ded7d5c126a36aab3d369deca50a17e64e901e4a46b40ded7390cd009d397661

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a59c4737332cb6d2186598f9031af08e_JaffaCakes118.html
Size

23KB
MD5

a59c4737332cb6d2186598f9031af08e
SHA1

8a3af6fe3acf4c2d8c6d8af4ff1d7a36ea1c4ffe
SHA256

ded7d5c126a36aab3d369deca50a17e64e901e4a46b40ded7390cd009d397661
SHA512

c46d3cd965eec9b9dcdcd1c04ca55c8cc8c20acf4c32d7fa7421baa28cfec231af81d80774fdfae7a3027bed68634bad5182746d9bb5d25234802899361cbd76
SSDEEP

192:uwbHb5n9ynQjxn5Q/MnQieHNnPnQOkEnt8+nQTbnNnQuGLnLnQtrqMBnqnYnQ7tR:PQ/sGYNk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{19433441-2983-11EF-9FEE-EA42E82B8F01} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424444719"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2908	iexplore.exe
2908	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 3024	2908	iexplore.exe	28
PID 2908 wrote to memory of 3024	2908	iexplore.exe	28
PID 2908 wrote to memory of 3024	2908	iexplore.exe	28
PID 2908 wrote to memory of 3024	2908	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a59c4737332cb6d2186598f9031af08e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c182065c8f0e8b63c4ffd20d68bb19c6

SHA1
236cb05aa32c78adbe8b7efab5279e73f2b98ec3

SHA256
12ee37575d76afb8f0010bc5076f4d6b47b6839a876fd85e626aeaac74d47f64

SHA512
93df73254f6c1c24e4a436e374f953e5d27065abf5f12c78ef6fafc8485054604388074db2f4c55feffc81799abbbd09518c265539c0770bdbecc6b183b2d444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1eb4987af2abf731b4e7b2209631209b

SHA1
57b2894e68b0066e918b00e63fc8aa172481f87c

SHA256
10579d36e080e3f30ac6a773c765caffea2a52a1741895b85768eca26c00bd1a

SHA512
14d772a5ecc6a5190dc147d888ed5a168e8907787fff4c1cc9dbda8262d74f7f8f72c163d6db3742892e7f5a7a1e1ee1bcc4bf774ac0035176fd72a5188075e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59c06becff26ef98d49aa9a637282eec

SHA1
38928a0df6d761a075c54339a4f89e3de569dde2

SHA256
abef8b5b9bf6ab21def32207b6d0a4eced6a6cba792e091d2c5a5c2f1d42aa1a

SHA512
0a78e40b46a298e4184b8f6f21e11ed6d7e29332dc83e51859aad17bbcb31ab3db257782ac6cdacebf575c3c76d8a81457372a4a5e30901501bed084084395f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbe2ba5aab4fa6d33fb16851ff3cc096

SHA1
e771243afec49c35f941ca3e24ab91811f8b70f5

SHA256
cd181890c8e205e035f1e8d2b28cdd93382b0bc28cf2ea2518d8247d859b9fe5

SHA512
465e1bee88da416fb5dd1eb673c8aeb82d9f1cf22bb4fd307ad776e9453ec94b86939dd42810aa295e573bbb21c98a24132238e6caf962653f0e992754c901a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3110707c70895f9c4fe092efd675c9d7

SHA1
8d17681e5cd7d829ec5dc3cda53703c159ab18de

SHA256
2f3cd4b486bfb54965ac2598d66acb7c2c5f0a147f24d6c69069b0154ec681c5

SHA512
52b26e25f24f354229b674581cc08d9b49cf81d6c9c5402b73b59a1511f05d420c15370dd61f086767ad8720a352a8fefa689ada2456b4a94c1facc4956a070e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d92248abb05115c7feda6476f3f2a64

SHA1
d79c53f8fba48360ddb90fc9280a8fbad63618ba

SHA256
d630f31eba263aaf6bb9e01ae2e9fc85783baf6df1745a2a6940a764dc82745e

SHA512
af6a971df9aedc81a90e48a6c97f3a713e3ec5c168ef9d39ded69c423862f8cd0a6f9d5ec2ebf039655b46143e8043c1d9588041d589d9dd7820e4badf730ae9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05017f00adcd959f385ad6c7cb02eb0c

SHA1
c0920779df0c1d330d77f40084345e5a33d0fe53

SHA256
9da9217a1ba967934a4310c2062056991ca3c6f5ba2c300e61e06db1947c1764

SHA512
1d2be47861e975698660e7ae49083c65a16b81b078a42e328a4b469df269d5e618e809a696c6d4570a4bd3d7c820df62bbf15eec6cb91054baafad63df42271c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37ab82dbf73f63f02875e643bd6c8d0b

SHA1
e794b8cbc47539648d3d53299ff30c8f0af5fed8

SHA256
40517c085a4c1f0f73a39938444f84ca662ea689e514049bd581a66ffca6661e

SHA512
e0e7958f3bd25edadec9b865514ade60526fe12e48c11e732d5c2df161b782be0f3c62edc2f0f3fdd36f1a462625a4f107cf8811410ad0f991d82911b255c5c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4002c60b3fd774c2f17a03f27d6b5d04

SHA1
a8427b5f4c009a1fa6a58d75975a2d04b826b9de

SHA256
636db2c9b855fed9d531416546ac69d75057d4bc108b1bff448c511d494e2461

SHA512
9dacab9fa37956b00e00b396f93ef614463701eefab77d652600685ffea53644c2c623f26e2a5f1bd51b66a4ea818b7f81b5a675bb7577cecac7661395b79b56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1392.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1464.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit