0ca218c2bd875f45883ed2a7542a07f7514a06e115c860738bc7cd76d4348bb6

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abec69da5fd8c9213484529b99aaa0b5_JaffaCakes118.html
Size

19KB
MD5

abec69da5fd8c9213484529b99aaa0b5
SHA1

8cf3bc02418650e3bc6634995c2024ba35fd5f24
SHA256

0ca218c2bd875f45883ed2a7542a07f7514a06e115c860738bc7cd76d4348bb6
SHA512

9e1002b8b8cc57a113cc35d577980c9a615ac21fd7d20bbe00eac644d8584255125aad46bbd16ca61b9824a1f8ef522a2c06c2894979943ffcf78a9b1be13080
SSDEEP

192:uwvMb5nP8WnQjxn5Q/CznQielNnznQOkEntM/8nQTbnBnQmSgHMBFqnYnQ50NnlE:1XQ/CzjqCqfO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31AA7041-2AA3-11EF-A293-4AADDC6219DF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424568455"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3064	2172	iexplore.exe	28
PID 2172 wrote to memory of 3064	2172	iexplore.exe	28
PID 2172 wrote to memory of 3064	2172	iexplore.exe	28
PID 2172 wrote to memory of 3064	2172	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\abec69da5fd8c9213484529b99aaa0b5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83178c2576461163a0cbd74cda465d26

SHA1
0c7b8145b7bd4a365d6cb1ca59e3a71995acd36f

SHA256
1e9ca02e475324ecfc7b77fc127a3982f54be5b41a0f8c57122df2d9046f89ab

SHA512
b11348a3e774f832d100facc90d4b9d76697039c0b8bd53c9f5453892eb85b7b7faf4bbe14477decbd0599255e9ee6d676db30735d6cab4a169d47f0741e9de3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
999bca87cb82aa3467115bb3fa93a88f

SHA1
f0e55912434a92bb4c8fd00f3e1048b44225b57f

SHA256
d5892c8cd59c9e509c89c34777da76b69df691e0730e201ca8f154c1a81475a5

SHA512
0d3d815cdc30d9f567d806397e98204550c99e06af87becd4b941fe9a0365569d4277d4a2710c3400d0b4cf87c5792a9a992efe7f09a79d5aa9531a1eec735e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a4a7940efabc0eaa390070632b6ba27

SHA1
4060108b404e1b1df3a273a4a0d086e13993079d

SHA256
efad345e9db0995bbae00247fc044941ebabfe1fa91070d74e22acecd38550c4

SHA512
8d9321a209d3d56dd64323a44d8295e6a646e98d67ab9d82ee9f640bb4d1d288641835affb2d0425a78cab7393c339fa3d5a459abbaaa660073cd2c744e521ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8869f869f1474ad1b19396db00c9b627

SHA1
835995a204d739119cbdd41077b2b0779fecb25d

SHA256
b3cd4eaef0f3a83407b77af0da94972ba5759a76e5f7a4d1f93812284b8d1d7a

SHA512
093ea9c48d57f91c79616179f0dc205c921daa0998cc6180bced17ad8ffbd285d3b848b8175bce05858557b625f9be1a557a5cb7ae549186a2a3074b723be296

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b0feda884149df150c532b1887abafa

SHA1
ba7ba3805506a47f1f393936c73417905bb03997

SHA256
971e4cffa8f54116e97e8cf137f00d9a7de619f67c7b687d2101670b0c801cdf

SHA512
5dc55f8a43d9bc927d7702b3b6af36832bc8a8fe8494ffb5ec7a7fdbacbd2e5308bcc2cdcde69b67afe453d627f4e8b11bd7282e0319d1de22056c36da68eeb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
899488f73221b4ef4da5e85cf489122d

SHA1
c34322971c3a6a79bf9299a83323c353794d0b5f

SHA256
7cd7bbbdd8c6f10c1fcbe7729e2b585ce9bf6440551afaa6c6d667d7fc0c38c5

SHA512
9e51d8d645dafb8cfb288cba7f4049237c7d67407559248032a8fd3d959564a5260ad77bc1a8c95836b57fcc6be95ad66bedd459592ee9e58713d8b7da01e013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
013969df8a853be00ac9272811816368

SHA1
a86b5e7775268b7fd9b39b45d83b5b16ad659d56

SHA256
92a9e7bc5040dbaf988a13f6f061d59123b0fc4edbcf186d8333e900c9b79c1a

SHA512
72b4c4ffd5e73f282b71b6e551a2efea9a5a9b712cfd4522082724c12d544fa135a593c48ac35a61c2d95d21505d968919b769a77e026116cea485f6b57bf42d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0d9f6ec8ac1c957a19ec7b93c8e039c

SHA1
c20b24b7c75fe511cc3f8645c53bb7b439fc5893

SHA256
8dfca15c896bd3f713d9b2568acaf39a0e886921c5a4f6f5e967d42f5a36ab9a

SHA512
bbac15f8aab7850942c338db0f7fc7015558bde8d0729c743528dc8c99401a1d6b5d69d702bcb7ffb9a55e3b7002a9f2457522fec6fde6fb47e575feb7fbde1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c92ca0dad93f8671b2de22296125c939

SHA1
a78bcd112c7d75cc786ab6266e8cc78882666760

SHA256
438be9ccde707f8ffff2892927ebf36f6dc1ee02b2b2da81e7a692bbcd16a4c8

SHA512
e107718cc6aea0ab76d2acb58d496659c7990b113ee19def15e028d080b800f40514174818f5e30a0bcd8344440b9bf63514b3a7d261aa6dafc124aec81e246e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
393839bab93b365c302bc7761b8ef521

SHA1
9a3ea0bddc5078ff677e1917596e8cd523272059

SHA256
b926a235d9dbfd81b760cbfadfdee118ab103c28bbbf71154dec1ab4daafb2cb

SHA512
66593319b3a656738e094962e16dd26d728b4ec4aca0581e5d0076096b4759b2ce2d82f3bc440169c39f64bb1acea4a838726a8f597359e1a737bdfb76ada50f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13B0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14B2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit