2bb9683899e96e022f804d5c24caddf13c19eaa8751e320549a8bbad5d0c3fa5

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7ae053d33a21de7fc51a5e959bc6807_JaffaCakes118.html
Size

19KB
MD5

a7ae053d33a21de7fc51a5e959bc6807
SHA1

bfde0cf0d52a47b20fae0b5fc92967844632b048
SHA256

2bb9683899e96e022f804d5c24caddf13c19eaa8751e320549a8bbad5d0c3fa5
SHA512

18d7f6c9f3878eee5c5dcdf61cbf44cbf458c987c0f984a7edb266a81c52aa54852ce7de6102ecf4d111eb28d82f04ce0cfee6f0fb140321493486276667fb28
SSDEEP

192:uwn5b5nTDnQjxn5Q/qnQie5NnbnQOkEntG0nQTbnxnQmSgHMBZqnYnQ5oNnlnQVx:oQ/UqiL7l

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424492841"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{244A5E21-29F3-11EF-90EB-D671A15513D2} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2428	iexplore.exe
2428	iexplore.exe
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2272	2428	iexplore.exe	28
PID 2428 wrote to memory of 2272	2428	iexplore.exe	28
PID 2428 wrote to memory of 2272	2428	iexplore.exe	28
PID 2428 wrote to memory of 2272	2428	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a7ae053d33a21de7fc51a5e959bc6807_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4abd4cad1b48f8283da9fe50f22caedb

SHA1
ffd294bc30cc621b61b54da0a7154cbef3f166c4

SHA256
b05559ed015b2ee47c5d199e62b1c0feb9073bc60c8d0b91a0fd8702ddbaeaa2

SHA512
23fc1271abac619ff4e3b2c7c090fda05711cb06630f5428f8e7c51e50e9d4ee0c1a5e980d2792b03840825b71c7c252f1a28e4a28ca3e759e466eba226f3179

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96ab7d5370988a0dd829335b6a75870f

SHA1
d0f73ecf91e8ac53fb6ba42a2f51949e18bbeeb9

SHA256
25292b6d32d1779776ec896c187a3806ac57f297b6e40c7c15aad83dd164e111

SHA512
26e82bfaa0a997599d76ef6069584d8fdc741349d0d2b17e728e5966cc20e8f91c5beb24dc4999e82c5c946c68db7a6aa149531495c25f454eac6d4995db8e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7636f308d23aa1b11fed00438ab6cca0

SHA1
684c294df587275dc3f061ae3f2daa037165062c

SHA256
f0abee07984664dc54d68187a56217e8159c7e5a63edc6978480ac3fe226e141

SHA512
69f0727d689e3e7691082689166c88fde9c455b40a85766a01501a6d100b1bd3b8d0cb647f1ce5219dc6038cd7162223982d5689f3bb04d62ebda7ce92c06cd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da3284190bebc502432a2f523c2e7537

SHA1
4cca716bce097dc045153dc4cff8c902170be576

SHA256
632f5bda25be7a3af94729637faf187e157f68beb227d8fae37e913087326166

SHA512
3d29c94107790026f2786bc158e00c86b0d5c7930bae1d1cb3923b22dc0213fcad91066a5cf0b1ba15ecd75a7f367ecf22ef579cdadee4f4dabe9a78dfd5ee7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f0cc7ab45c85087bd66f2d77ba01cb8

SHA1
ecfcbf05351e6979b48f3a5f6c0b3ae680f28e8e

SHA256
8e2acd1e6752730eb3d9b68722f6149668469a2bea48dcccf45710170d331c11

SHA512
74fab5840f5bdb2b04e7051fc269658e4e3aa4f4c38461eb869fbac71993e158182eceb3dbd4c4e5ee7d9f3eb0d7a227169a5dd5cd6553338a7dfd49424a184e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9e6e4e26520907b87df9bfb5fe1afc1

SHA1
267802a6be27c17546cd6790e1fa84bb8832487b

SHA256
42dec6964be5d4e3ab33d9e874cf1b239cdeeeca81ab206b3e358e74f1d907dc

SHA512
9594a36faae8f4455bad24871d40cdcadc52b761951304de5574ac694ce9e0d59057eedcb5e88e42766ce6b3558dae4dcc9830f6900bf5e3ac55557c8917eef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2601f4311294754828329dee7b0990a9

SHA1
2003f88cd7a98598bd8a4bfd6e5f145d7b8aea2f

SHA256
e870b581653f63dcc67ca3b07ac1651343354c29115a72d2779ed3188c5f2186

SHA512
341292245e51ed19ed73d609bc3317b6decc1d91986bf4f61927ba0e792e70d70bdb8ce04240f66b89b9243c5d35225c6e262d4b848a923ee131ccb0b8fd44d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50a6068e0317d18d8defa896f243fd12

SHA1
104983a9f88e2de7acb2cf310dfc56c212d118d7

SHA256
5779fe475097c765f185e8aba1a53dba087fb585b348055dab490c729242c748

SHA512
4f708ad91f7b5fa40c28a7758a7237acf77fe2e280a9457c45c72a81c8ac5665852a57be5e7715830d5030980ca54fad6b0855f8f0a53567fac6ecdde80f856d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e8d23f63126d76923f9752d84cfbc6f

SHA1
1f3ad6906886ef55d5e2de98621b1d1865ed5570

SHA256
18dcf940398a1f8ebb7a8365fd0549d35a2714cc8b3af74652d68000be6d98a0

SHA512
91bff64d53d595adaa4a453d7cd34df972d238b681a84fd79878810605e576f2df1d7d0bcc4851ff4da2a705aba9fda8f94c869efc93ddcc834d687ef5c03afc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab10C5.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1168.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit