df5794735ef580c6278941a285cd2cfdb420bc2c6d8781e30b080a99e6b93024

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a593401aa9ee0d47d2dae337e3f82115_JaffaCakes118.html
Size

31KB
MD5

a593401aa9ee0d47d2dae337e3f82115
SHA1

0e40fc031a85d66c3e01b261dee6ee7d76e556ea
SHA256

df5794735ef580c6278941a285cd2cfdb420bc2c6d8781e30b080a99e6b93024
SHA512

2f7eed660092be484aa69b7d770ae4b54bca0186a80a0f93d3d3b0cf55b0d3448d3716467a481b04f4b4e3aec59042d6ee7fd7c9c9d71ef1219b51276592c9ed
SSDEEP

192:uwXZb5n7GnQjxn5Q/TnQieSNnUnQOkEnthhnQTbnZnQmS5xjn8k9a3ktcBPsajeK:vQ/1exf6kslSRPyyG9QU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424444133"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BBFFD3C1-2981-11EF-BCFF-D2952450F783} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
1816	IEXPLORE.EXE
1816	IEXPLORE.EXE
1816	IEXPLORE.EXE
1816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1816	2228	iexplore.exe	28
PID 2228 wrote to memory of 1816	2228	iexplore.exe	28
PID 2228 wrote to memory of 1816	2228	iexplore.exe	28
PID 2228 wrote to memory of 1816	2228	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a593401aa9ee0d47d2dae337e3f82115_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c44f3c58d5adaf0f6e72e30fc10691f

SHA1
053acfd448d95976b4723e8db039358d8936472b

SHA256
07828db8391663240ebb0fb5e6b86c7b2c434dfcc354dc9f48b2bf3b540f06fc

SHA512
e4fd4b9b0d5917938d7a67f83e139b04f70f31d29329a9151c843034abf7de0e0150557a63e82875bd7559e4e8bafc4b1b0e1dc37e35727bc5fceb373c1b87b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14d170ea8d078682ea0350978e073df1

SHA1
1876cf15ea6715c4892fa2eb596de412f6a0c10e

SHA256
90b36af4ab2a49a16ee71035ac9308c3b40e341fbd5ac6a93c325fb66582e1a0

SHA512
5d22c4fa7ce93f314eb791fa3c39456f9163e1a31bacfc6a0e6da8f46d4c5ed71d552c0dd612c5921a2b4967365b3abd2718b2f3c62568d471fdc7b2a45d30e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d930cef90de4854a5093d1eb45a7e971

SHA1
77105d3f331c2061a7c0329d9d471a3bd14d32a1

SHA256
73d0406d38b102ba9b46fbcad8b7a727beb19a07f9e7fa398e1f289f4fc454ec

SHA512
81fef142d6a5897874d5ad5be09f638da914865467f30625f283d8c78d0a4a36f153d0013bb467cf2a3346eee681fb1e132478617bd46647a7e813f8592c17cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
901fa9406dd6096b4d154126c4083092

SHA1
b9268ac11388adf0eacc3be2ca7135c200c10b23

SHA256
094c751ccdbc003272fa4d4442fb77ecdc3aa9640a7ce1dd429d53f81c84e66c

SHA512
5c59e950d9163fa5b478d41ec80cd592f0ff625970dfe1daea641895a81df6ce68e61cf2fbdf479c04f5c1be8eb3a3df45dcea0016ee176dc580e36a750450f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f40bdd22342890843246d64cd911a99d

SHA1
10d1095df80b1fa147f3dc60a12bceb8ae99f42e

SHA256
c350ee4460230ee8c756acf7d59977ada59d47d8851a6fe6b87e28c32038ec33

SHA512
4a634bfea89c5343972215bd0b1f52ab3c76df5acaa9c1c5c57925b3122d8aea10b7753e74b6d2c9b323667fb21d9781f64028c911ce12bef39e0134df73092e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2888ce5bc62055b6aa4a36a6cf2ea2e

SHA1
7387bc4ee57fdb18be48a003d31b6658c2c2b8bd

SHA256
15694ddfd63023c08ce8309b6cc907686d8b7614030d42197a9817ad9cbcad60

SHA512
ada5fd3811c036d96a2f017d23738804b70689fce2dba97f06bec080c1bce79f117bf6ba75969f7397858f6fc77da2418ff4d7a1d5318ba2d1880274796658bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04c3b9f8bc6c1b6e0b5d053531d2e6c9

SHA1
d51a8784c8d3e84c5aeb4a702c4e35fc9d53dc4a

SHA256
b15301598eea4171c0ec6165a66aa4a0c93d0653dc64e741fce06d87ff8e5e25

SHA512
49edacfaca02cdf27a5d4300b315b1c9dea095ba4bc67344383f26877ded470f8a5ead3dfb6b42dc0f0a7f87e7e65fa99e0ac25055ac0a52002261ee6c1298ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d33c036d5722b283c56c1364727873b2

SHA1
f4a94591b900d101fc3fe1ffeb051d4478ccb0b6

SHA256
183a9064914580f1d077a1411d1a0da117c36f2c9eb2ade846e76c13e515e8ba

SHA512
3f8630e0a34c80a544070ad13dc51c1f122b2e9a34fd519f34ed61d3a22f1c12b9f872f3713f087a7f5164afd9ea1c12ecc427ef51a83ec3eb095e06ca1c4a3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91e344e7787410ad8c88e843e86dd90d

SHA1
08deb7511be338fdea506c1a5fd038a4105682c6

SHA256
477c85c139bd47f32b2b6f5f895ada5b72d4d44e9f353887335db8f31818689a

SHA512
dbb69a5a46135536e5568dd6cff900c7e8017461cba3bafae368bad22da59e72a3ffca37184f9af6a6cebf3060b5951da75f150e0aac3c729bde1db8504b6d02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EE8.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F8B.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit