855390ebdde0f9b98c927ff7de9b29cbeb2d7dafe0fcc3ea0b545d55207c7fe8

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa01c73c24f06fa6c4a289f7a341a144_JaffaCakes118.html
Size

23KB
MD5

aa01c73c24f06fa6c4a289f7a341a144
SHA1

edc9bc20e2c181fd3917fdecd9d969731dd095af
SHA256

855390ebdde0f9b98c927ff7de9b29cbeb2d7dafe0fcc3ea0b545d55207c7fe8
SHA512

b2567da7af00888be992c9b03df1fb97d230e540dd94fe265de520c349b2e240de92e768a79a0800e8bb9238f4587b1ea598eb08c2dc75073caafb627f303ec2
SSDEEP

192:uw/Ib5nqunQjxn5Q/BnQie8Nn2nQOkEntPnnQTbnRnQLGLnLnQtaqMBcqnYnQ7tA:TQ/2Gbun

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E8355721-2A54-11EF-A34E-5E73522EB9B5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424534831"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2612	2204	iexplore.exe	28
PID 2204 wrote to memory of 2612	2204	iexplore.exe	28
PID 2204 wrote to memory of 2612	2204	iexplore.exe	28
PID 2204 wrote to memory of 2612	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aa01c73c24f06fa6c4a289f7a341a144_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24863027231cdd15a614f71a4f8a5e80

SHA1
d18266e60d1fa91211334d3f44cf7e657c359265

SHA256
39021227ffbd64dbdbd70561c6b0fb8032fee418a5383b275680a438cff26535

SHA512
2863710e20401ef4fe43954f1f5a278065faecd39277836d48a052ab32333f0aba3ea09ed94be110e361e100ed4da13b92d6013d0f8120197f3c23d12fc057d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03d74d25da00ddd96a76f183596162e7

SHA1
2050738356830fb262d4030129cebaa463a414d7

SHA256
0fb220cfed901a4237b9c93a000d33c272b0dc51492a178f607450f502bff670

SHA512
5b6b1f5c8b6b410778969f3ddf7aaee2e4cd1c60bd7171e17f36dae6d34c85050e05cd6dfa7efde41167cf129ec07e5aefb56acd56d1bc7a29c96cca912a5c6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e13c8b84678d1b520a5391f7d8a2b617

SHA1
92173e368e229132fbbc36d94a7c0464e8855a50

SHA256
9fa84411666e17ad54090525d58502c6a16dbddd0db7776984e93f972af288c8

SHA512
46ecebc8d27636d72831351690dc315efa03ca95b678ef969035a4ef71235935978d89ac7b7881071537952b7872edd8ee72579e5339f92d3bd6ecfdd9cf48d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dd9ecb14dde4c700f05952f97c03121

SHA1
e66ee723093e207820b4294af471198c58717b5a

SHA256
f0d63d238c2984bf859d3c52e51986e3a4daf259c1fd8458a1c7be27208f664f

SHA512
49d0165be3e0dd728e0ad83a5c32b65be63886e1317850036f3284c1ce645b1af1baf00cb25d1bc2de5f6ccc1c8a260b18d079263ac46041a4c48d09749ff244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
411d968263b77d39158c0b2283e5554f

SHA1
505d97abb75d6e1f5637a30dcee450591c84c02b

SHA256
fb9c8ee414ec491fcef20310098eeb3ba4bda5b74d7906d664a8de9c02392526

SHA512
bd4c005bea853e1a9f64c3c63fbbd7922dcb16874fa03337025636534dafb300712ca0cc0b7b0779634037368f858f6b486b38159bcb0e3673f48099f6d0b4a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
accb07ceba2e6ed77c721db6752278dd

SHA1
c0fe852eacf307b0874475a33c4f6a3036bc01a6

SHA256
1fd8fe7338255d79832d1517b4f9914f3018ea31deca47403cf204b284df2dba

SHA512
2ea40f0f19f9dfd2271baf363857a594db1eef7abfdf142269d6eaf64f7418efeb0ffae7a38e5458428cb8799d07652da7ad98b462d204eaf6f1193ae2e3874b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b29ac6e861a93d788d3f7e673cb621f

SHA1
67e0ede318fa0d8ea6c8cc5bc9e3b89f41748d81

SHA256
807bb247d0f787f6f59172f3b5dd4d1fb0151cef9aa1af387aa584441a6b07a7

SHA512
7b31a6d299c9f37498a31b7789592ebbeae91c9875fbf53caa60581fcbd3c96fbf93838e73b8c0af2dad8fc8d5d628a8449ccde3c8d6f6a38ba29cb072a22435

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53faeb57edf2032d1951138c0623ffec

SHA1
a13cb54c275740d77bab8e957fc439fe6b98d6d5

SHA256
d12ce742bfe0f6aed76f7116a56d85d8bb104659544a9047b5a28ca087ed2338

SHA512
184db770c71e67f8e60bd5889feecf7b98b887d9960c4d6354f2951640d9118034f38b04ba50295c0b8b8d07e6fa5ca08af7a120e7d01d6e7c4930221e0e4cf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ab267f3ae4cd8c4571a579adfd301d9

SHA1
3efafdd9c1bef9941bfd8f87b5fa1a063c8e090f

SHA256
996af89463e8ee6893b70e857f881f77dfeed0a7e097bd9d5df3878b8b5643aa

SHA512
b43d6a6df928a9e57dcb5d36c346f1c1d207763b4008dca69d5c126e7d41cc1d6a61bbc357578782163f01b8e958e5566ac87cdeb219eb1b85d4ab58d8da151a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CFC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2DC8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DDD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit