910ae8a5f6e533d37035e04a95fdc5103848416ef40af6e9d0f9686fda3f3ce1

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a431c86e18823479e4bbe51f3158a1d5_JaffaCakes118.html
Size

27KB
MD5

a431c86e18823479e4bbe51f3158a1d5
SHA1

5962de44204755cc55d942fb046ebd5d0493e15e
SHA256

910ae8a5f6e533d37035e04a95fdc5103848416ef40af6e9d0f9686fda3f3ce1
SHA512

b26c075345cf8e11b781e42382f8ced5139b3e6e4aafce8220a06059a8c875c3df7537fa68717b1072e60a4dc1eb3c4ec99e84bc09038432d0f9e2fd71a532a0
SSDEEP

192:uwn0b5nLbKnQjxn5Q/inQieZNnanQOkEntGEnQTbnxnQ9eFyam6uXXxQl7MB5qns:gjQ/QcjCXYSzUY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424421883"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED333F11-294D-11EF-BE23-DE271FC37611} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2540	iexplore.exe
2540	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 3064	2540	iexplore.exe	28
PID 2540 wrote to memory of 3064	2540	iexplore.exe	28
PID 2540 wrote to memory of 3064	2540	iexplore.exe	28
PID 2540 wrote to memory of 3064	2540	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a431c86e18823479e4bbe51f3158a1d5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d6efa766c1807b74597c3fb198e67b7

SHA1
f0a59115e8f41337a275c3dc4eacbd7589275a19

SHA256
63dc7e21c6bfb277c73cc5e4a1ea094fa32ff10426f00854393591b7d3bd136e

SHA512
a56357f275d0f2e1f002c12cd696fb1f71cdb960920ddfbbd00b5c877e30eb8452082f1d3f8d5908b2f89a46f94f01dbe2c7df98d8be1ecd6e9340460acce414

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9acafab2e74e06defa73443d9efba7f2

SHA1
71244cda4689112ca9ea47aa439e86d9f8a38cff

SHA256
379d05c938f501ddcbdbe83f44c187480e245a93130505ea31602e793b2e53d9

SHA512
3240ff61daa68ae9f6712e73c6606a13feba67259206f21d507e51791424016a0f76f17eb9e7673c3ba0f9a219bc55e9ac60e454adbff200d13bf75f47e92f12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33660e052a708f08eecb939c1297f325

SHA1
dc79eaa60cbc4e09d5f4d0a2188a1eb94ba75e7b

SHA256
9d9991134adb3814468cf696f4dd1bb1602a8eca3a222b0418ace134636f40ec

SHA512
b5bfc6d34d929f5d36ebf069da933682a2e3ac2d6323e2db07aaa309da381488f835cc22cd2c5f45b0cc3ffb209634bbe299c0c1ad4a0921549d06cec23d3ddd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6569dd7311f8183753f7aee0e1c1ea1e

SHA1
9182b50305ce8f7cafa5327254a7c8d0b12b46f9

SHA256
4e5d6c07922f398b53dcd4bb453ee74e6684799d9f49f77708c7f1f6aab30ff1

SHA512
76cade16863130b8c5511c8092e65098a70e9e9fb08659b9d401fabe6ee1cb2f14f3807a1490d5dcf53e6e8ac937d93e2871b110a84ee03f70649be7cf6e6970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04f54eb24811048b18c33765231f1ae5

SHA1
1c682b7a55c591aa78804c48314a59abb102faf5

SHA256
1b9952e98f301028802afa6e437aabaf2ab47257a3d326e962b47d74bcf2b046

SHA512
5e4bb07822d180a0582273b1bc58521fc08fe9a8e3ecc4c7f9754bd1a56982a8b627969b75417a615fdb60c767c6c4a909ffe4fcc1a5a17584ad13c3c43b8b91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af61ad424d31c9d6c1b84b90a99567bc

SHA1
004ae0b7c703984dd2cd95f42b36df86d613f1e6

SHA256
2729cfbbd26308b77fbbd372adf05bd8a9d047edcb8c368bdd1127e7c3ff0d2b

SHA512
53474ffb57379b4a6f56281cb4ef694e7a025145891494d0a9dc167821c6f76bc68c549ee3beeb6441c6c644b36952950d60e1e656b46e0f2c8522d2a6013e5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee9ab28432922a78237755b93b5d00a5

SHA1
4e1346ed6f9bd956fcf1aeaf0a96fddaea37f466

SHA256
5b2e68aba4bbc6c1b459073195388894fc41e2875d9b123aee5c11eee73fb642

SHA512
368eb1ca2cf02cafab5d097fa44a94e636b8add54619327fda5995309b4f6cee83c3b1f13f00141502b3ab4a81a39c784862667be47922a1340f7fa98bbc70d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26d24391b69851c42523e43e68e71663

SHA1
cd46cc0ce7512296de865198f00ca8b0461c3cd3

SHA256
261b12eacf4adb892032e988692879a618541fe4270e72bc37ac977d10b89e16

SHA512
f3223278b2f3f389b1d22e0b17e5da66ef8f066ad11e202872d8096333fb20e8a82eaf459c0487171a256d0ce3f5b93074502d512809bd8d15f60af443702aea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2a5bab5eb89e11399e2afbe1f4719ec

SHA1
5de1f10fcc4567e9b40129cd26b1fd1664090a77

SHA256
435614f7414818055bc4dd23406d1e16aad35b78deb9c726feb854063755c370

SHA512
a4314c4f890d10a9c80d005d4b63d06fff945fabf8d8b95e5fb849f0896f21370ed5d22ed96857b8a2184b4b0841960000a873605e1d31e3d799dbbec510da79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7C53.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7D11.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit