d14b83bf54effbfe8dda43be94df83e13df434dd424c5d813c9d07cd2e59550b

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3232352bf6bafef78dfd04802c9f959_JaffaCakes118.html
Size

26KB
MD5

a3232352bf6bafef78dfd04802c9f959
SHA1

360a25c312db535dde96827bc458d01141d4ed52
SHA256

d14b83bf54effbfe8dda43be94df83e13df434dd424c5d813c9d07cd2e59550b
SHA512

34333a5cac0f81c745146fa8b64d36b4ce53802f0f3cf8734f319f7e82e9a69aa548efa1a18f9ace9ad5d645ea72918abc414637aeea1dd9fa33790fbccc1d73
SSDEEP

192:RW6oC9Tb5nwnQjLntQ/LnQie3nynQOkrntxinQTbnGnQT+kXm6Cre8WsQl7MpnF1:I6oY5Q/UHBJaXWnO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424400276"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9D35C7D1-291B-11EF-AF9B-7E1039193522} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1044	iexplore.exe
1044	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2936	1044	iexplore.exe	28
PID 1044 wrote to memory of 2936	1044	iexplore.exe	28
PID 1044 wrote to memory of 2936	1044	iexplore.exe	28
PID 1044 wrote to memory of 2936	1044	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3232352bf6bafef78dfd04802c9f959_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4ed259107bdb5d93d42eedc69301f9a

SHA1
341a826d8e2f2fa7d232e340e1bdf15102975078

SHA256
2c28b64861106f1a99b168b02418b2dff4122e1c9f99c914b16ee90ca3463545

SHA512
619e1f98da7f4ebbebd628f69bf5b206595d0503b2d0d3a87084364507697352e644c7ff7d2eb759f7f6108f3136bce0c295be710786156f77a83b8171ba5fa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1fb7e7cb8d3ccfeef4cdc7ebaaf166b

SHA1
b2778c37c0311ceb416c24ca8016c532212cb737

SHA256
43e444fc88131e3a9431951ed1967cf33b67c848f20a54fa1fe8e6c2c84e1fc8

SHA512
68547f62c20f47e917a2d3b5fee54da5160390b08a5fb98ae33d3a6174e1f1d3d3e44e85a42576a157f606d5cae6cd3e375e55ba916e27bec27f9e0e5f22f1f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ac186d40db1d2b1e16390eaf904f292

SHA1
3c75160657117ac9295eb3015de15976d518923f

SHA256
9a19a0be0a105b6573e67832a9f98438b7cab4b7786022f3459e6bd19ecc9555

SHA512
0260838c840aa4e4af557fe8d75d13a191b6df48dbf43f5e8dbf7fac18b673945bfe304ad6cf93953b79ec8c790500996ce44a22ab6ba67f5b80fe1c605be67a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50ce341997ad86585d20e0733e2af47f

SHA1
6afd54d2bcde6d15609c528ab03d76bdf183ccd4

SHA256
ca06c908e5fe3a9c4f8cb0179011cd5a516dd6f1b8330bd8ff9aaff978738242

SHA512
8e6d1476242840e4bd4dc933086ca7cb2dcefb441402c50b192250a1c120b1cc33204bb3cb196888c7360c459430ff9e80133235af84723271ca6d765f68f450

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3322c1b494a526c85a1e9e0907528e9e

SHA1
85205b0a585e549cc0eef18687868131d6a041b2

SHA256
2db5c11cbda9bc727847013b0e3f43933f6cd189b009ce81c00d8d9d3de3fceb

SHA512
8f2c0fd089f02719572b3b9cdf2491673905643583b984ae942c5e3ced036270f3ab148879bd02c984ac436dbefb3c7ffa1a465bbfda43ed489d5523508b4bc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4b7c8d9d76cc64af39998290104c7c5

SHA1
a986e2f7aa5daac5d3037872b6554858921a4fe1

SHA256
ac5cae25b6a888f0eb88fae7379c711b63b5453dc1960c6c060f9d1424d1951e

SHA512
c11fff8ad499b448f0c19301a14163ab8b77ef1bd9902f177f3572b5ad8c6e8c88bda1326e0c1c01ccc31de46e6b0a79f8fdd96ac188772c652bd1ffc2d34bc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
798a335609ece5c5c17f12abc6abe21c

SHA1
43c19be4e2418ae781da88101d4f14d5a777810f

SHA256
21a8b092efe5b5a37db98d7b559132b59ae3afb068e8757a7ff7627fda8ab1f9

SHA512
8cc244d363ade467b19ff05bbaa08a7f1f60e363aafc9f42f339430e1d11666bc9d071649e3705c4d0228d4ce2be9ed65aa47116268a47694ac9e1b8dbcb61f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
034c0a4cee185fa14630965d8da2ab06

SHA1
581533752ef668eaefd06f59c908d99c0c7c4f5b

SHA256
84aaf1eb37b83b43723cb7b25f6da87dcb2f5edf717168d61ae18d3ed6d8b2f6

SHA512
7763b7f89f87182625853e3cba0f5c461db14adc93a6a7cbf1597d1f50d713bb00945094231b7a1b0625278685ecd2a3945c78a28ff244ce2de31505b69cf33a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acb353f255d1b3b003b60357da065220

SHA1
d5bcfb80de7e4f0c5ee66ed34ac9aa7322847c6c

SHA256
5356a8a1e44825c9ea091b62fe7f58453a5110ce6c219ac908f208deae8cc165

SHA512
ff6573ed5086b456e58695fec94883111071bf89598d8c5d070fb4ef761815c3e6c95789d3f553da4a6ac65836af25c90dd9d5ca62d6317f3cd5e02a3e06d7e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1daa55e7f55575c95d8ce32e6fd5616d

SHA1
cc2ac6c1b3301d8e39b8ec9ca35fe64a2c68a921

SHA256
475e9a35b8f0c59d485486be26dae2b116b93e3ffcbfeedb0a84e06f1add3f65

SHA512
9f00e2e884c1edc4629d80ee77eb51db863cddf32f1819fb52633cf9d3de82c0ba1cdb83401ad8faed5e447b198a8ed4dc4010012b386aea951e5e0f892a34d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcc7335794570e30d0520e81fba3e018

SHA1
cf9f6a1768643f3223e1f4c5056aafd0ac30854e

SHA256
615a6c43255859615f64ba0096cd85c6ffbb1573c166cfb3685a24b0a3fcd377

SHA512
3c5a606b52917e8b6fc93a60c408add63029ceb83c9b245063bdfabffffd1c9721cb9275fddafb9ba5dd93cad956f53a4588464a5db6686983f5fa20d59323c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4F49.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5047.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit