6718f332547a43f60387bc9751f5ffcc30c8383506a970e31f3b

SHA512
1a7316e56bc54e331929cefd210704ab3ffb65ee9fa8aaed9b0754de1fa073235c3ea0eddcdcb273369267e2bab66acedf9c3d71a2d54153533536f4c46ac8c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af839950f90edd1aa2f03fd32f57c936

SHA1
653ad7c3283af9d87ede5a58cc20be874c466a07

SHA256
33605481b48a89c48db81756fb3776934c4b1f2b7bc9668ae4b626cac0236194

SHA512
144a54c6c5bb8132e1f30b29bdbe5a98743099ca059c484d96438fd1089439d1cd9b383308d4b5d39aa5021365a0a4b174934124a69b8c669f2522e31821ebd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ee6a59b2751acb0a4f739046c59c7a9

SHA1
b976223e7f585370d9abd68d547e882a5ae54241

SHA256
01807a167e44e21fdf61a3ea2d6457884b705b5bb443546f1a763a5a3c2af8a6

SHA512
00eeb3157ca2bb385c3212d59e1a3ac1bee1b8e9a205217c3b9e49572c64c1735d63904aeca0bdd2235a389d091e09ef5c24e4dcbabe828776490ae5887bdb8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
347a3af03e83ea1cf2763b47a548bf53

SHA1
a0da37864e79ab9b0e09c0c45b790df3859c28d1

SHA256
119e11456a0813d13567d56dee12ac95a94f24cd54da34cfeabfd5a3a0545347

SHA512
4321cf512678848df621f9a07973fe6975887987cbe9cc796f1c6f2648b895419236559e33ad091a05923174602b6b2aaa34fb0d537379a8ac9f7aeb077c0123

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a290f6bf8d5fa977f91e0e1de8c51eb

SHA1
a1a31ca6e6d8057f5c06355c472473b8eb2cd517

SHA256
2e911867b0bab6b2a723171a73029326e0b4a1524ca0de219cf6a41192e6197b

SHA512
b55453d3092afc8b7a0008fb221b42f4fb2bc038a9d7011c15d1b9f166c4bac0a5f4d3b5186b19f36e951c82b3569b172593d4bfe3b649c0e4f21796c8934566

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b57606dd9ae7ab03db4b448897c6e815

SHA1
3e943b91772d3f4fc742b9cf00f6f78e3a987f95

SHA256
f2827819ca75417dacd064ee8e78745266dc98c6054037d25d4823044518012d

SHA512
fb3fe06d96e8a014f7f42666467020e9ad54e45164480f42449f4b56a299b7e0d53b08eac6494b46190d93cfadab2d95c6f17bd84a403bde7c3e1722dba3dc35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11c7e029be94bb1b9c61f6e04aada5d0

SHA1
9a757dd7d413b92829e4d6927c858e12f3587dc3

SHA256
aac75da352784a172f47cd0e7c029c774828bdcc5e9c5182a34faaada205d1dd

SHA512
17cfdf3f9a456c84b6f17aeda5cdb1bb953aedfb15f7c0bdc011ea0f5a2983052392199ac8b0b36bca897f957e33decab7b49ce1fc991a15b5bf6d6d9c4b9bf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
173e9a8c5eadf4ea4a2fde064fb2a2a9

SHA1
f4b1f7ec7b43c9d31b76604d5e8c4ba9af13b2cd

SHA256
20fa177f9ab9fca4396c0e31e22fec26e69d19989881559ff5dc31a4c9f6ac68

SHA512
4a32a25ea12d3d7c6852689d8bf5d5a1009dd7b3db5ad7e13ce4c7c37a1476ce092ecf334e8f88280127d27def51e519cacf23ef3ff58a57ab51eed4fe711f43

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD9A.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE3D.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit