4720201b2f2389df9d8620d2b189161af6043cb06bdf2910754e698146b4073a

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acf26e29d1b0963ea5e6e7224e9c5c30_JaffaCakes118.html
Size

34KB
MD5

acf26e29d1b0963ea5e6e7224e9c5c30
SHA1

2d701ee5f3da9c428fed8baca44882ec0758e430
SHA256

4720201b2f2389df9d8620d2b189161af6043cb06bdf2910754e698146b4073a
SHA512

ad877331afc9e2071e4490fdb8e661c63f6fb446e7d36814bb1dcc7eb8db16c8d0ed410a67fe31a4e5d073b7f7052e046af1cb449c8ee1d39b878eedc587a246
SSDEEP

192:uwrOb5n++nQjxn5Q/pnQieENnAnQOkEntD3nQTbnBnQOgdcwqYUcwqYkcwqYQCUM:BQ/75I+5CUQXwKbdBnOg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6932E581-2AD3-11EF-B73D-E693E3B3207D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424589164"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2120	2156	iexplore.exe	28
PID 2156 wrote to memory of 2120	2156	iexplore.exe	28
PID 2156 wrote to memory of 2120	2156	iexplore.exe	28
PID 2156 wrote to memory of 2120	2156	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\acf26e29d1b0963ea5e6e7224e9c5c30_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9eba6fc683b01be88798632ab431666e

SHA1
eb70e6eea9a4ef78aa487f2be8bf6d3ce941be94

SHA256
37882eb2804fd7cfb8b782144db050c23486ff791fd84043688d13d356b88a80

SHA512
e3672d56c534ebd30a69c6441ffceeae6ce09389dbd84f9a1d3f108d20d2c8bc2fc0ad57efad59c3ec6815d3325a87c418e3a79e068dea381755a49b8a0bbfa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84653f91747b398d980f7729e9ca6e01

SHA1
75ca875424c56a07d97f55d8fac85e2bcb3afd4d

SHA256
ba90a586cf70b78b764aa2227cebc3e4360b765835a666b4fc478a3fb9c82ec8

SHA512
0e7f7535ff122b08888a921afe6ebf2626462f560bddbaaa04b491be2b86d8699db58adff60895f09d733186909b4bfcbbc0e0a51d86ece6d2b1a18e9374361a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37cd971dae0eaf34ac77b15bb86ae105

SHA1
a534f1a97d93848d1303cf940e495486d9077400

SHA256
25df782445f619463ce3ab287df6d39bda7c0eca90d3799401aacce0ca4e181c

SHA512
7edef2d3583b51bca0ceea25ce43096dbbdcb25cfdee5a49a3f5148af24714a8ebca757dba6b947391b0f3c8edd39251c55f72b9bf53805ec9f1b86d653a4e13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c3e34f55e27d0bb3a30a18c11a6492c

SHA1
0f3b7d204b6532c638772b1e96191a23b1406bb4

SHA256
f4326bbd8d02c1d9c2a79b887b97524864354433fc571e86389a8c4ccfeb08de

SHA512
bc494c9c7b60636b092715b54013f1101585b7a0ff0b56f897d4d3151f75c979ecaf55cdd6e195a16584b13cf7a00db7946923835507bc0e5f20bb3dea7554ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d3f693d783c15e43cb6df3408c1139a

SHA1
a8781500c8507d818ce0420de1786376bffa2af3

SHA256
2c048e8532f5ffad8a6e3c192fa98b47554a3cf3bafc99cb37a7d13703e97ecd

SHA512
d8313eb0f99792b01b7333621d529b59338bba73773968148eade3b8c8e5f8e06bd2d83c0bd54437af3ebbd8604fce0de4134e31c9eab0c6f0d86ee3956d364a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
357d3980a59e0ca86b97caede9250f68

SHA1
36e55a415a2472700e20d07adf35f16478e3b00c

SHA256
4d87c15f7b08b554249ff6f89d5e430d6f653cdc895fa65ee0ee9f0874cbb9a5

SHA512
e1fa09ad8862dbbe23e76d4d7bd508746aeb99a4f935c6bc11c121d0f033870fc2bc4b49d1ce02a887a3d085d8ff1e1b4589a81a8446eb25b62d9e4b3d674e52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c244b3f515d5ce69a9b0b507951e6f6

SHA1
75bb5f8a1eb0269abcdc57e018c100f92ae19918

SHA256
8e1b7e3106aa843483b053d4c3d18e0fa33e705fe057f2d211ea66def682ec32

SHA512
6ec0d54c50226e1a7a09031c39c68b918ed5b9d3d4ba0802d49c32a980859dc21df70b759d656b10e6b2547067e814cc00410d909003211a57adc9285ca06527

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69fda64b62d71ce52929cad3b17ef506

SHA1
7912c77fafaee7f334cbe5e795848556969e9260

SHA256
f3422cd06e3c318393004a35f40f8a4a6109858cc3821356a3fddecfc22c2d6c

SHA512
74dfba6d4782927ff329b7351c8662b2818dd9af9f97d09db53cf282d97b2ca1a8ae38fbeb7f6eb3f29d5381d95795f5c266ebd59d50df58615364bae3ca7433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64a91ac01c22fc57e9a8c2a55c430483

SHA1
6b3dda23c40ef62e472c150a9099339145128ba1

SHA256
f86fdb40b4cf45725909af08c538ea5602b759c73e53f841d226bf2ce870cec6

SHA512
f47062c57bb3437f12c0287ae85f24e656b11d9e3c5e579135d6ea60e577238adcc24e085eef9c8d4667999d25448adb3074735bc37a9f4e4547013e749764b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabACC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBCD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit