7fe166d32674b0ffc7ce9492517f4d8fae33bc4af4f631766f81fada219b4d5d

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a34a31803fe191fcdac8c2e558899766_JaffaCakes118.html
Size

34KB
MD5

a34a31803fe191fcdac8c2e558899766
SHA1

06038683e2cd918f78e8365f078dcf08692f1f36
SHA256

7fe166d32674b0ffc7ce9492517f4d8fae33bc4af4f631766f81fada219b4d5d
SHA512

41c7a0c8be75880f2a2ae29ec9c1ad1f98d95fa7b34eacb32b9308e5f69ddfde9a16781626282125e538675cdf37279ebed6d2a53343d2a496796cce68770a09
SSDEEP

192:uwzkb5nE+nQjxn5Q/fnQieeNnGnQOkEntdBnQTbn5nQOgPcwqYqcwqYicwqYQwmK:xQ/JbeI5wmmNakR7nLI2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424402570"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F69486E1-2920-11EF-B5A7-FAD28091DCF5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2016	iexplore.exe
2016	iexplore.exe
1088	IEXPLORE.EXE
1088	IEXPLORE.EXE
1088	IEXPLORE.EXE
1088	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1088	2016	iexplore.exe	28
PID 2016 wrote to memory of 1088	2016	iexplore.exe	28
PID 2016 wrote to memory of 1088	2016	iexplore.exe	28
PID 2016 wrote to memory of 1088	2016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a34a31803fe191fcdac8c2e558899766_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6189c92b8f51549a0acfa62d4a2f6ad3

SHA1
e03d28d3cc3085a0849fffa7dd089c47bc2b03df

SHA256
9d47a7f7aafc914f3fa008577311150e1387446f3400562c89e7d14eba60c5a8

SHA512
c789aa26443d7c8a7353bee5041cd2b2b5571456dd4fa255e30d538a55f4574d080a164a1966728e8b05ae30d6d21b66b13c89b9ab49caa2f450cac43f3230dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
faee2f8e2fee0b08438abf23b173ec53

SHA1
bc5f5339bbd7ac5a1d1d04bd0f2e1d1ef59ada3d

SHA256
ce546eaa5a9d1ef3db219d23e2efe62bfdc29f9717c5f997b1bb0f194f46e6b2

SHA512
e275c0c62aa46ae874843c49e4d48da69cd6b175b2e75b1e6518937c468ad489eeb9d97a9938ae1cd9f72b85d893df3ed052a00b99f68adb08ed3c8da941831f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23858855eb0c6ce23ff5fc1bf0783df8

SHA1
5e837bb323ffd0e74980018a9d8e022f34dcf606

SHA256
024c86b4e2c0de32b9977e7fd77a3c43b8bdd73caa2199163c9731c1444ecbc1

SHA512
ae2fcde20bb54a1bd6e85e70ebba40f9c57b09592879c9a1a168347f81774f9f3da873e58c98b346db0d70b4c12f8c4cab4529c0cc472dd9ed748ec9a8dd75c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d18ea871e8a7f4d2057bbec47458c5d

SHA1
05a822494148fbc9b188a45cc279865a036cb181

SHA256
718080b899ebdfec2b123e96e2099c2b696168b070c892b8271a04864852be73

SHA512
992dd49232d16f28e573294cbe19caee9c91eb14984d890adcd41ff840e4004b3c288c347d8d5c558972793f91e078a3212cbfba8e765dafd198c891ccac7bf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6313f59bd54f296083db5287f424669f

SHA1
11f4492e2d62268f7df089f7aabc8a5ffeec7a56

SHA256
b9515ad3c758f4e7add66202a1be20b741a82358a7eb4e779631ac790798bb6a

SHA512
91ecf49a9f52b82d0dc91d0bdc3b86a7bbc1c663842b68c23caab589f11bbda4380fdcd21e6f4e5961f27c17daf7ab1977fbc5194777e44aab4323fdd055bf6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d10569d6713ebcdeb0fafdc283492db

SHA1
fd25563b11496061b51f04c661fc27ccfcc15d1e

SHA256
531a19cc63ced3add7a33bd7143dfa37b6292c54a5d1bf0ef3dceb85517f7b97

SHA512
54a8b5b2ec3e3977a239df1f3b1de7d8ceb10d3876309b21a55860b941dda48d4d69976ce1c03745c4e17c2a72ed88ae207e61917eb2e46f397b250cdd6aaf6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42c88d32dd4d92a89367ec5af34dd07c

SHA1
6d43755fae248e85d371c57a66fbfdf5f10229a5

SHA256
3b2c6c15454d35697a37e1c91366fccfe6e6a031c1b23c504f5d723c33984754

SHA512
d8f34106fde8d761c300a5fc7693723d023fc1a89c956186b564a3980d998e6cd773bf1eab14655866c19d8dcd13c58177b3c213217ceb5f9fc0e437823db919

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04272c78575f5dc74976fe9711c8be68

SHA1
5ea638e78c53e8950306c02bc0a3dc45ea5c9fbc

SHA256
71b9e8094e62b870fd47ea47e2073485195b52b692b3cd5c00435f46be6b3798

SHA512
456f41add24c57c79cd34e71dd4c22b1fcdc8fcf96a8057f44d3bff15d1983c54a71a83f0e35a23f5e73c71d57c3139a22eb06f8fa395612fda1ee1e2961d85a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CB6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D46.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit