41896282a5a9b3ecd40fb3c43b91ddcc7804192c280690edf9a167d5f087345e

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a526fb54ab77a268d70a5051189a308a_JaffaCakes118.html
Size

839B
MD5

a526fb54ab77a268d70a5051189a308a
SHA1

a8e97d6f9b3342a86af157f0ff8f20cf99e99b62
SHA256

41896282a5a9b3ecd40fb3c43b91ddcc7804192c280690edf9a167d5f087345e
SHA512

a573e49eac35f50260c0c913df1816fac621d979cc3299b2917f64d7e96619ceb42f8563e3a1f985ebcd4ae6ea43c6bfb00c30f2ac33a7ccff18a2197e82b462

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424437572"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{75541531-2972-11EF-B6C6-7E1039193522} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1876	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1876	iexplore.exe
1876	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2264	1876	iexplore.exe	28
PID 1876 wrote to memory of 2264	1876	iexplore.exe	28
PID 1876 wrote to memory of 2264	1876	iexplore.exe	28
PID 1876 wrote to memory of 2264	1876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a526fb54ab77a268d70a5051189a308a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54b8cc9fe30333bb49eea7c066e0b4dc

SHA1
3cd452af42ec337de085439dd635451389944a0d

SHA256
e532a614c553aa6f8d387e51543df94fcbd7feb7cfcbddda5fe118365c5a6b1b

SHA512
17719025d2352046f48343f4e0f6cac5a2ee918caeff05b427899771c3178b6687f6cd85e39bcdafa55813007ef06cf3c587675a10496d642db07e8facc89a20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a85f42600e8198305b76187456f95648

SHA1
d6bb255a811fb1931314123c505e2347256e8f09

SHA256
f1c2a9a290275cff134038a0cc38c0ea8b4eb8445ce1ae7ece7aec3d2a148f23

SHA512
1e18279e28ef175e4a63da16006f98b006d25a41ec50a78a19ea71a128c34d1e0316b69c33f84f8af7ce96788da5cccb197b31330951d33abc7b7ba510673e2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34e51322a7a2a797de014243a8930971

SHA1
012158cde08ef3202e818400623303aaaa9f7b07

SHA256
2e7ce0cd65581770cc8cfe53bda45bcc046b4b4b0a743411086985eba3fa427c

SHA512
516630f05d568ec788ac9f5599df8edca253183813cb76e33c6157e9d75b0471d07bbab36b08d7305a312e2b7c7af029e729726afc1c484bb47fd47d6702bfd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9e2051b05e6d8542900a3e2dd4931c1

SHA1
653759072c113477c61e788afa9249eb1feb7cc4

SHA256
36430a2eed526e77ba898301519984a105a3cec4d9833892b1b7589ae2a09eea

SHA512
a268dd5bc5294859be4bca31dfb7baec9c437c77fe8764cd263390a438db8fae96b102a71696fc9ad67b81d9972efcb33f0ce26220fa58d58c8a6e31439d652f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
422aa1834bfe6b5f2a4fd8942584bacd

SHA1
1b0bf6742e8fa8aa18c6bf7a619c3ab359fee51e

SHA256
98dd6e6f9eaec71d26d60b774d7a6e7f98dc17371178917b1acdaa34c13b7bb9

SHA512
57b5a2abf3a178f8b2f1f1daa6dbb21851c270632cf0caa7ecb267efc2a4c40118509caa243cadca2654d8f1950033f97423671124bdc45936dbf81a5bac9658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fce30cb2bf267567ac24c9c118a8660a

SHA1
1805f0c90a042f6db04fb7066eaa3fbbdccd89bd

SHA256
7559bcd6aec092748b3544f43fca1c3adb456ef650beea0f8ebd13c6ccb2b73f

SHA512
dd222df8e9c034df83172651a2882a515be976bc662cf82f080c93bc5f284132d3d6b69608f2f67d10e3ce2221833530c01487ca540594cf7dff33e8b6762c5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02e69b3ed0025ed548e417a3db0c8dc5

SHA1
1063bbbd89145324be3a8a1a8050ee3206554217

SHA256
4a1a83fd8ef9bed892be311248f8159e790e6c21edf2703e97cf77d504d7ccbd

SHA512
d68b2fc33bd72a22dce439c88965f05f61bf7472162fcf66fb0e1d3968be743883674caa6c7903d2c121063972a12c0ff18ffc7ac5ba69a22360b8d08395941b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bdd0f4bc113715200136713061664fc

SHA1
dac86d4981742ff2f42ab80e4a1c910a065325f7

SHA256
dc47b7b51a3f3a26a8f54caf246c90b0301c011d8f5ea3e191fa766a6bd07c84

SHA512
50ab6fd4bbc3dbd78a2570783073ee6d9b50ea9f9b6c893d6055538d66e5c94f1d297e8454b4f38e002f3bfc7b4a64a4291d9f6b505f1c692aaef23defadba8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
809c4d945ffe5c53894adc1a65cda370

SHA1
d5d4a9c77c3005f49ddf97709a0125140dea6407

SHA256
a7fe66dcfe07c0a6472b899c766448fbab3ef6ca2a184bd0f4eebf0822b1a28f

SHA512
54a742ab253b07fe154ec42a442db8e27e6ae4781f46c5055a3a22ddf0aceb2c3aa0e6e421e4318c9f27cfd1844168e3bf880f86909df85b53469bae07489b53

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC23.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit