09d2f345b115bfa0d55b52e106c39923e79fe05e04384a49e41d367f7068c52d

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a5fde9807adaa9aa4c108439f532b0a2_JaffaCakes118.html
Size

50KB
MD5

a5fde9807adaa9aa4c108439f532b0a2
SHA1

257d6cb74950bee0ff191089d8f18464aa4a9e79
SHA256

09d2f345b115bfa0d55b52e106c39923e79fe05e04384a49e41d367f7068c52d
SHA512

a89bc698ac7b4ea5a39595111468743ead3217deaa53a9fafdbc0bfdd2ab18706421508bd6f0d04c14bcc83f1dd79f36c329270cb9a1b35ad9c8634046b43740
SSDEEP

768:GhEKb1LETi7W7XzrZtPkmkM5eec1LE/8ohPMEmZbOZIt:GDZLEO7aXjkmkM5eeKLE/8oNMEmBI6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{377DEE21-2990-11EF-9F86-7EEA931DE775} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424450353"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3036	2168	iexplore.exe	28
PID 2168 wrote to memory of 3036	2168	iexplore.exe	28
PID 2168 wrote to memory of 3036	2168	iexplore.exe	28
PID 2168 wrote to memory of 3036	2168	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a5fde9807adaa9aa4c108439f532b0a2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b68f3ccf5540ab055f12eec4cc2f5f22

SHA1
78a02859a6e182c8ff1f07f98774792e049f1219

SHA256
0d14bf4b8eb6cd5b85efb167a75f95915fb2e552bfd5e07359cac9bd0f8c4802

SHA512
8e01dae702c359252bc6acf527e433709dd0792cd8757207b277d730f1154d3fe2e1282f27a60ef9202483829985917c5660a515b53c01f34f11de61914733c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b4f0718f2f7334227f40ab13405b091

SHA1
252f1c603d73b8016a8094abb08670e979fd6cc3

SHA256
803e505f1bd44f8fdded1dd1947b3c111454ddf778e284d20e141b46d5039c30

SHA512
c1f521df948f9beb9e02d16b08562029c402e8ae796ef2d9b68c700b840c4139d468a04905238ff74039c9260fe4c743d48fead334acdd0e2a95235c80636711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7adaead892aa910d09b8aed0346bd99d

SHA1
e35d381ff32b8ea78a31e8dfdb4340212074b501

SHA256
83fea9dd0b4e714ededabfd489739d1a2e20b4450284b8cf7b4696be8b82ab27

SHA512
10e10f7b34ede543fb97d6ca2a8e72827a5a2aba23d8ae4dc159d42f7cf7847de6e82feef1b096a8808b2e5218dfc05591a2ecf5d34214adf3a4da6dbd5b9a06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adac7738add3203e6b5072d15fb11fa6

SHA1
0f6f3988bb67f2b6c6451d40818b448042dc04c9

SHA256
91c2ab7792b885bec76136249a1f4466acb8c5bc206a3875c36ca0311d42b15b

SHA512
5824b5b853a43c1453cc4e34b46e5e176682a39b9af889c5b98a8249c3443850aee56e0fb1d03c5b09e282353f54c5a18ff3b0346d8c30e90dba2559d43bf156

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e024f76e5b56cb583d92c865e253553

SHA1
755522ca6633356bcc79d01815707799e7b64567

SHA256
677617a2456bb451af6b85124e0b7752b3afe3c3f889c849167c33defab2a4d2

SHA512
1aeb29e5134bef954c960d1e7f10e71950179b15eb7e0df673ccad4ceab4c6a37d69e44d5d69685328fcfd10b57941d6d96c96812c67368af321479a7b7b3df9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a193f88d3cc1147de2a911c6b2a8240

SHA1
2366f7c67375ad8e5e2c36fedbc123ae62d536b9

SHA256
b4216104a3e086d5b98db91255fa32f33d46059eac086fb1dbe61e8d4c169e14

SHA512
76fb326008e8b0a306323aa06857047c14d9c7ff287a1e51ec7a77f44186d5b2e55adabc7f7b567818b2b54b77d4fe64c9920dcd08ff3c353687877ef48f8133

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
574d022c79db262683ee6ab6aa7a75a6

SHA1
f83532de11744fce8b35f85e5c03e5dee0db099b

SHA256
821630d1bc8bfc3b4984905bfcde9d5519e4b937c28f92d5ed20e31d22a8a261

SHA512
85d06a0109fcacdfd4e13846e974cba359c9a346fcb8eed40ec022c53973d8ff0bb3843f812652abff12c5396419b623cce8f311b8faa9ce9503145fafd2cbc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2abc5a6c370ec65844204c8d1874ab57

SHA1
f89a26f6a157fbe5a04c40a1e22cb8d811dd5288

SHA256
6c5ee6c3565f17962301c576ae6e217450f800ff13086334143da3abf91cc06e

SHA512
3e8a4808bb3b56f5770e72e14e774c014934d8abbec094bad4a8fbb11938f0c417a0dfa1c538c165386596732c86dcde939c63c5758bc9e67f0610f0b0eee879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
494a5816d0fefe984933a4f38be6f7c1

SHA1
1176c0992b5364c44c23cdf9ebb2e6a494f1c6fe

SHA256
011a017b7f6d8065d40d7ed898d72cce0179a0388bf6d06ab1cb8d8342556ce3

SHA512
aaba95d01a685e266f9f9582d4117d66d5f88be6cfb8fd798978cf8f5b7ae067df2d55f4c14a25f710bfcda1400298b6d1148728d46f477eb710bcae8e478f9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2BE3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CD4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit