d4b4b424eaa0c064039ada9b3055a33ac387f4c37d5704349cff9c486c59e558

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9cb44aac30d917fc1a953dac9ef87ce_JaffaCakes118.html
Size

25KB
MD5

a9cb44aac30d917fc1a953dac9ef87ce
SHA1

6c4f98e5b7f4637612394f8b6045c02b52318084
SHA256

d4b4b424eaa0c064039ada9b3055a33ac387f4c37d5704349cff9c486c59e558
SHA512

a06eb2e6a8db78e63ff98c343b31238983e5c730faeb2c3e702b6830d61a05436682e3760bee615569af43ae5a656c79a8b2d0a9a8f883eec51c668b1e30a40a
SSDEEP

192:uWPMyb5nVOnQjxn5Q/0nQieXNnYnQOkEntkynQTbnJnQuYqC7AKpdES4cwqHXMBt:FQ/2v7bOt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424531738"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4A511E1-2A4D-11EF-B5A7-FAD28091DCF5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1912	iexplore.exe
1912	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2264	1912	iexplore.exe	28
PID 1912 wrote to memory of 2264	1912	iexplore.exe	28
PID 1912 wrote to memory of 2264	1912	iexplore.exe	28
PID 1912 wrote to memory of 2264	1912	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a9cb44aac30d917fc1a953dac9ef87ce_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c051b4e0ad35a755094842cc1e03d7f

SHA1
3dbe24aa902da97dabdde5863e7146c0a5d18602

SHA256
7edfa70a1aac05fd5ea301a650156437b427fdd7c1c175f3993ea1b692723be0

SHA512
c597c4349c93fc27b2e6c26c0c366d0ee7ba5dfeed85955aae40b7c8df3e55f759a6a4555825fe0507ae1da566c9e722a30954206ab2a783dfc2dedb6b7cc254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
321666c0c6df4a68b095735d97d9d67b

SHA1
431db734dc99adc69cc37b4db7b4ff6d217d205b

SHA256
6d904adff5674816516e2d5fb3c116553d9d1d7e95a712e4d8098906abeff40f

SHA512
b7a30af4a2b2f074cfe8e6a6c615f1ce3158053dccb83c5312bffaa059619450a3a9d1189ffe99197d8206393854cf3f9ca30dfd0daa169236ee208f9743b449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
024abddb509410a5d1bcd4d217a4f244

SHA1
9f03437c567e62593e89d8a4bc17e24d4ca464bf

SHA256
e544c005a857cce10abcca165bbfcd97680251d985766701aa54f6e3c8d4b78f

SHA512
293a89b2f37de83fb4e4bc170c5ac6288baacda7fc109753a133ac166adfb08fdbe63ac9539a1621ecd877f69e5f7db16825857e4f3eb01e8c049d6acfd86979

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e40af5b13ca77d4051fec4141272173

SHA1
22cfa91bc5df2ac80481a9245a6b2aa2ff09b7f5

SHA256
7f828454183304221d8f7e9227259c92b57a8b9a13a1683c1ae983b91b011d39

SHA512
18751d5447696e2e36edd74fdd6ccf643f038fdca73fef01b3ae762d3e5ca786cea3a8b0e2e3dc1b1faaf1d927bb0fcbb7959fcf4752895d44db1dccd6535acf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f14bf390d502ef54b635ce721ecd963d

SHA1
afd25785de64c0ea6c42720ba4e6627631db24f5

SHA256
142823496a4eeeae4461babf9c46e48b747f661645f8ab1d875979990bdc8a83

SHA512
49af719d27ca135e52422fc4e2eef186adb36686ad7b3066ce6df1d6aa8cd2a424bf4b25ec076bdad9e251618c57e1eb01720ce4dc1397145ee5bf72e1a3b456

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47d48a2b68b708f27831b29ffe447ba8

SHA1
e6aef0fc32509950ae86f4582664fd3baefd8053

SHA256
e93eb845046fa3806c4219c9980e1f2025915bb8dd6ea6bce9db6986f2f858c5

SHA512
a59e1faf95289c07b93c85a6e0512f94352b176cb2458f8a8584cf25a6a684ed27f7b97dbf63b892cb1518a8a1ae06b08b5fb81449b9adc1daf8de46acfce77f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b71bbd51b6b4f53dac1bbc25f1d9c848

SHA1
0177f44006eb90472f8517f3c10efcc4fdc453f5

SHA256
6df033c2abe8349376f3b0146c6fc62bcbcc604a88e4f5ef0cbd2f6d1b7d1242

SHA512
ff2a4d2a62260058c8bb71d8fff4a7c28439beddcfeb4ad72b8c80ad53b084811eb7acbcfe7c33d76faba42c4f240ee25d351d59dc8ea018f5105680e9bf55fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec95599683b02ea858016f2597a0e5ae

SHA1
8030ba36626823e59961282a80fb4dbc75f9f26a

SHA256
ad83a1865f72824245f232aae0a3efb5125541009febbbc27b343a29754526d6

SHA512
8a796cde6e7a3ce4ffc4959acae7296f1c6862341a6371c1ff8b738b01949cfd93652a424ce49922edbcce0b317e7d4553d8c6ed51f926f73f3329de1b35ee20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17d00375016ba98c5efa22cbefe2adfa

SHA1
f972b6bf183b6d022a41dc8375347cd4ae9d3773

SHA256
97586636a7e8e4ea96171f87f42e373f178aba7a24c33f56a3acb3e545d8ac27

SHA512
7573c97de2fdb41b3b7802bb639943b47a56f998eaf98d1ac0522ef4e88ca93876aeb32825f77ff224593568751181e7dbd7464d538436d2d943e2cd204c2d6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C86.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D36.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit