7ada5a892b3ae3f218028e3b3d3cf7c003ba66bd231374a220b911f8ca449810

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a719b52178c91514c6d9834bb18e3ec8_JaffaCakes118.html
Size

34KB
MD5

a719b52178c91514c6d9834bb18e3ec8
SHA1

88bc80cdde0c6c4561b520dc5f054d2f4c7e44c1
SHA256

7ada5a892b3ae3f218028e3b3d3cf7c003ba66bd231374a220b911f8ca449810
SHA512

b73b2e87ff182ff5dfed4e9b4bf6983ed40d4d2c7856ef87216db9616250f1151b7d8b601d37503f5b05ae762e6f68a25e2f5fecbd8ba842bebc9cfca4ec5bbc
SSDEEP

768:RJ1q0zJK6j+t59NKf6gRKGbCo7i6svHLMuCoJuyNEu5xIxOxuQrtuZJNumt2unRS:RJ1q0zJK6j+t59NKf6gRKGbCo7i6svHT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424483077"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{684113B1-29DC-11EF-968C-FEBBC6272832} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2652	1704	iexplore.exe	28
PID 1704 wrote to memory of 2652	1704	iexplore.exe	28
PID 1704 wrote to memory of 2652	1704	iexplore.exe	28
PID 1704 wrote to memory of 2652	1704	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a719b52178c91514c6d9834bb18e3ec8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5eb7abaec29ab83155dd2ffef7a51a22

SHA1
3c744435212367409af1ab57175b344f56c53faa

SHA256
a7a69714965f3cd3940793c97f27c21eea438aa8e576b9aa63eaca8c69d84cbe

SHA512
1a208281516d7df3cd440fcb90efa6bfa363d835f99daff8a1e27eb9f621e8a7b9870189deeb19fb640381c1b039ee5c180b1b99525a56913b6031a038e2120c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cedced53920e4c919e0d661e8ff09aa

SHA1
77807a9054a94acaf0cecc507e38c13f168f8039

SHA256
4628bdc9e3c402b5db7519e38e3b298a1f85b3bb87df681f220f0e02bc9d1fde

SHA512
226782361c3ded5b986af1a88019f0586a890aeb3e327817b3419cb2ac4c6d0924e70e32ddc7df72c34dcfcc9a3112415b20b36c56233849f3a21a23f56af6a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
084169c397b70daf2f9cce14279c1ca4

SHA1
eecdb2cc93601ed1e8358bbd3e697901905c89de

SHA256
f329c94c6624d2f97b4fda749b632f54c3b282d4bfcde8c162f8c98f88fbc730

SHA512
b7cb3da9071c3c7ddc1b5c83fcb23d0d2199e82fc123d4db6bf6f4c7850b78dd95472beed3817bebf5d083cb02510e0c874268da792b48f1acf3a4224971f5af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55048469f27f5bc970900c78ef466d0f

SHA1
3674e3a165d30d56258f760ff60eefb31ea91993

SHA256
dcebeb628b7c2426f3477dd8d5cd96b4175b9b44fb85be62bfe75716a13b36eb

SHA512
6aeb1785e472219131fb3d14da0a55433b30c49c504f1d4b136a10998fb54e8bb5760ea8a82246218f02700afefdb1cd640d7965918af4b644ac6660d5e364b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2493d3c7986a588960b34c6f2ebc2c4

SHA1
41e22c22873b6249c8262ba26dd6b5b7aa0b102f

SHA256
f412d1e1ba0d7c8f52a1f9a038b01c14696be589a3a2b1b9e072ea2afe036205

SHA512
7fb9935db0fed84b083518a8852122bedebdaa042ad5fb7ee459889e36a2de8cd11488a2c4264c108e8870c8df8d8d08ba788d69b8b7d957a42520c1cc2bb84d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
614354595e4a628509a75fb4f17a3ccd

SHA1
89a6639bb4e5114a6d7a88c073ef7b2ce253c759

SHA256
dae3030c7b01178c963bb372847a1aed99274c06e256f9509f455281ff1b297d

SHA512
6b1b30769cec95d15b83532d8b52b54f1359c1a66be311ba866cc133704cbcfdd376542ae5575fee164a2d24f5f0b5d318f2277d369725e8d4bedbf91334869a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbfe6ce255e364666d2b1dc85cf21eca

SHA1
1420ac3853b37a44e5b8ffec23172d5e08a5103e

SHA256
827ec43eceb1c137899eadbddb470c14d297765e6babba9f7cf88a374d7c9fdc

SHA512
3c24255583e28ce686bd5067aefc03bc1382d433c9abf5be45aaac1c2608677ef59a11df6062ca96aaea2f67f46d4ed50e0d83d6afc1665ce6dbacd24c2c9eb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0015634a02d6112f1947b1b73653997f

SHA1
147e94cb901db7d05680857d921aa56639040d96

SHA256
e41a46ebc92804463129450a3a30536ace65e944212270fd0aede991df797ab6

SHA512
577334896bfcd3bacdbf29481cf6330c91373c95b95503a436cbd55d52521b2136a9c0433eb31fb12e2264c1252ae9bbdbdbff8f1745f576751f7773b46e9d60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ea4c8394ec0ee4a2c81a2ab729ef2ee

SHA1
5f31a891b37f97972878df22e540da4402bf4b61

SHA256
ffa3407dfea70699a6e790d7bbe867094556e46ea872f36fd4bd3247ff253dda

SHA512
dd71a136997a18b41bb619d4a68f0db082b6bb229e61a14e96ba3f58250dde7e9ecfc58e9b5d13e9003d22cd2fb7c8bec4da951e51e1ff636f5196cff5079e69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab64ED.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar65AB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit