11ea387b671759fd047ba2cb447f91980d62f470ce6eda50633e64a3619b076b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a939c63f39d95bf6968986609a14cf02_JaffaCakes118.html
Size

23KB
MD5

a939c63f39d95bf6968986609a14cf02
SHA1

1bab69efd12c3be08983a1ceb95fc8c485508377
SHA256

11ea387b671759fd047ba2cb447f91980d62f470ce6eda50633e64a3619b076b
SHA512

dea06068f7a5cd06511ab198c97e9a55613632bf5ca7f6308fa68294252d711e5afb04507948ad85f8fb6bcc51b419c1b3bd0d1fd361299989df549db6d41363
SSDEEP

192:uWTkb5ndKnQjxn5Q/snQievNnynQOkEntc2nQTbndnQVCnQt/wMBPqnYnQ7tnIYV:QQ/69O

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424523285"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{064CC921-2A3A-11EF-92D3-66DD11CD6629} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1460	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1460	iexplore.exe
1460	iexplore.exe
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2632	1460	iexplore.exe	28
PID 1460 wrote to memory of 2632	1460	iexplore.exe	28
PID 1460 wrote to memory of 2632	1460	iexplore.exe	28
PID 1460 wrote to memory of 2632	1460	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a939c63f39d95bf6968986609a14cf02_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3c0f858902979c3f2b327741d43b902

SHA1
7727b993d69c79902ce99caa1b4c87e34baa0cd0

SHA256
71a83ae22422aaf4d83c7d1121872480322d08003be6fd6bc7e4a74d554fe568

SHA512
faa5a69a7bdf088b1ced2e3ad9a612521ddc904fe7543c6205a82a63eaa68b28c5ee2021069b3ef1e4d4aefd78640259985acb64574a9f9653b557e09aa44756

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41604d6d18bd1cdfb1b8ebc3cd22bd31

SHA1
2dee326ece14e0f7b6d486c2232d2637809c38b4

SHA256
aac8c67e2dc60d59c6b797b25a8fa4bfd4ea0f5c7617c1024bb53e311da58a2e

SHA512
93440569a3c120270e2cc32f181eae6c6e2f94988aa204f614aa7dbaf7834fbb6ce86e5fa1dd956d9a3f91c9f8e4c7cd71be265605809b920a56c362ed51b392

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
687785cc96e642dc379db375851475b7

SHA1
09a634328db76860d9e7594407674d7202d2bcbc

SHA256
6f12e7a3de1dcc491236d646a49ce4a4f87c73d99f70172411f0a722b9118808

SHA512
e208e2878bdfdeb6d78e2ec91f5e2fab5561e386a795d9a131c20b97e34fb02cca2cda0cd05d3b7f84b967151eed9d29b013f25ded6dfa92eeb434874fc43311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56dc2135a9bcb2d2f044607f157cadd8

SHA1
26898eff9cb85d0ddf7b56f5c2b3f663efda32b9

SHA256
8bac8bea2d9982e8e6ffca77d04e994b6b0ba412b70df91cbfbe521c15717f99

SHA512
07b61e8e4753ee4e4e3896f883ea0bd498b3626abf066e4e1f639efb9fdaae3259bdc8f251adabd9842b5badee50fcda058e1bff9f0829cd60c6282bc13f0353

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3db01f9f00e623dee7643754a7e89204

SHA1
22760c4841aa6c2163a1236f45ae2040f9870819

SHA256
7cd42e6f32509772c5fda18ce14711b378d55dda253727a93653e69d33cf7cc7

SHA512
b3830a8d851fff8114153316a71adaf6e9448b09dca6fb4845d1c749af45c64e16db501849dbf6d09f90b8b019715928eb46aa5d8e36593301306f73fb01d34d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15adbb4c421a776d00e9740a0587335c

SHA1
943529ae147222c047679bb43a5820cd5042d5bc

SHA256
f632aebac6b747117fc6e4dbb1a178d5f96b4de537c949a5f6a17e0d5fe91dae

SHA512
fb99c9d38177665f93f8473a7786df1036d87a08c951c823dfba49845075553a373abafd17826e8f8861cb4c7a86d96b6333db2b8419e92aaf43b29448eb382f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8de611bbf060cb2f2863afa529539f05

SHA1
3dddf38333f061aa6a2c5eff42dd7297be466a77

SHA256
35975028a70aa00b3d3484100e790b2533faa5c33b3c567aa9a5b7922c0a2b39

SHA512
7b5c8e0ce27fa2c44b731fefb8f2fbd6812f38540d633964f5e7c0d825e6c578edba58f3a0ce3513ba573438e17bc5da1302473873fb87083111699d1ed88b04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59a8776af9a20daeb7697b9342d68b65

SHA1
e2ecc329f41ec35842c85ab37008d5a85706d36b

SHA256
6be2abc60e659e4bc8b5caa099065a5ff4a5a9aa49cd2f9e12599b4bd5711b97

SHA512
e20dbf77f983b28fca9f1c2f30d15d9df738783b52f25ef30b0e317ca2c0f24be9621282ff1d222d43c126d5485b4f2f22cfb3207ee51388597bff026efcb00b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1a90afdf0fd867d4d2fcbaf8d62156f

SHA1
53ff5927a86c298c91764ffb09618b943fe94812

SHA256
daff6c1b45d6f4ce8922f16974e7b64ef9cd4f188d140835b8550ff1f5977a62

SHA512
d3e15cc9b2fcacaf4b36b9925067fe52f310ba9ee16322f9458ab2ba8db4c2c99a8756abbc6ea53923ccdf8ff504548d7961abb959218f0339c9fecae5d7d815

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22A0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2391.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit