fc59d776ec74d2a27bf47c90272dcd434a956d43e31c6c7b897d1d925bb90d86

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab8a8a750864a93cc3d26f601ab653a4_JaffaCakes118.html
Size

28KB
MD5

ab8a8a750864a93cc3d26f601ab653a4
SHA1

dd0c639a13a7988f98d5d4d08bc393677ca6de48
SHA256

fc59d776ec74d2a27bf47c90272dcd434a956d43e31c6c7b897d1d925bb90d86
SHA512

37bb57d777dc2f3883484cd6798c19012c6e56b53eaa65c8532a122118579d2e9ba863b2c32a0e5ed20a84c14d2f5c7caaf312675b84a2382c4ddadca263c2a8
SSDEEP

192:uWD5jb5nidKnQjxn5Q/UnQiePNn3nQOkEntcWnQTbnNnQvXCtASaEgWcwqHA1uQQ:aQ/lqwCVC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424562288"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5A845A1-2A94-11EF-AA16-D671A15513D2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
836	iexplore.exe
836	iexplore.exe
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2016	836	iexplore.exe	28
PID 836 wrote to memory of 2016	836	iexplore.exe	28
PID 836 wrote to memory of 2016	836	iexplore.exe	28
PID 836 wrote to memory of 2016	836	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab8a8a750864a93cc3d26f601ab653a4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f732963d4356751769b69300021d1a3

SHA1
b11ea8e0feaefce9c2ad38f9fb47f7dd43037a96

SHA256
8636e8228c817c1da6b1d29ec8e378cd6d3139fc1b409d816d764994cc0545de

SHA512
b4b68ffd0dff3edae0f7553089b679a7b4e566ceb7c04c9c45360ff09e83ab30151851ff74d63bb2cb19c190b16ab9f1ecde74e26efb5dade7a4137943411e66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a0d1220a32c7af93bfd8d8c63c8e69d

SHA1
3fef0770ccc4bf9f22c2fdc2811b55e1b45ef63a

SHA256
f1745254e74e7c990a2cc12764146ab1009f3c51dc6214efa8a3c7a64bb373d5

SHA512
0b57e22dcde8c231058c64b84424e3df072e1e6e6abd94c08e0565109db34606f0dde9b6f126379fef28709ea50e6e143b69d3baccb8dbb529e815b9a913c037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fac37c520e16a2811c9c7a848520894

SHA1
016bb0d233028011c2fe4a0e6a47c984983d1c1a

SHA256
8cabfdc4c87088de2618ef863d9a15fd88950d3266a642cac6bd2555dc121f7a

SHA512
73a1bea5d9e49c1cf53f2d1ffe86d0bb45297e972b909edabfe1bb5a7395c3ffcf2bb94d42c6cfd27206799af001d41f44d181c6e55b1484a3bf95ad7e306370

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
139f92089e349b907b18061fcbc1e390

SHA1
b801bcf67e1fade436a83d3e3a16cfa1f32ff645

SHA256
b6267c92aa2f5a1d133cb8ab6b43a033f198d73ccc55906e9e7a3df9c125c3b5

SHA512
014e2c38e0e94e8f70e300cab4581a549c9d8598e03fb655a37faac32fe4d14832458e11c42c22aa5566221199eecafd3d57c58dfb295defbfc5549b25b73fba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0be629dd06be661ed30c6937c904b43

SHA1
ddc267abccd0130ec3416b027491e32ed85ffc2c

SHA256
20192bad0ea041ea1c2e98b6d04c76a71554b8a0387d88b052584510e633d83e

SHA512
f4764c2998e13e3f9e7c1e68a9e6e2f1cefabfa2fdc7388b7ea1ffd163538549610a3fa040e635be5bf891129d38d08da3aa8962ed6877e0c39883ecf63fd272

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52a7c459167fc0a0ab2e1e33aae406d0

SHA1
807e8041d416876b61ac142321a93f6c6538926c

SHA256
7009fa9661cb9f337506c351c90d0aa19faec8b33bafea5c429e96544531b42b

SHA512
7ef989fbb9ce7a1e4554405d5fb0db18332e5401fa65f293bb39dd36401485bee8c637b20a1e30ccfab8f5ab9234de797dc7381b907e0d0495dd5fa7786a3773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f49f8b3e14d18ee1d7262a1667794d0

SHA1
01e92449641c5d52e377e78c14118c0df2b3bb89

SHA256
05d504178f0c41bc48829b5f848eda5f6c04d4beeed17af1cad24b92852246eb

SHA512
ac5f757fcd50ac412ce0cb3945d1dae6a66faaf2ee36a0501e43a20fb4c839bc519deac27b02d4b66508b51949cef901a0a0172a14c0bc1e1220e55b5ade105d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e734facead419f30e209739ec2fd8873

SHA1
76994b579232d1beb7de8661a7ba04a53b36625c

SHA256
3f7daebcff5db5118b9a5144a07361cc093a93fd8426c586390427a21726df62

SHA512
2faabb8c23a5761b7c94ae966222f7f29e33172569363cb9f7443ab2ebd0c5d036b9de36daabbaff05887413872ae4b651d824c811c34df2bcb9ce923b88a094

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab698E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A4C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit