117693b6402c18b8c1c277fa43f101c449d17e15ab5df75ee728d6ca9a8d362c

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a59360a361395098187234831afa3e0e_JaffaCakes118.html
Size

103KB
MD5

a59360a361395098187234831afa3e0e
SHA1

40265e9ea12d2c8cd8e9e4e600898faedc1ce617
SHA256

117693b6402c18b8c1c277fa43f101c449d17e15ab5df75ee728d6ca9a8d362c
SHA512

ae00abe3c725d33bb12daf14e5e2a90390a953c38b93c97b0f177fefc8cd64ed98f7642279c3b15222767d364374c69b4ea87d850e3727816b48ca922d1e4356
SSDEEP

1536:ah0NCYoddP2N35P2s8Xe86Jvi+rjgExJpWXiiCKKTC4SzQCM8j9XUsdR82+SX:1CFd+5u2RUyXTdsd8SX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C158C8E1-2981-11EF-BBA4-D2DB9F9EC2A6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424444142"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2044	iexplore.exe
2044	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2004	2044	iexplore.exe	28
PID 2044 wrote to memory of 2004	2044	iexplore.exe	28
PID 2044 wrote to memory of 2004	2044	iexplore.exe	28
PID 2044 wrote to memory of 2004	2044	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a59360a361395098187234831afa3e0e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bb41bb006ec8e0d5870ffc74b7024b5

SHA1
e7c9dea6c4b9ceceef8039fe822c378cd0d0abf9

SHA256
af2efffc4b6c1c7ab9360f581a34cb159c4d09df28e2b48f9991a5449af0d2a4

SHA512
664821f93f01697147875e55f30691bfaadfd3ee147950628cc8ac2470bd4af726c496ed29664d2ad8a8304231f0a9d1621ae59e112d7abf0d67b12be7fc4269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
958719d181d79604f988251e11352c33

SHA1
2b55cd79fee559d1c9762b4e7d57ba5b448f12eb

SHA256
7892c3a0505ea83b997f9143e8cea43ddd969c67570112df878e885ff5c2d066

SHA512
b3378d63f927fef8c3f2f67643365421bf4872b42ff7d547f821b58c697848198b9bbb7ca48e4bb0d836f246ca1f0a1e0cce73ce9baf3b920128c735b421a1de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95c8aae9ce9fd6f4e712d98440b4b127

SHA1
a080232e6cf4cd30e7108003804a41d696c1bab0

SHA256
8ea35357f5ad167cec9481020c477331caed8b565195f3be801726a6e99b5b17

SHA512
cfbb74c551d8615dd5b531faf88db66ba1b41644db2e00a5a38658a6e6820a521a03523b88f99d7d1f8758ef670429db12959be8fbf50962bab0575a7611c93c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5815e202d4c0139cd6935fa28ea475f1

SHA1
41673bbbf799c75965ef5c888d4721ab075d5b63

SHA256
9115bd16d42f8dda136d2aedf5d92db0f6e207ce036fcc9dcd2098895f8d97be

SHA512
640c61785aec7eaea256c1147152301395fb262abd86affbe1de13ad0333cbb8e6facaa165335fa037ab70ed79a234e29560af1cc692da975bdcaccb8cddb284

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9ec3ebc40cb29bb018a9038e758e751

SHA1
4723fa79fa33aec51f8fc8777a14e5ee1b48f913

SHA256
80b66ffc57b169e4175842e2d64e5dcc86083885709fa14d1660fcb0b9913fd3

SHA512
d509ab346b671694a5e1b96312038fb8eb5da866abde6c4ffaebbbdbdbf1ce4cd0a909c777fee26d7ff32f271530e8ae427b02157f8bf819c099783ac360a0e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a749a3664a95105f1a8adc0927735d3

SHA1
f560e1fdc0231bf8c1b0ccb0a169282522d9b080

SHA256
07ef243ab890f7ecdd94a9efe5feb92cec864cf68b634dc43227eaabbb839727

SHA512
489641a05cda9208337b1e79f37fdde4f2de5a70a1ecfedc8764e01804aea5d9e1ea41f3221d7c72a3ce528daad5584d8cbd9d0700f93dcc638aa2af18c0d042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5282b8441fdf345d977ac6f50ca2824b

SHA1
3aba2b4686a8065aaab2f97d0ad587d5a7428eb7

SHA256
b75f6ba8c102cce104ab774e91417d240c4b6b2c4ba25887d75abfdff4f9aa31

SHA512
2a11855108f5488038185cab9136e2f778461edb52008b6fc4d0206795d6308140145bf21bd43eed930a8d4b3edbaea9aa7f62d8a6c03b77bc1192857258fb3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8653e5842ea04ce63d3e38bb84f889ec

SHA1
f4283fef117ec9562791ae5606fbd843239d118d

SHA256
bc1e01674913260e970de71974b9bc8131e98a8c12d74d02a60c89fb54a74d1e

SHA512
5cae6b8101288aabf6c09fb952d7caa708291d1a2778e5fa5fd0186639fce7f1623e2ab59f405ed0cf6365f87b10949b7b12104b6960f724c8a03a2f608ba279

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
741ef6d90b208c8c4523bf4eb757acf8

SHA1
3c6803eb98244e96d81236ed13edfdf3bc97fdbf

SHA256
a944e59a7e91a4d65d229570f02ebffc66f95e8455eb798478ccb77441e7a3db

SHA512
760cd042ff6a4aa845aff87bd45cb4b55e04aaf0d5ded8448329a8fc9132e04330b6fab24459c74023126b3dee7fbab7e9ef6b3beb2ff9f17dda3465db7b365e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1170.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1223.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit