ece4daacb61d7acb5d5508de5f15added16abb196cf45d53b13319a2d3294ffd

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad427d9efd5b8204a516c22176ba86d9_JaffaCakes118.html
Size

19KB
MD5

ad427d9efd5b8204a516c22176ba86d9
SHA1

8795898d202c220801068a52c5522fd719fc7a7b
SHA256

ece4daacb61d7acb5d5508de5f15added16abb196cf45d53b13319a2d3294ffd
SHA512

42fce2d1b0b52a4ae357d5c940b146167decd543394741bd1b6e033a794f509fc72bc09e5acfdc816ca748c4d6b07ed09b348a72a618f6ed757d34341fe8166e
SSDEEP

192:uwWHpitA2O+Yxb5nZeHprDQumkUGCmrnQjxn5Q/P1nQieTUNn4GSnQOkEntlJMie:kQ/TqCLx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424597000"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7D5BA31-2AE5-11EF-A5CD-D671A15513D2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1800	2208	iexplore.exe	28
PID 2208 wrote to memory of 1800	2208	iexplore.exe	28
PID 2208 wrote to memory of 1800	2208	iexplore.exe	28
PID 2208 wrote to memory of 1800	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ad427d9efd5b8204a516c22176ba86d9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8ad9437a4eb794bfd208192115afb43

SHA1
fed03ce461b8488563126bdb2e10b6f009b31c19

SHA256
28a5fb304912ac102d9b2ef41c4146c7cf5d7db41f0268d538a7e72b8d911d96

SHA512
00dc7936663bc43d771b7da6e05d9c9aa2cd24c5788f68ed1f6bc807f1928add5f3187192daff3554aa3bcbb9678843d8e23e8be094cf9335eeb5db90043b41e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d22693ce3714ed7261f30b00c86d17d9

SHA1
1aeb64d7b4dbadccaef9ae2f305d6e3c1d1639eb

SHA256
2ccfab4488ab7b0d9b4ea7daed6ecc6bc82f00292eea1ed498bfcb282030af6d

SHA512
005015f5436dd0e7d95bc11021e0a01245e7fca307b24c16564dbb6ef29be19c9364944d4ede267aa62df931a0fc339478c42076aa4111c03faca2f9d3cd4241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaf698020dbe2ebc1b416acf0b16145e

SHA1
ef640c2d7fadbb8723c8570f764c78d8c3aa1d63

SHA256
931fa43db2e0d321aa0ed99bf82e2d5bf47789a01f2bbf60e392375d29b33915

SHA512
426d4d08fc205aafd107997146e587e84186592e142be7322e16223e40af045ef874d61b056202d6cc1cce3219685b5c7937ee638d61ce0bce7992c05dbb8de6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3a34d90544c5e68d04343ed207b2c8e

SHA1
3669aa6f5efcd93d9abfa2ec85d55db4539d7e9e

SHA256
6ad5f9ff71ec8c7b67be49bd31267c36bd956459ad5f1c9e46ee15d147d16582

SHA512
715276627994ac07fb4ba6bff0d9c029a60e706c2b560fc90f6deee3696b54eb23008328a923b50d1ba2e0b774bf38434002d0388701c6aa2fda888cd0cf5f4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a145d2ea0b144673c7fd110471f16f82

SHA1
447bc0033f461d28fc90d4f245c682dc2b970079

SHA256
9c12b42289d8475aa49438aed2ddac5742a075dddbb5f2558e589f15a0c2c083

SHA512
11796bd3f4c049122b31dba6f95517584754948a397a563cc62a44900a9b6962b4bb16ab50b9fcd015ce3b0fa03db087ddb737bfee34f08623b261b83f65c4ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
740ab3642925106ef1af2e7dfc6d16dc

SHA1
d3eb4f2756258c9db3b3a974c766c5ef9d69fe2f

SHA256
6021e53d3002aca4685c98904810d371ae98754e863675dc7482de1eb36cdd17

SHA512
371b228eeb3d6ab1a30caac0ffb21ba5523a4170b3219742d09df52f560d28aec7ce8098c26b3ffe609b71e111a85ca5f33a8bcaa1d760436fecaa8692f0ff72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d9ac41abd14256beb06251214f20159

SHA1
ba53af3c93c57e81899dab51ffd96178574938ff

SHA256
320b1173efe09885c0ebdb40c31b7c56347a60d9af2356b046e84bb1d42018ba

SHA512
a7ac4c2bda4ad32844ee4b037f66bf95d2f37963ea447df3cdc33bf4c3345a61f98ad68277c7c02bb3db77e72e5f0d5df3d594e24808917ce7aea06a2736f86a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef824b1df7f512c6e379332102e10458

SHA1
f149e7e3871a396d8a6ba219afeb55f68581ac24

SHA256
1c08038013762ef5a4d2a2ab28053539a44ef995d27d9b222c6963e48123c17a

SHA512
43c1482af35ad74b4685b1a22962c94e3e63708eaed87ad9def81d0f9aac789a3169105e343868c55b9a9c52b52b464422463577a01e4e65f0847428f3f4805d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01a0965b63a8ab41995238207133fe40

SHA1
8e7ea3ce5c1f8068cbaac34d0ab9b725235fd37e

SHA256
b3eb1ff4284a9c44f75937ef2763f1619631aa577d9ee35776cda3ae07d822e1

SHA512
c7faff7dedd0856c36ca26ae20cdcf37debddf5fbb0c994139ab815162ccb375d4e141abdbda5fd7aba359ae8fa1d7108514c27fac45347d59fa357b605b32ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22CD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar235E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit