fccc3aba84393eaeff7f3121f159ab17473432e95fc12dfde285b84d44e69277

Analysis

max time kernel
151s
max time network
157s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a59c7b912c3647a36ff9fd71181b96c8_JaffaCakes118.html
Size

27KB
MD5

a59c7b912c3647a36ff9fd71181b96c8
SHA1

1d269e3ddf1c213a92c2c30be25522f38a47be1f
SHA256

fccc3aba84393eaeff7f3121f159ab17473432e95fc12dfde285b84d44e69277
SHA512

df923474eeb4da0c65672a3f111db1b79d6e3575bed917a77d9c358bf0f77455a74c441b5d0ac0777c702f6b3d19c27653212e2be05668ea0775c0211045ef78
SSDEEP

192:uwn8b5nOWznQjxn5Q/FnQieoNnwnQOkEntnHnQTbnxnQ9e6Ram6uhweQl7MBIqnM:q4Q/wnMEw5SSx7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28C75F41-2983-11EF-B918-627D7EE66EFE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424444746"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2444	iexplore.exe
2444	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2360	2444	iexplore.exe	28
PID 2444 wrote to memory of 2360	2444	iexplore.exe	28
PID 2444 wrote to memory of 2360	2444	iexplore.exe	28
PID 2444 wrote to memory of 2360	2444	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a59c7b912c3647a36ff9fd71181b96c8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73a8cfe8b36d081c8caa3ef7a459c779

SHA1
4fc889fb7d16caf8040fd4ce952296bee6711f25

SHA256
0e099c58b4b94f0b952595900985dbf229301be4e01ad481221a0df24c64ce61

SHA512
befdb1fd056575f6580bfbd621660cb93826c3f6abbf02153ef3d2c59a278caf6336e64e3fbcc23cfcda88ff6b6dd4ea2b638a68cacee6a990458bef95b54361

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b6938bb19e156afeb3254554b9fb2c1

SHA1
d274e976d395674171fe0e2c64508ff1641cb532

SHA256
a6312f4bee56b19d12cfbc173e897110bd3220705c95486dceb44566385a98c8

SHA512
abe236fc45565cda9e461eda8e8f1ff8e3023e9c585498884fc35d441050af8b10060d020fc20976b91df2a3eea2324e0973bdfd801b4375a7c2859bf56e3473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4de881b6d150c7fd3b6dd7dea40bbcee

SHA1
1fe259a203c1dc99c732d84343509192fab427b2

SHA256
0649b64540e4f3a267f1c911b2d2d91b2225a6c3f4da7f24be2ee3ab9f1b56fd

SHA512
6c4966d09517d126262e00e247fef288524a20a4331fa1c80c38b869f3bd09585224a472f80d1f7ffef3388e8adb18ce7206a3ea3a5f43104b6aed5257de7e3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc1fb087bfcf7d901e8425b5432c20ae

SHA1
7dcf3ca80e87d390e03d4de21df1304b50d251fa

SHA256
903f69a2335bccd6a74f7e3bcb16acd12d02016bc6ec47d625d722d0274055a7

SHA512
361a55bb0dde11a43ba7d8f6215c450c529c6e0cf78558095b72d73471dc6724c56bc2acbb2fe94cf15d591ca6cb6b70f5e45705fad7e719bac6166de1dab80f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97017beef213c8ccc4e046f912db70f0

SHA1
b9eec15593b404e524ec5d2cbe2e2ed00ee8a4e9

SHA256
5ddeab08f74468f462c208dbca3e577dd1b463a638a6500f557e8a609927f46c

SHA512
50e7636ef2a5b953c6a3fb855de523f1905a19ac83242ee7d41136d97187584cc21f2567db59dbfd041a2cea32de073347bfd0d6c5eda852f3383a69cf234023

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc23a0b12b23f52f9a62fd446d25c37d

SHA1
b7ea5689c9f2585bbf4b3a7ad64342229b4ac249

SHA256
db8eb7d4c5d4d9ecb2f895d7f8f280be1b3e6dc0d931c3df2599b84270929647

SHA512
ca215fb1661a1475665472dabca404f753efdb730283a433bab3f3359049c1645a7f918d304c035f13cbdcfd1fa6a5488e640484e22b2f2c84851e33956493e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c5e5eec8bcabbc99875f15f8b4b5ca6

SHA1
5502d0aaf98d3845f0dea5081d68040ed6817d74

SHA256
5bf022a7c5ceb3fbfce107d4e0ee12381b7134c1aab4b219d1bd80d41223af7e

SHA512
d508e6d34b034554cc68eb8713f244491c0b677cc34d14da7f144b9158ecef8c5edb6d5f4501743a6e0b8130d6b7c798d5bc276a231013100e4052680034c89e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b18668ff0ece7130c3a772bae266092d

SHA1
5a90bf6d05c48fe54173707c357528224215d98b

SHA256
24091cb3a00bcb717834a42b0574043666c106ebf282af712e3e4255408a2191

SHA512
f4b11c773ee3275e92ab1c7a87bfe2415d1a33ab08cddde8615b472879c5316bc46515204efaec89d2c94742b01eb6c7618ee2427db1fc1858eb5957e4b7aa9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
577e41cad7e95d033988ae44d5438833

SHA1
ab7ad9b1227c7dc3705f594832bf164cdaea26c8

SHA256
8bcb02fcd4851f65a12b1cd60f00a58bb1e1e08d4b330467f25e8c5eef5996b4

SHA512
baf5f5a96f9e20d83d63ddd470836bbdfd9cdef2afc4b5df83764a61da4d4feb492585a33a14546a508adb89a05df1d497430b41c4ae074f5c5b85767e74f41c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5717.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar57E5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit