8279152029f303c5aa117b3032365a0d49dc00287d393ad02a9b29b29b62f8d9

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a75b7212864e090af2864ec9587a795d_JaffaCakes118.html
Size

27KB
MD5

a75b7212864e090af2864ec9587a795d
SHA1

2ba1fae7d17ca3325374220b20579efb2b40ce68
SHA256

8279152029f303c5aa117b3032365a0d49dc00287d393ad02a9b29b29b62f8d9
SHA512

6ec451c4a33661932de8a156d933cefb9d1fd69cf7411ffe4fa2cbb3a2722f71205b4357b0c2bb25f0e200113064f92b1c27775c3d9285ad6d30531111471ee0
SSDEEP

192:uwbwb5n5OnQjxn5Q/cnQiePNnWnQOkEntoynQTbnxnQ9eLzd5m6lPxPQl7MBvqnE:AQ/Ywzdz1xOSpie

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE5904A1-29E6-11EF-92E0-EA483E0BCDAF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424487543"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1724	iexplore.exe
1724	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2916	1724	iexplore.exe	28
PID 1724 wrote to memory of 2916	1724	iexplore.exe	28
PID 1724 wrote to memory of 2916	1724	iexplore.exe	28
PID 1724 wrote to memory of 2916	1724	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a75b7212864e090af2864ec9587a795d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be2b3fe4e78cd0836f241c676cf24f4d

SHA1
248e06a9d9a5e07c8811f2f87bd4531378f26f7d

SHA256
3e6c043d654f67d073e6086736287ce59da95dacb5bb9875dedd4d7807635030

SHA512
61ff2385b2901704ed857ec548376f6b74ca4dfa4ae486edef417287861fd46695ccfe9182aa0da47c0245197df0fcfe8b3da8a1e6c169cd2e0c8282bb5364dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d1447b2ae2123ddccd207b78783c52c

SHA1
0c182eaae79430bb54ea4fcf95d612fadbcd1616

SHA256
8f6dd2fba5c40cf2a9eef4757a9e041b7ae8c06775c6095b78baadebad5319cd

SHA512
9df2b9edca114bfae7d43929b2ffd0b96170f00f81d80106b18e0f8d9d5a385b458ca3fa4e8f6d5456ff7b7303a0f3d0ece7ae29389a8173f9ef116981b95057

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5dbfefa7fb40125217775a182296072d

SHA1
02e0956aff611e2858ed6a2f954536a2d3cbbff4

SHA256
0e241d9618720b1be08476f2980f8a39e0855021b1e5afcf58071b221eec0736

SHA512
65b195671574b0e2b9ec3af26dbf9b3a460976661e9b6c11df26f5c9dda0171407e341a6efe27e09c2756f1f8e677da355b0734f4773051cab960dbddb63f61d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
036447c3df7903ba5a3fa74c8e1d67fc

SHA1
819794c5df876fca145bf50bdfb3d33d5bc5d4ee

SHA256
9aee91df2acccf2269cd776ff0c4b019940c17b6d8d4f791b109199c7a13efac

SHA512
7439ec6b56c604c84a48ee1ef182a5ce498976bc666c48b7ac094bbffb1992965629f42c9293e724e9cc0c91e883aea3a2017ec1e764c1e52d112dd9abfd8cf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b04ac9a94339ebfd332081792189ae64

SHA1
b11492bf3356f87b186118c68d87b977fbaa2b70

SHA256
6a4f9bb091165989f5006e1a28a7d5b8deb7c0f5b370ca45f65e4482fc3b9118

SHA512
c628926b1d0edd574ee4579436d9d8aa88c71b92fb0359eb7564bbde54aa3ae5df217ba272b29e31c232e3013b2b21416ed09d5a864f1911f9b5ecd6ae5aab42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edcc46a281b25881d6418d2b9a92050a

SHA1
64befc79fa7403b8209fb468a90c08654db73956

SHA256
7f99f3824176dc85c623ad7ac104eb900b0f36f4de371494b15fa105cd422831

SHA512
1397a9c3bd9cf6c6983e2ca90da42ace857bac76ae629ddf7af00974dd71ab8d99fdf25263544bd3692327c36a5abd5ea3db0a306ac13d3fe9ef083815938bd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b6122336225ac75234361f5f95c21e5

SHA1
39bd65022697026ced31d0ea20a61fc7744c0620

SHA256
6769007fb038f2f912cc65762c7f2e89e43d5eaac7b9dcdc1626c049fbaa0909

SHA512
cfc4ea3a1a62fb4bab35e9648cae2dfe238e92fff2016be08562151404f58a289b666072e3230bd852bcb2edb662413c5457fe57a75d5057140f0c00f553052f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95ac5c519234b8022b0b0d8ed7d41936

SHA1
69bf790b2d5df8b6cc6c0d0eafa216b265d437bf

SHA256
7cd6d6d04bdc85948e0328ed5e1e0e6a1ea4c3ea971a1e9a6be86e0b917572e8

SHA512
827cdabf95d57e8aa948becf5c0521f8984ab2fb97af1eb33a1c270458292f49ec802f331b0d6197a0bdb82caf3e1194aa6c7afdfa6b0d104f56f91704a93c77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07e439e876f1c37d083a6a7c43959e8b

SHA1
e1fbe7bea90a2dc8aed1412cb85094681907bc13

SHA256
11ba74ac074e8a2b66b19eeeaee5843108ebe5b5ab819e4c7afd85471838123e

SHA512
010e88cc915e649605b35a01ccf3a41c1220a1a6644f7ac7dcabfabc35e22ec2deecfdafbad10dc3484c55003925952e3f8126c8df2bb9b594c5aec138c77dc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11EC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab12CA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12DE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit