bed0aa95e6d7e4713fd4a5b2cce7536af13535ea3187ceb9ad9113d160f07fe0

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad4107ab94ff97b65210fb4c7becf719_JaffaCakes118.html
Size

23KB
MD5

ad4107ab94ff97b65210fb4c7becf719
SHA1

2a3836d4f20a51c0acaecf6f4f77efe1bb159612
SHA256

bed0aa95e6d7e4713fd4a5b2cce7536af13535ea3187ceb9ad9113d160f07fe0
SHA512

a48f4f450bb4108f759bbc7a8706e2b86e678bcba719514e34ccf56199c7c8e462f1a87b06eed7d1e210d148449e1225b6dc9d2837659f13e7967d903b75b26e
SSDEEP

192:uwfEb5nlCnQjxn5Q/onQiezNnFnQOkEntMqnQTbnlnQKdjzvMBTqnYnQ7tnkYynW:0Q/68h0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57640201-2AE5-11EF-9F86-7EEA931DE775} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424596871"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 3012	2156	iexplore.exe	28
PID 2156 wrote to memory of 3012	2156	iexplore.exe	28
PID 2156 wrote to memory of 3012	2156	iexplore.exe	28
PID 2156 wrote to memory of 3012	2156	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ad4107ab94ff97b65210fb4c7becf719_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c6ff0fddb6b0f2116c889fe699abd46

SHA1
47520e325d40e5da8ebef9db0837cbfcf73c9c28

SHA256
2da1a054ae71cfbc815b909d5d23f998bf11753a9781a3f162a786a8c6f52c00

SHA512
19d85577c2054e6bbfe77bc88274860e316824273b6b3bafbec2aa88efb42c0b52b9ad5a95e0d064119ed77700c94d0cd39f52036ab00adbd04edc57e6c09263

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7839bcb2b9472cfc3883fd8aca0cfafc

SHA1
e81f7c5750188e17eb904d8a91d68573b556d13e

SHA256
995f820f50d0c1776aa0d29639e222d4726f4beba48e0fc9ec12ed7b82f2b922

SHA512
f88051e96f19a85abc2ace046ac01b76a02041a58848c3c110eadd7388cd4e05e641fbe903d12a23a2afc897126be2327680bf4dd18b49f75efeb8cc0e50a0f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0f53aa6ffc6642cbf6112f11aac3c94

SHA1
49a46238e0764fca4fe3eb428dd544e3e0b375f5

SHA256
f112d65154800f32df56497e3e0c8ec083c4f71cee6f9cad23072315bd897d23

SHA512
05e8678efaeb10c33be0b57dc9f4b3fd9886c9e4b7e4fa8ea3b61dc9c1f305b479e637cfa026367441d46bcee3346427b13f213a93451cefa14ff2772a534dd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43091ca3cea90d9e0228422d47d7959e

SHA1
aeb96695e95b26ee26a6dcff64df9ee31ee0ca29

SHA256
6a2cac73c6f8cc37994d2eb5f8258d0948678717bf211adb259d03f2fdd7264f

SHA512
f591d6b2980dbeb2285074d4b16df7f28b93bf03973a34a4f9dcb297628a507a6df02c354f1e7a73e99ef82cbcd49bec5b4cfcf96f4c2b4e78dc00d2e8d7aac5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a75668429377f10b41c94b9f641e4a37

SHA1
f97ba2978fd37ff7a95782ef3c2337c78d309663

SHA256
dadd8e40407b52bb5c137f6ba30fd16ce34b8662bfe6a81f5562671b290ade4a

SHA512
cc7a8466c4793ca277b72df20d6eb52e35a49fa79b42bf31378b911f214d7ae013d58769fe2d26423c7fa4a11c343e17c243ce6fb78d14e035892d8560af30df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2bcd1c72e37cfd4c0e47b67e0ddc34d

SHA1
378c07f9901363cab34a5069eed63f698ae7b04a

SHA256
6cbc35e4154300a9594fe1ad853ca1a720f73a3be82842cd65e9449337cbf78d

SHA512
1cfe7d8dbd4d18e592784d18aaab932a6dc6f7feca9bfbf81a80e3b9a92e7408377bc3e5b364f2c634c02451993e0746a19146b60d5fc824669f781e9627c2c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff7b5da9ca707967ef8a8fd53012274d

SHA1
bd655ada770a2c948500653e22efbceb4e8071a5

SHA256
6ffd306acd1e7b1ae2250e1809b76af20f94216ba358594f69a1e1aa817e9c98

SHA512
055063838e24064d64c1777dc894a6410c3cec441542917c3fae7170d1252ffd7b6f91ec43e5fee72237171b2346aa8405d4e760be243e0063f44ff5adeee94d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1aa6822682187f7e877a2fa546d54783

SHA1
1ce5ad38237f0c7aa18ec3edfa1d47a6b8dff3ad

SHA256
4e4593a51ac9e67ba937262d42c1d4e006c3e540d306994028a646bcd786a67d

SHA512
72c5136cec17dfa02a84a3c89b332a26c103633b216f688a912c72aef366a4f1d1bddd336ac97377ce0fb99b3dd24939dbf8e76b71be385bfcde98bdb53646de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4238bd2c70af815d8e2806831419a731

SHA1
769d37ef900c5cb93914bc2b7b65310eefa3095e

SHA256
755b580e30536e7272f066788b6ac35e548608637a5170f9b18168cd55e422a8

SHA512
d03a0419d69e4042956e8e3628553e3d7931fe37c6a1bd90da614e57ec628e0e4411e7a2a5bb54c19fd9f238886d6ebc16fa18cfeea825d9f3be225aa2e2a3f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab365E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4312.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit