4d74bc54a4e52e6363a6a650339d623f9e7b0f82df6d5f7f400e3e353f5d5cd0

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5a220844dc3f020867a4632905c0972_JaffaCakes118.html
Size

34KB
MD5

a5a220844dc3f020867a4632905c0972
SHA1

8508bcfe2dfc42b9dea2ccfc0570329b2b8d90a3
SHA256

4d74bc54a4e52e6363a6a650339d623f9e7b0f82df6d5f7f400e3e353f5d5cd0
SHA512

31dbd754d21fdeb6c035430992d289509c412a19ce6f2aabf9af6badb5a98b32981ed4d0086b18f70562b49ac353d4964460261233796125503c963de9897379
SSDEEP

192:uWffb5n03GLnQjxn5Q/mnQieFNntinQOkEntSYnQTbnxnQLXCDAMw26k5195+Z6v:4Q/jE46w12JhGTRTpz7Ow

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424445111"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0197CC11-2984-11EF-AA16-D671A15513D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1168	iexplore.exe
1168	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 2604	1168	iexplore.exe	28
PID 1168 wrote to memory of 2604	1168	iexplore.exe	28
PID 1168 wrote to memory of 2604	1168	iexplore.exe	28
PID 1168 wrote to memory of 2604	1168	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a5a220844dc3f020867a4632905c0972_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23b4134202709d5c6d5f7881348c2041

SHA1
5754b7332deff1894a3aa3dd4d9f8f4e0a80d2c0

SHA256
d5693f4db4900617f9b86e27b32610d5913db9c712e53a76054f049ac5895cc6

SHA512
de3b188b495c7970f8981c113d2f0c6febfaa2bafbe289acf956853c139b51983e82c1b495eb81d8ab50f8b6f64604cfd4da22d6f20d71ddfd1723d69e6309fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70be5745e2b2ed96449257a688db5f75

SHA1
84c54ca0cf4475495e5736a962299b6ab105ce3d

SHA256
7d95085eec965e2b583979057d2eb06db87b0bef743be0a272c43787f475e315

SHA512
7c2229b4da8125b24c7fa1b6fd5e1eada5dbca58bb6de2b9ee3d81a9296cf74c86e46440dbc0c57051b0209fffdcc3d3ab0a66b2859152cf3ad56ca67a15a075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db61290e06278738ffb09305aac30f3f

SHA1
6fa857b3915e99f40b484f1bc08a70fc5f4621e4

SHA256
cf23c01afd0f177245e322c58fb12f8062f336c40735b821a42c0bc87e0cc12b

SHA512
280ca1d52087b011d14377e1c016da6fb30b45318a3a180062bda848f9b4ae5c37403da8f14fe8d2007753eb6e19640a91a0b188898f05f86cf8f07dedeb532a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce3f7483ae1247557a4b6161899ce455

SHA1
71e78772571506e1be428924ff7dce99c82ec1a3

SHA256
ba5ad8ac0450c0dc1d10af87f72226f8f8cd70e378f4cef5acbcb387a86e82e9

SHA512
debc1afbfc20b853e9b739ce3fffcd2e5fbb735f47d5afc7935dcd4bd75c436e0bfa23b49cbe0bacc56a5ae2f5dad005a24bb974d1cc0740aaa57f7a0861915e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e263c48c7743eeef13f343ccc813486f

SHA1
7b24876fc514701972035c52728d6c207945391b

SHA256
7c8d25116670a893382bfc8dff32bf28cb467eb18587d20caf96043b93255643

SHA512
fa3fdf6584e0289bc7da1778fe310233f967fbfc89e4eee0b5eece146d011d3a923a2e0b2c06620a8577d0092f61a9d1ce8f5286e14cfa8e02e31cbde053d26e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b93a15aca0cfa10d1fc478873b9c21c

SHA1
c4f82ca90a60352079e0f8d107f724a6fca284d3

SHA256
ea1a235bf9d6f913ba584631db3bec881f86c0284ec998d4dec1dcc145055ee3

SHA512
d76ad71f0e8222897482b2f2d0ff4421e8753a2abfc3f63faee1b27bd6fd34365f48dc233af741599278b5118c0c3db720477c7199396cfac1d9d97935c1bb08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33c63331e0b5aa7e480418b2a429acbf

SHA1
369c02d87b385341b5f5f813ac1549335781b52d

SHA256
f6e2b0e27c95ce7127b76fcbab38b569e3907bbbbf844b0e3c3ac65a6538c198

SHA512
aca1b520fe356111af63177430eef6ef620e4699bb62e52abb55bd27f20ea8a3cff94f586ee50122a2320b71a0702fa088ee4d8fe6e1286f2ed15f93ff9b17c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a3443a0cf461159b7fd03febfb586a4

SHA1
ddc73d93bf3445ec42c7275e0169e9ef0949b35f

SHA256
0351c937fbad5c681e27872d8d19aec5c5f1afa6c8a673c01a9445daf3952094

SHA512
781ea481fc9cda006f33fe4c689d0e6eededd635fd5ccecf1237c9203503680efb25dbef2fbf6a400d8187b40914c80dc85033314edf09f6c32ca8eef56a7568

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b6973e6415763b168c1afd0987245e7

SHA1
e4f0c269df3d74b725173cb8ac80ccdf244c6b03

SHA256
27c49d3e6da2489e60e580a161c4defaaf3d7e0001d3068411cacef0b3630dea

SHA512
c9299db6a403405025e5a862ae8443b82adeb362a406044aeb15e911cb3c887de65a168e37ed5adecfcdff29c526b8a8c824de17c2dbc6a0792c05168a79cfdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7207.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar72E4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit