94ae25d06f36d54130993c38042c826fbba84e18d0d08d71af386d49735be8f9

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5e1d62ac77e13ea181f3a40652f5485_JaffaCakes118.html
Size

62KB
MD5

a5e1d62ac77e13ea181f3a40652f5485
SHA1

c8346d1bfbc8adf8b6ec24dae7e4ab40d6d4d1ca
SHA256

94ae25d06f36d54130993c38042c826fbba84e18d0d08d71af386d49735be8f9
SHA512

f3305dc998050b77a9685e608fafc6c5cd89987419843018a09fdb8fde62a4927c474f6d9a4923f122ab8c855826fa34b994bf3727fe31581248618ba8b47dda
SSDEEP

768:VgOriWNcaSoagGDd0B2A+GNOuz+Udh4RgUXsH2A7N4Hlv29fK:6/Fd0B2ArOuKwyI2Ax4HlB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000007710601c01881756ff36c7fb6c8a9d7c4e116b04e291eab61a5ec37fa273aa6c000000000e80000000020000200000006e22d0ea7921dc3a728bae2263f0ffc2265ac361441d93a5a3803a974191d34820000000b4750aecb64fbf5df53bed90f9a90a676ecc58b6e9882140d7d62e5859295c0d40000000515329778bb6b2856cc6c1e846823e076db8373546a2737ee9c9ed686eafb6c95ad11ad6a19360571103694ed980528f7e7c4b9fc5d805476aa13ab7eaa24255	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00674b1599bdda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424448649"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3E62C7A1-298C-11EF-8144-CE80800B5EC6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000043944de3cd7bb57f9260e2cf4614c71147294e3ef932d9b52847ea98afbd4a61000000000e8000000002000020000000262e848f085f5a92f1a2d464772bab53ec3ddccb8d93bcb41e73e0d206ac6ae19000000001f19100b17745e398ae1d7756f0592c9411778b3b34c5b60c576c73f0819b38bd70347ace29ffdb15019c4bf883e4b572ced4834a3f9ae7563f1e16eb38e87822fb41729d18a37085575434bd8e3eb39047b577d14524a155e0c9b20b28ef93350c7c0597c6da185290e5dd5e40b3be8dd6675d1bb03e564050656f2015041b6379ed0b4b3ed4ed73f2c4d9ca4a936f400000002afc16a67ad7f5102d2107a06d3afdfc47a12a16e4ae75d6c650f1916f054bb4a0c197185cd4d14b8f1eb6ee4564ba1a840c97acbbaca630ca561d3d0e202c1d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2612	2240	iexplore.exe	28
PID 2240 wrote to memory of 2612	2240	iexplore.exe	28
PID 2240 wrote to memory of 2612	2240	iexplore.exe	28
PID 2240 wrote to memory of 2612	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a5e1d62ac77e13ea181f3a40652f5485_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f272722a9583405bf12c7f90b82f343a

SHA1
ffc6a03c7d6f2d7af2f13b140318a879b1c3ed62

SHA256
f18f934d4c5ebba2c6bd22a26af5a57153690779f1c757b870a3c455a4484c0c

SHA512
308a39e7bd35c0c2df53c9b5478404b25470e614c720e3c12dcef070a180c39fd6d7635bf868ce4426c6f6aeb6284cbd9c22fa4b29c6f479e2babe00712ecaac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
454d3d400c4c4eb497e02eab2cfb812d

SHA1
800ac75eced4487b762226cfbe965cd28d1019f2

SHA256
ad746ddddaa3d902827567147a82c28de01bb2697f720348eea31150a1d47906

SHA512
77a93ec55038eaeb31e2c29edd0d27503dd9559038e3a02a079689a752798a0ed11aee5204474aac663c849cff38fd9acdcfe8d49f73235d283a41f740c25afe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
187c8b440e06278027ba8699bb8e524c

SHA1
2b626ef49ba54f60125cc64ef1ae6fd43296ee2a

SHA256
0f11e66668a29e6fa9fdb16ae3bbb451f5182047301d1493482ae3f9a2d312f9

SHA512
880ccc55a225409f2b0bf4d1603029765d0c0b1a07d2e0d1c5ce30202c838a6c0f919e09747343e6958b9b91921ffc27bd9cbe1cf7f88023eaa5fd8ded740444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78940a81a6a96bcfbeb68d6a3dba9a67

SHA1
63e448d7f56cab6edc062924d90a56776e5b00ae

SHA256
3a400afce8b6f48f98ef09bbe47e1c5046d028f1552f760455308521a3ff64bb

SHA512
a66d322df549b72f49722791f61cbd1e47c9e830d510418eda5a002b0c17061dff3af7c3f241516c6fc2f4cae9fa6ef2bdd3f3ee64a4d07d9234e57464b3129e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2391240b65f233e9281e3ed9ae0c330c

SHA1
284ee827aa47f408b3f674469455d598b6354bfb

SHA256
95fbe49645f08fdac0540008ab2bce3bdcce4866921cb48adaa49ad38c9f2988

SHA512
e9a3e9341e097ba8eb623757d0f59051f90116f98bd4789effa7b4f1ce55c300a121627d1e3041517c42b00dd1d1f35f24b16b81525db990a111f17f74f2c295

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80f5e8700eccc0471be55649c130925d

SHA1
92896e198080c0883c10cb63481c0aba538b85ec

SHA256
8f0729e97f1047d7cac2a4dd48a43a2ff45018558e0cbccc801112e1caac835f

SHA512
a8c35671edc9ea0f0c5d3ea20064125d63d4ed6fb7c66d193cbc23947fa9ada427cc6903399808cd868594d164e8f988db40efdc207e8200b4c6220fa449dbee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed12704f67b4499c4030ab1159d5ac53

SHA1
91f9f1f1f76704e246108fd7a3811414a3085550

SHA256
dca764ee02da99e3ce465abe9de56083a425fd93e99b05856b3c22de2fac59f9

SHA512
e668c9acb7cc206042cf69c2e0fa5db82f8bb1da7a0c2058f6ada2d793914833ce9eeaa1252e0eba8bf839b296ae67c389436c3aae8e52a469f4257179da2ebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf4d2b63dbb4225cc0d26a53fcb621e7

SHA1
819ac00522d91aab285112c15c52ff2f4e6f70ac

SHA256
a87117d813c0f865ea5232aec2c7dff926b9b658e480fc3b6b09793a6359f38e

SHA512
f1f2d3dbd512db2ee072aa053c060a7c642a5daf53c1ff8ba5c70043a3cd9dfba09e5e9e45fd89bece17881d601b6405e7476f5893551d75ed21336ba95f287a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e31f92cc051b80ae0c18d1acc97980d

SHA1
53f15fc43ac8725593458e9c4ae31eb4bbe451dd

SHA256
858a2005af1ac3f397b89369bd5fce8adcf202a3df043620a45986da0ccfdb6e

SHA512
71c2533e5838d637403a245eb03bc2272f58f3e14c890138055ac2c4d6c65b4e528d3562daca0d6f96152c090821432a23f624fef7b324ba67f7b3f481c8edcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
074d30e6a56c3e512fe98b2512ca90b5

SHA1
ee6b739610545056d87c7a02c2f1f21c7e70aa65

SHA256
dbe8580b977cc9062fe80750b8dee76d399797ca1a9ae4930fbdb8f57f5cd7d4

SHA512
0a807b3cc950ab5fac17d97ce8e86c04bdb5246cbebf72c39abc90e06aaaa00a6798f1c00a69a8848e76224f32edeaf822c1ee46e89764c75bdc331302059785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6df798014872d80853fa0ebcebb02d39

SHA1
ed1e97671bfc9ada466d3c9cc41559fa0fd72fe0

SHA256
3438d4a5c740225f96422ee90365605b5d1d3b6a1f20a34b458f933481c58fa4

SHA512
4563170a60b6f8d678809fa268919113f12711a4d80acee08d1d425d5db9aefb14b92e35b0b4149c013e0dcc22b598fc3272743a58579244ac8e93c9e9f6d583

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
059aeeab89789bb7b80f4e6e55985223

SHA1
936759b537eeeccce6ab5ae549551c1a70bc987b

SHA256
16b11daa32452cfdf09d1026ea44d7e620314f41807db58d2dab6736982655f2

SHA512
dd0528ff6b4b4e27387830ae8c843a6be199c6ce544a4d99b5b7e0ed2d8193411d81c44d2ad7fdf6187f344dfedb074789fd6d8a8103f4faea49d72f50632070

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab781E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7A43.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit