de7595b4e37c29e15afea6318a24d6edd2780022f08c5b76b07ddf2426ead4d2

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab255eb97f76d750ff4aa2efe8d51a7a_JaffaCakes118.html
Size

23KB
MD5

ab255eb97f76d750ff4aa2efe8d51a7a
SHA1

ea0eece71e99538a6a33676189a8e7c8dde04cdf
SHA256

de7595b4e37c29e15afea6318a24d6edd2780022f08c5b76b07ddf2426ead4d2
SHA512

1b8977557fd17c153333946b142cf49af67fe468599c3ff5a43a807b4ed998704c1d6c0a69ed7ff496a0176c075e55a84c172c14052669e38eb90007be91ed8b
SSDEEP

192:uWvQb5nBA2nQjxn5Q/BnQieMNn5nQOkEntHfnQTbnhnQ+CnQtuwMBsqnYnQ7tnJH:vQ/Beq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C03E9E1-2A7C-11EF-8144-CE80800B5EC6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424551697"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1252	iexplore.exe
1252	iexplore.exe
1420	IEXPLORE.EXE
1420	IEXPLORE.EXE
1420	IEXPLORE.EXE
1420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1420	1252	iexplore.exe	28
PID 1252 wrote to memory of 1420	1252	iexplore.exe	28
PID 1252 wrote to memory of 1420	1252	iexplore.exe	28
PID 1252 wrote to memory of 1420	1252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab255eb97f76d750ff4aa2efe8d51a7a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c229b73528d16a63c32c4d51a0b61095

SHA1
a83f21080843f18910a3a09cbd37d427469eb5b0

SHA256
53732f9fc7524e56706a8481e7e09895b752cac4cf17ef8b2f25b308e4375a19

SHA512
aabf01913f23ce17f2e1e235917c4517d517e0ce15147576dcf0ec0e88a689907c327ca89b1fc10a1d58c0cf6401cd14bc22d42424b52e6cf9192c0acaca5adf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f189c012f060399fa95b282daa14f5b

SHA1
a00b3a5acebd1ebe09c5f8d210f32d745f346520

SHA256
f92ce60d0230a8bfa2a3a7fe4e40a993839cde7339033eaae9fe97f642a4a049

SHA512
db789631334f98f3306006ed4ab83f26f89e0d3d10fe72d4b6c8580d88c5f8561d4902d4a7b60f4d4e8a3b623c218c889935725b7810f50e26a9431677a1a3ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dd443549ccd03d39d030a244a081c95

SHA1
6cd1dafbba77f771813156bc3d682521a3e1c89a

SHA256
d7f0d7d93c7d4897924026e9147a2d4228affb07a6973174a592715b00f25ef3

SHA512
2aba8a2f58c95698a2585ae4ba948f045c8572e57efa78da3aef1740878ee33b8cedc13d97447801f6804e5f139b6872be65d1ebb4c550816a6e292970f94f8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eefcd868fb6700b6f068cda3eaf27555

SHA1
c66dea4f247538a079ec89faaf7a927110c06570

SHA256
fdcf7d5d4d7f80ddac57b0e3a62835309316dc0d29383a1fc40111a671a9396a

SHA512
a0c39c931ecf00c4eadf2c205e8a26982f4f9f46b9bbe77cb9dadd1a7800749009ec374ece55e68ea28bac8eb9c62383baf8e79047333361e14d18a449f77d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13fcd6039fec95527884933fde0baa93

SHA1
f0ac56b7b5a9bd718eb757393e426c29fea0b32a

SHA256
9f22f2557e17a861215a054f9e0c8aaf4d8a3f6d3702ab3819c25d9360e9c10e

SHA512
5dc765633077ae5c62bfa5b51158c72a8de7dae02d173cb5153ab0958ea2bdbbcceaff31974a2a5e29fafc4f944a3a70bf56496cf794c12a93688c3c102ebab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e67cbefac811362795dfe5862e7415a0

SHA1
c559730b8b49d8d0622094fe49a865cd104edb32

SHA256
43e5382efb1e2cb12c7b912d6bb61d13eb342c1b3a39919eed5ac7fe38c3a678

SHA512
1ca00f4da62da267891da969e9af71c9dae68c8ff6080a7ed69df3437eb79114685e9065a73806c485d54c0d52548d4587d1c5ceba5b6f72b887b8924fba390a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0b1b451c2cf8734ac97aea9b40ceac1

SHA1
ee3664820e47aa962950288fafdd4ba04008266f

SHA256
a10be9434854b645e810b3aa090e0dadd9c0b8bbf4bca890a542dd5f97a9da4d

SHA512
ca3df7335594e80d1fa6d1f2121f63fe33ab8f1810df5852d1908a57961367e85e0bb8954ce2b95e4ff0db55f44fc5bcd01dbf68332d26b4d5ec7f246e496ab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bab09794481b85998c251ebee23ae41e

SHA1
6c2805c950133af11c76ed110a1114e132925f5d

SHA256
88b5392c01183a198425f3912b61f2d0ff43049d74653e535ebd5cef7e84508a

SHA512
feb58ddd0f97ae8b0f016383341773f599d5ff9ae9657122324c9d9fcc4a7e5193e12e811b9552435474d6f49a60c993d5592b96328ca7bff2b6f9b01813fe2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab57F1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar58EE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit