4bb4815d850c5bac33a58054ca3ee13ad6299c775a39af7a168d426975874c57

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8c1a73e2e9b61bdf1032d77731bc458_JaffaCakes118.html
Size

22KB
MD5

a8c1a73e2e9b61bdf1032d77731bc458
SHA1

8cfcb5dea2891dd9dca430bb005b8ce5d950c549
SHA256

4bb4815d850c5bac33a58054ca3ee13ad6299c775a39af7a168d426975874c57
SHA512

2a97fa2fd1b1ac7f4e72c2e8002228c6b497d9e084dd3d2176d3047da8f71898dd6acc0f92265652e30eb6bf5401c26ec2d9d8c196030f54a66371ddd91a557f
SSDEEP

192:R9Nm6HoXQg7qFlKgb5nC/e/N/6s/J/2/t/m/V/a/R/p/LnQjLntQ/isnQieVvnL3:MYo6RQ/WXj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DBA6D141-2A28-11EF-9EC9-FEBBC6272832} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424515912"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1452	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1452	iexplore.exe
1452	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2736	1452	iexplore.exe	28
PID 1452 wrote to memory of 2736	1452	iexplore.exe	28
PID 1452 wrote to memory of 2736	1452	iexplore.exe	28
PID 1452 wrote to memory of 2736	1452	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a8c1a73e2e9b61bdf1032d77731bc458_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1452 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdf767427d42c2e336d0e2bc38f3aee2

SHA1
1fca144b59e3e7e5b72be9f9aae3a11ec53388d2

SHA256
a2cd884de28c6ee640a9a05993934edd5001896c2eb63eb94800f9410daaa6a7

SHA512
b96d215c375889561cf57d17637b71eabe41f8bac6ab14cab0bf825c7ab600ab9f067c3cbc313754207e4ad52df4574dc135bae27ac6d0ec4630fafbd851a0b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89ecb2ca0fcb3f107f91cedbc49d59b6

SHA1
aca17131486e8171540c93341440d9aac267bdbe

SHA256
a63c87a9e097e171fd04a5b8a7f701ed735820cb65e5090f6b1646178c78da6a

SHA512
748482777d0857b05f7e5e0042e097f14fdc498951137e3d1fc0c11c088b15cb062f892242a5093058cf8f68d3a72e7c44434d7e2d7b9776ce8691266a104bc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4abedf4b9237e7d9202b7cb05b1d77ca

SHA1
32af4907131f7aea2178687a48c6286b969f05b4

SHA256
e549e89f3cbf7c6fc3c04f715c7bfc9eaab36c0dfaf98c0cd7640af3c2125a66

SHA512
628ccf8e488b74ddd25aa079d2015ee5934da3a1aff438209a358850862d38836dd3b35c8024fbf66101475e50cb6e31a2ad97b1a431d76521af26239f462755

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b156b196edd87eaffdfdb1831b31d7a

SHA1
da09c453737d2b64cbcf09c8323f982ce14c865b

SHA256
032ad265913bf357d45c25db3a173da71c8b799d2c63c8eab13d3b58cfb3cb2a

SHA512
509b544733b9ee0f328524f5a32fd346b6809874c8f25e4dffa3f81739df60f2462aa378151f349c24f06789c9f2498e085a4457c53a18224db63e0a3e426113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42d27c470983cd9f5ab13c8a9526d8cd

SHA1
cbf912926c16e1e26bb3dec9f852ca8159fbe509

SHA256
6d07fa1a3a114cbec81a9d4b4dabdff580c475b22c576bc2e9c5fc9663a0dc07

SHA512
bc2b9645e31c8276fe50479fae85bd905df88f192802c5171f40161ddfdedfa87d7dc1c0517e2f0abeb52310e1ebaf6cf935d01c584a1c81e247eb4e1f6a1426

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61d3a86e86abfbc3f25305affeed3b29

SHA1
bd04c4ac10cb8aed1bc6cacdb4689c4953d32503

SHA256
23b3d16232088062b0c979031567e2a099e08f6f24e9f8b36c1ec2c6c105c0f3

SHA512
11b312203ea6c4a3f0340b3c18f279b6ba15baa6ecca0ffb6e45ac324c416af532ae1e828d6796db39adbd54ee7f00d82f1b303e09ad5cdbc08db6b4688ecc91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b33b7e0a276e3355c8f8cf787e20e4a

SHA1
c03ff0353f68b17ecb6ec1273580b26b521d146a

SHA256
accb8b6e2039e4ef3e77fed54f7559ed3a34f995341b6c2da70e3c5c9db01270

SHA512
2acfdafc59a81821ab776032e119708af8afb9c302302ec5b8242ff7f7b03f87d00c1f7eaf3e9fb130e6fd7276eff4b07c517855a5d087633b4ef047b5b8a117

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4043c40703e96871c9bbf5a312be3705

SHA1
4adba4fb54e4695fe582ed2b81a1790a034aa27d

SHA256
54c5149df425c756aeb720d0130105722a6deaa5e2a063f8093a2ec77b92f2ed

SHA512
a0e7bb1b5631431584379c6ecbb880cc62e8fb3c12a3067f110a8d1c13feb0ec0d61743f68f4b675c4e0eb9d919acb677f3c5711b3819c47a90d4f7481c85013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87c13fd51e581ef567359eb8e8affba9

SHA1
6c3d243b33e6f233a31c39ee83fb995a2300f0fd

SHA256
db6f946a2f832f064cb742d748fd8b99f1693d841fbc646e8de3e5c6fb9e74d2

SHA512
4a155abe2fc250d59e83db23b4c15426f7d201a5fb5c6a81ddf5e12a0e64da5384b76626c98ccbbd117e8b69ae6d6ebbcf035e9e359bcfa0fe9b71f001e783e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C39.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D0B.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit