1b54707b829fcd8a81802b1f598b5bfdaea4a2f5ff779722b89f2f30c5b68356

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 17:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab0088449abe1e0a6210081c2b6181b0_JaffaCakes118.html
Size

34KB
MD5

ab0088449abe1e0a6210081c2b6181b0
SHA1

70eb17ca4ffc66a37235475f37258d26e298a00f
SHA256

1b54707b829fcd8a81802b1f598b5bfdaea4a2f5ff779722b89f2f30c5b68356
SHA512

2cb83a434765721565a686ee909683f95c145971962ca3c6e527c94545baa9458d04ff26d048868be841901325f0502c44ac8dcb46e5ffde9476414809e3c954
SSDEEP

192:uwvob5ncenQjxn5Q/bnQieiNn+nQOkEntZpnQTbnxnQOg/cwqYycwqY+cwqYQgWW:FQ/JXSI5gW2Zqstj3nkZ0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF678871-2A76-11EF-B6C6-7E1039193522} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424549446"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1876	iexplore.exe
1876	iexplore.exe
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2524	1876	iexplore.exe	28
PID 1876 wrote to memory of 2524	1876	iexplore.exe	28
PID 1876 wrote to memory of 2524	1876	iexplore.exe	28
PID 1876 wrote to memory of 2524	1876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab0088449abe1e0a6210081c2b6181b0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
214fb5b1b364e027fa74e1e6318019d9

SHA1
fc0cc9068867304f19023f8442dd3615e0818272

SHA256
7b964dd0fcbe278d856e223cd447265465d31f8dd8af7c1148ab73f388b4e323

SHA512
25b42a584381db2b3d2e525877d763ddc031fb933e191d582b3dfbe882e131eae9d4345c88315dda54b94ebea8bbaf6e052c7644eb4ed1e1cc31ec05216cbb8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb184fbd5e7f75a905ed871c380e1ca8

SHA1
ea2530233598e9449fc7a9c6e4945cc28e9e3d3c

SHA256
4cf9632bb6f18cb1a4f7437e5104a402c3422d5a6a91c58a25e2a5dc02d36cb0

SHA512
d5d6299b6adc80eff1c803fc517494cf03090e42e5428fda2372da735c1b7b7aef564648b281b05f94569823f8fa0244a64eb1febd040ab1427a4e26ebcbc8c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2699196abf05b89f7a01f04695e15fe1

SHA1
d05a030be2dea8cd62199f2608f66b44f2653321

SHA256
3b6bc52a1be11979650162c2af5cfc3550506948ff611bd1bfa81cc5ee630762

SHA512
ca3dcb0486f9bb7f34f3e85b1357a938781ed5c2b3477396c34ab8be7a5ab19cd24214bc72385099db7c4171ea644048b3e1c477283b55c27730fb011bf9053a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
526e5359c1798709946d5d5e8171367b

SHA1
f4e0718106a8507388a670bd7130c4960eaa1fa4

SHA256
090cb7fd38e5085c4d12108644da92a2f1c9ae5f6a9836a8f2f4e2a5c720cbd4

SHA512
4e4ed6c7955534dd7928ac0c6534e953260f3c9212b87c7f0fb4bed1b923081fd1b532265614a92a5668c574743f24971f3bccde5a4deeddecc60888527f9679

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db804843c5c57d458d0da880bd2ec645

SHA1
6ca537020f8ff673034729a197608288ea4571c5

SHA256
4351b798c0998a614d7bce915c33b15e0a4327c0d388e4fb3489300b0d78b419

SHA512
0d45344705b3b848cc79560c8cc424019d7d2a171b1abfdb6f8725d57adb16ed469a3075a4b5f54d594e44a0e95cbb2117fbef94417b61a6901f13f30c3041e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36d5bdea0d88c280fa1e8e2309765d12

SHA1
98a06b9deaea57d1021e8e5195bdc0baeb69c938

SHA256
e0d0916d395bb72cb71196207d43544a30d35d9e9e2bbfdd95ae5251ccca3624

SHA512
f63803ed75817f74d731e408f65dd7c120370dd69443eeb3d953b2e7d6543b91611d2c47a12fab466f2bd6ba923312553129148a99e376c7d8834196ddf8c8ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e7b0a506a22c1b752696e99320a0fc6

SHA1
97bd2b4ae3246c5a239d778bab4693a10d59037a

SHA256
9f20fb56f6418d4f5962a0e30396a2c39fe6a7ccc23bdb00233e7296c19eeb5c

SHA512
89901a2cf35ab39dcc3a8bd698c309c79686fe49eb0f07b89363d994ae8e528074fdbd692b9f313a7f64d4ed5b85e74cd66fa32ee3b441e29faea8f2c6c5e6d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
430caf4b5e52f68a4cd4ba7193549f09

SHA1
1f1a609abd306dc847b8c55b22dff3fdf5ecbb1b

SHA256
384984c9c9b23573bb6b1e34d1bf1947ef77865c4e7f8868978af35c27f66c4e

SHA512
63eb0cb4c0013bdb4f6cc0e7255a04f35ad2d01f74405163f1451a887f42dce89a2572799b84dd5e71f36d91a714047dc6649462180fec9966bcbe4652f09455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15dbff77af2c57ec64ea1dbc469e8d1a

SHA1
afcb725f357af2413d490f238b31f0127f738240

SHA256
be68fc448e193b62fdfdfa9e9310899c0a6d568cbd5825a60b25206579f2a8ca

SHA512
30c0dd14d2f0c53a3a9352e398b8cfa9c815b8c1b883be7e9bc4f8609ee35b8b9124d64c4e8cb1e10e7fcaefde0e611a6e872107be3a13b70525426d19130984

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBE5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCC4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit