71013a9baff767df201db244a76d9ee94fa8d9dc0bb4a37b6990793fe6f4d8df

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acc6eb1c18f003578cbfea1932870e15_JaffaCakes118.html
Size

26KB
MD5

acc6eb1c18f003578cbfea1932870e15
SHA1

6fd30541a4a9802884c24d471d21c636939e2f22
SHA256

71013a9baff767df201db244a76d9ee94fa8d9dc0bb4a37b6990793fe6f4d8df
SHA512

3c20b0b267e7c67dd1ee7def958ea510219b8840008052dcac845f544ea1bbe2ba753c5a02b44a36b2482b70365b824faeacf6dbf5873c3c7dc44d72622ba820
SSDEEP

192:uqkfDab5ngqnQjxn5Q/TnQieSNnYnQOkEnt1lnQTbn9nQwCJVevo7NtpFo+NzQ47:nWQ/tygcKE44

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424584875"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6CCB0BF1-2AC9-11EF-B9DB-4A2B752F9250} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
1512	IEXPLORE.EXE
1512	IEXPLORE.EXE
1512	IEXPLORE.EXE
1512	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1512	1936	iexplore.exe	28
PID 1936 wrote to memory of 1512	1936	iexplore.exe	28
PID 1936 wrote to memory of 1512	1936	iexplore.exe	28
PID 1936 wrote to memory of 1512	1936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\acc6eb1c18f003578cbfea1932870e15_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e2ec14fad5dfbceb347c55732ddeb92

SHA1
9a02faeeb3a89fe388705ce4119ff58cb7002b3b

SHA256
f0573cb580def650da1b9a61d0327937d6c2a4b6a3e9e1683800f437df6bf6a3

SHA512
cb7c4793abbc67b0f9a9e0a68e72d77d63d710011ae0a6e4807376dad994d5acb9a9074f7c3e272edbd229f0e4137098cf03ef3c8d114afc1c2a9fde876a885d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6b6cf38016c036cd12f0d201537d7b2

SHA1
e3d78a9fd68ae81be818955aeddf80a8c0e67954

SHA256
3935c9059ae71d52c2a973b58d23d34029335351f42f163098611bddb8a70d38

SHA512
48cfa0635015ed9b567c27d72a72d42c7f3b312257aa36766130de66132539e16c36f436b732c32f1fca0f3184524033a45f7133708fa7453a37531a6e69a509

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73709b71612c02bc02e4c52bbf24d95b

SHA1
dd458bd2956e45c5d032442b0f13624f7745fee9

SHA256
fd32c422afebaef9730dbd0aa66d23d89f3a9462545a78a8957b127621c55267

SHA512
68e343e17860edbef7ba922bc306e4694d273b9ec258dbc64f4a93455d4e2e0fc87e1149320231107df6b52ac1760654d4a31f8f46bc8c72fd22e4ef45a9dc16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49f2860b5f8813d4642cf2ea1e7d7779

SHA1
a1cda0514267657c6d75ac54429fba508a14ec45

SHA256
dc799d1055a085d16ead6d04cbda1e050eb29931188f27d6ac0cf4fae3ca65ed

SHA512
09905141bd798a2530bd4865e07e7ba358c4bdebd27e83cdf5528d0802f39980244854f1a978f962c3e84a1e7750777aec7cf23eafdf16b8272293534a683875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ba28c43138244eef18b53619d97c686

SHA1
b0b730c12a692f90763f24e62006d4d510129aab

SHA256
b42a78930d02df4e4b5c2264ea4ed307cc3ec3b687e297bdef8b7ca538a7aa3c

SHA512
986d90044d086f33c8e653ed9dc12df432c428fafeb74998b54e5b5dbddf82ab14cdd6c1faa7b816c35a520aa921584b0a25575ef1b710e179b352b8d87b7512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd4a9968289e32405682b8e132c1f4e9

SHA1
eb9225a94b6f1537516ea31c7718a89271872461

SHA256
0f8557048cda964080d8820dc46cd0080f0998daa3ab9511b8e0dbe85c2c64b6

SHA512
9a0f1889eb40448f4c2aa9b7ccf73097552857d305e42d5669f33d155edabf4ef22d80d602c32bb3a7a2968939ddff2d5ef59f78a93e9f11e6ef12b824af6fea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75fc83f13ceca72d3117c98f32847b97

SHA1
82b5a6bf95a4beb9185413190dbc01ebb38e09f7

SHA256
8a38a304d818fe0f34192f51e8a56ddb46356bcf337d41a5dad66f463fe33641

SHA512
9880ada2297b515c1081805f63c14737a591fd8ac9e7e3f0fe86de2c437e8d5468ee1db11e6062e5fddf7527fe56d7a125816cef193ff3d7a88289e6bbed4f70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b84e4849f8c01be10ed79462d11e33b8

SHA1
a143f248f9ab64be05c999769ecf5bebbe1e4826

SHA256
ae147153fe3f166560f6d5db47fdb3aa7084ceca157ebf37357c0fb703821145

SHA512
2e499ebd012a789a3f33dba296bc38c8c53f85f8eacecdd86bcf4ef3d181c34a01a983991457d4208e5fc107685bd3f33b047f0b9a5af70117ef78506c5da912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8610169d7123d21b0caff00aff61f46f

SHA1
4da85f6c96ee71f5522c7bf242c46c69a1525ae9

SHA256
3aadddc7b0d2589a18b6a752cc57285f4e75b5e18724e28150949d0a933c57f8

SHA512
4ed5cdcc27661d967848e3b8507fce728b4ba7fed1821064a9e5d72506fc93c85a0b27009482206cfc0154c54f08e728e3ae8c718d0707d5edd0af5f29c9911d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCEE.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDB0.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit