64a7ca63436af6149c55d75be67b2459545874723cb72779e4305d603d17af3e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a44ad8d66c3572cd09b286b5cbd37c5f_JaffaCakes118.html
Size

32KB
MD5

a44ad8d66c3572cd09b286b5cbd37c5f
SHA1

e47bdd49fc32f684a1a600257b7c0bc6de520730
SHA256

64a7ca63436af6149c55d75be67b2459545874723cb72779e4305d603d17af3e
SHA512

9644519079dbc36b6d74bae507e24c377802315d4ce8382e7dff2b82a4971ed27bd6427ff11789bda14f9dd63bc6f4057bd8e98dd56bf9f8888bea66391d9867
SSDEEP

192:uWjUb5nnsZ7nQjxn5Q/vnQieeNnkJnQOkEntRVnQTbntnQBXCcCAn1e+7XkaGOUU:6Q/yFdC6jzlUURFa6jAiKgX6kOE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95BC34E1-2951-11EF-A490-4A2B752F9250} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424423453"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1748	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1748	iexplore.exe
1748	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2304	1748	iexplore.exe	28
PID 1748 wrote to memory of 2304	1748	iexplore.exe	28
PID 1748 wrote to memory of 2304	1748	iexplore.exe	28
PID 1748 wrote to memory of 2304	1748	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a44ad8d66c3572cd09b286b5cbd37c5f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22d5381fa4e7414c96949bfa32f9b917

SHA1
a76f09ba45100c5cd46427fa984d11c8c3bc4928

SHA256
f6b7b796a42426f777513f9c35058a680d845ab8019c8ffc4c0fba21b47f6d8b

SHA512
f022094879c6c7e41ecad3a8d83770e6bfbc5527c9587de5b1d9a0d5affacdb79ba4ac8164c3935cb2638f7adf7dfe189b1c47600f7ec4377c4b7a857e8fdd3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
788838a50422fbcb466aa8193c5581ac

SHA1
2b122857afa1cd6ce664a490f29d6df33de5d8ed

SHA256
58b4a688e2972ef2eeb2ff4125677f3f1d73a48bc92ac918ce50314e889307c3

SHA512
d6c22e3ad739e3ef372e5e40791b0c5bdb8decfade60093b20d3bca8987aaa0b30a7def400ffef7be0d020fdf22311a2ceace329a5135bd10dd42217728d7f07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d417a0df0f5b5a6b04ecc7e368fe0bc6

SHA1
5734758c653e64aab527cae66bea2c3eeb5d1d0a

SHA256
b1ebc8668959314e13431ceed8a36d722a306fa58d382f88ffa1502c524aae22

SHA512
97c3c68d75d8ee15db38f3911f7f6ad612f77aa01f994541137ec2e0a2fc9842feaeafba321fabc26f60624585c0a093feac42353d1f3f580a34ba60565dd5ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e20ad7531d8ff67a9e3d47e337114d04

SHA1
7d202f034bfedbf83f13b77a54de97d8e464e271

SHA256
90db47666bcefb79446c706bd0d6748b01693a6c8848952019ac6a13e3543230

SHA512
02673a16abbcb8c67058430ba3881df7a4318368113fe4ad31b13a7c6032dcb0aa4283e25d71b269681b252f832642cecfb49788e08500ace22d83ac83d96b0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9abd18654c529cf1b6b3a1ac83af5a84

SHA1
a379d87366b84d9265d764d00505b955e57dd8ee

SHA256
ebe605305fccbe7f080aa88b1e8082c5f9840f45884d300da325a20df8934661

SHA512
c8f52f27eaebd34c3246701192e495f238997d5f12d3484a4e57e8590ce2842a12ae93132ad60a2304918ffa7ef08f41ff168dc1d4d34caf99583b22d6a5c1a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80cea5e77044e9a94c4345a755b69796

SHA1
784a0324d1fbba9cc675092b1481cefdb6b91f21

SHA256
189e0f4a0776dc54b57da8b0f7c5702f022f8c12d5d9bcad949d19d5be051070

SHA512
145def7c972440a3539b139586940ef685caa465833cda62568a31d4cc0dee47eda9617ba4d4aac018e0a6e0c5745202a4092de028e77ffbd872ef3fa823a3e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ee9f10217466f59ea182cc7b5bb0577

SHA1
e8ae904926ab11e391fa74db1682b2655b7e5d98

SHA256
4477b29c55e1dac4e26a464e5f6048e464a8a232b393f91118623092333536c1

SHA512
49624101a5953120133fdb0508437847a6a3828300229f76b3f448862c7ed89e5f90a5b6fa18413b4a7e3c70bb9d97581d23aa85de27e685556dad8a88f9c5c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caf85e40969397a792d3457e9d08c682

SHA1
5f97f216bd673e5217c862ff48243c0cc72d211d

SHA256
9ed69743620a9ef30d7dcc19e89d0ff6a10492bce3a95c9b08c5bdc557588583

SHA512
027466c1dc92b4c9baaaee0fe8b3ddec2400f91b71cbe0a11d08656f017aee946fed16e77eb026db25a72ec7034a22d0645b9995e6dbdcd007bf6f2f7f16479f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aaecf691411b1e124497d7df1e41a970

SHA1
8052b92b9d3482f7cd006729365632fadda826a1

SHA256
e27e2d975ac6c55d133aed6f29c86f639d8c15dabf895b0c94f47bc360445395

SHA512
31e517a6062a57392237a8f27ba6868612f2649d33bab1e693a1729d9bc38826206d597531f139239558ae6780f5db6b53d04eccfe99c4cc85c23d05f1ff1fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC42.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit