10bc2153a632d1e434bbec3a5ebc0de28b8f2fb14b9295752fc8d763f2371c2f

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab50ba79488106b890874863e72b15d2_JaffaCakes118.html
Size

23KB
MD5

ab50ba79488106b890874863e72b15d2
SHA1

6ebac685fd36efa932c8f86a7860763d8ad120e0
SHA256

10bc2153a632d1e434bbec3a5ebc0de28b8f2fb14b9295752fc8d763f2371c2f
SHA512

00bca6b2e86f8533530087b80c9753d70737a0f65d047e2f21a5edc62d4928edb1ed55570bb18a94ca9dcf1c5e51f0cd79c9c428f41d090a7f7c4c6910d50e8e
SSDEEP

192:uWTYb5nqlkqnQjxn5Q/InQie7NnmnQOkEntU2nQTbnxnQ9CnQtTwMBbqnYnQ7tnM:WQ/61

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424558706"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7ED4E421-2A8C-11EF-9586-DE271FC37611} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2648	iexplore.exe
2648	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3060	2648	iexplore.exe	28
PID 2648 wrote to memory of 3060	2648	iexplore.exe	28
PID 2648 wrote to memory of 3060	2648	iexplore.exe	28
PID 2648 wrote to memory of 3060	2648	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab50ba79488106b890874863e72b15d2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
279d83fec71e7c3033ac9db152b414d1

SHA1
0c4ff6479e22fb1804ffecee090e33726346af34

SHA256
bf0ebfd372f002c20bf2c4304a68d3ceaa12c8b2fae30c84eda83d3b692f0674

SHA512
26dcf62a9a22203305af03035ccdf8423da50dcf616a3b802a04b658f2c3277068bc4a6ddb1140097d4d29e5545a46a8bc9255f5d8ae59fddf5acbb592a9111a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f273a904f4ad6abe51f453d48338b312

SHA1
205cd7d3c24d5be3d6c49936462acfe5313992bc

SHA256
17f86a6ed7d3bcb30bcf6b54b693717d532ea3904dc80722a3be9faebc6993ab

SHA512
6a2f09fb0cae2733d56e21677949ab973617a13c203717109e3300bc675e8eb0a31a144b8da7a36969123a5d7bb623fa93b5aec90fefe508d2f7aaf04bc315dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5feb6ac2c62b2f1ef321d6e130b82dc0

SHA1
c96ff4ca9c59d542512a59726f0c9eb9922fd5b4

SHA256
61f9ef253ebf86296a0f87810ff7d7bc99bb537b5717ed7e742b3701e6be41e6

SHA512
726b8db1546cef4b52e380cfe5d652ff04a88dddf66e894cc1beca5a85aa5b8db4639d0ab0fe3e9dde5c02961bbef6f8ee2b301200f1e62a83add5dbb32e555c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6c0a611482193f2aea6b304f7ac763d

SHA1
28523b4307f1d2adb7f12d378dbece3b09897f39

SHA256
842f4d747a9cbe3a6a4607c04eb9e87c5052e8dc11e4aa22b0231387e3e871f3

SHA512
3230b4efb11c8740313961b5cbff97949d3e766b315002cdf389e4361fb0977485bede09a138ce1b0e5e51027582588e323fb0493518bb499d1225e861d72716

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
234354efdbd883dc3f032e947bdd25db

SHA1
f1bbf408b77805aac8ba870ce05d867390286a2c

SHA256
02310fe3dfc64b15c9120f88e5a88ceff57acf6073123c4a7be51bf1b784c2a9

SHA512
b4f338f311236446a18718440606ec8fcb534b3cf1c409b418397bef0703c2541d75694a068183dff7e59695016a9f629c9289b5419c0459ee81dd687fc9db9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a7d690ab46346adbee1af022b74d398

SHA1
e576577da4947ec6bafffb11225a3dcc97a488db

SHA256
4f901838ae2dda0931c136affbfb926b0078b119e944c60a108a1e13e8d40ffc

SHA512
a84fa3649d56589c92a8dfdbb40ba899fc4cd26ded623ab6761a5aad7694176c992dff405b1aad711deffaaf44c668a6bf9f0a2b4bf82a8ed8ffce19996b754d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e600db4055fba7b7d1d8250f79fdcf7

SHA1
f1de03324098f3841b6135fc9cb22ac93b820bf3

SHA256
e338000adf40ea82596b542709b8c9ee203f7d42f636e1404ad9d7daa36b9aae

SHA512
8a751b69101b0f20fa6a1bd42810f45f0b38e610b773a4c3754acccf25ee4500c6b1ace2f7f635498ba0036ccfc2fe435e0464611c14852ccb8c3deef0d33b0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d47b1a22ab928b5bb20b216256445689

SHA1
8cee30ddc4bc719c9629322194a736dac3a03da8

SHA256
cdc35969a06d9ed68eefac0d7b665f0763f5a8bd9f6bbc6484da3bc14e94783d

SHA512
a87efa2b0ce7c5c61286523f1f4099f7ca055fa39fee49f49962de5daecf11335b718e04cb346c018f4ce7c283ecba3782505fab612ba8697a126d4391f64445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
171b30adfb6a30d84ba1cd48d426e404

SHA1
062fd1f420e60c566f9309e9371144ef2f5f1e59

SHA256
577ff1d9d4f652e52826f33c204204c9ba42c3d333fbb96b7145b254200443fe

SHA512
87fed941d290679ad7dc152887b67f7aa0f23ee87964272bc4408c02bde938216dcb344129542f623581f83b6637b51d55da8f78d5baaf45079ec12eeebd6f1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5EC.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar69F.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit