5f1181abc11de6835a0cc71549272eeab8f9c18e04cb8edbe5828726b6796db3

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8d4949127eaa95a5c26b4de0fd8e6ec_JaffaCakes118.html
Size

43KB
MD5

a8d4949127eaa95a5c26b4de0fd8e6ec
SHA1

6940137a3295dfbe0e685f55a25e56479cf67052
SHA256

5f1181abc11de6835a0cc71549272eeab8f9c18e04cb8edbe5828726b6796db3
SHA512

20d73c43fe32542f59ca969ae91233c3c60ae9ee340da52163ca38d3018b30576e45e18aba857cf606801d7055601ad88bdbef208cea7d2993e66ed1b6c6eb81
SSDEEP

768:1I+vbG2+0MGi+vZGIikHhGRGXiOgOeGBGlGslstaFOs/wOenp:K+vt+0U+v5ikH/iOgO2FnYOg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424517165"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C6780F21-2A2B-11EF-81FC-FAD28091DCF5} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2092	iexplore.exe
2092	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2180	2092	iexplore.exe	28
PID 2092 wrote to memory of 2180	2092	iexplore.exe	28
PID 2092 wrote to memory of 2180	2092	iexplore.exe	28
PID 2092 wrote to memory of 2180	2092	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a8d4949127eaa95a5c26b4de0fd8e6ec_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13685dc7417204b12c25ae904df1b40b

SHA1
d06170608c76e918ff5613136f1900fe96dbf994

SHA256
d92ea9895ffef3308bfd37c8666e34793516da0b282bdec8ab053280904ec23a

SHA512
9d29b3d3a96ee39dbdb2f8d040cddbd9645e62a3eff580a4f6f36cd4aade97aefed4d6215deb2561d6d3c46a63a97c4ba99693e61f96bdd4e0fb331fed9c7720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3fab3bf05c29dde0ee4c45c9d4611c4

SHA1
06ff9d57603cde60df2687ae0b1f2e44ba6307f6

SHA256
839177e11252395b9daa2c38a7b31388f8941fb3dc65f5e60751cc8d1dd44df4

SHA512
91388a9391bb75d1ed6cba8be6123168eee8d40a0bf08e32298cbdeb4469415986d04d642634bf8152ce03c603a13b4e770cb169e6a249acee02a1bb08f73485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
412943de7ae7ad707e5e0be3d44d7d6a

SHA1
f887dc433f8272bec9e7f05bc36c60542a38444b

SHA256
4f024b70a0681e54d41036de53f7e72640b50e85bbb1f815f3e6f5faa453aed1

SHA512
daa7921696e26858400fec8adaaa09eaf547183a11b699a0465b27c49a8b6e0d7925a9e74f36dbe72f78d4faa3f7796014aa97b02becd0dbcd9e26c5d5609c1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b40c7af335914d80c8c3a1fd9512cf9

SHA1
5b4e564db0203128ef7d8d9197e725f75cd07b48

SHA256
51a015028f027ffa05269dc7a6e6a03a6c49795c711d6ab9fa1a187457a9a798

SHA512
bc8b55f3b651af0edf80c70c88359fb6d19f267a4c8e665675852918a8db49a7ee8fefcb31200799a9180737fc5721c6fb6fcb5afdfba8cb6ba64a69e10811bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f438bc9e73a46a6a08e9280d3faba04b

SHA1
833f3132997fa0c7e7f6d06277f8e0f0c2716002

SHA256
d783776caf5a182edbd5c45354df5ad970c22392db501ce98a3f4162a9c80af7

SHA512
d30ec09868ecbf60848f0f949d57f8112242e8e3d4882d562a566f83ec948cbb5f4e38ecaad7599f48cd8126ca03da77b43ce3e4f857ba5c15d9d6fdd61cd37a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4934abeb75fea3b4e1ba049efa424b9

SHA1
89980ebc15a07ecc18f1323d331bc6de5405fbfb

SHA256
47790f06ef56212546c09700d620a3fb7079cfcdf3b27289695bdcebcb9e60a1

SHA512
36191c52278cf9b5567ca672823f376f9eca412e7b61d9603fb8a7f1aa78e558a2379197e2d4394d4082e315bdf7414d89d2478501c49ef7caa1caae7b6ec5c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a9ab36ad8a41c05d9d0651e0c8447eb

SHA1
84b0b8d3b75bad5443c00613148481da30b85522

SHA256
48f26f8a41b92aa475e34a4ed7392994d0e6e4753ce6d8a52a39465ba400c5b3

SHA512
0ceccbcce501a53a45b9990f64c48bd90c97e87939d2998a65b1a0a784438e25315b67c69c8372db2f757acd02652d31b6cceb9bfd1dcf512581c8dead4e939b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae728aaadb6371c61e77c8373943bd9a

SHA1
2a4fb0bd168a4ecb2d6f7bf2acc7b8a65e94328c

SHA256
25e5035c60de865f9cf4b9f7bac01cebc79416da617b82f9718e32c24a868617

SHA512
99df732657ac89f59b21f31f93f44baf6bcdaa1842db7354a5d062cd3e1c429c527b869318ff978857d67f803d190e4d462edeed9a5f3f9ef386822a9dc6f4e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c588e2e8c9a9c58bf434eeaa85f845f

SHA1
e75bfc42bda16cbc5641227ceabc34684e214870

SHA256
09a6af24eeb2c3fc753f25cf52e7d9e579b6a3d145553da16ee22dead22c04d1

SHA512
3a15474119f1409160f366cfdc328729544a6e4a7942caa15b22f698cb4f68d766f4a26e921dba075b030858ebcfd24fd12660c99b19f4e7cf01f7edf2c3c297

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1009.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar110A.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit