e2e7b1c1c2e94e8d49f2650023d6fc95588f05f93262e3b22892ff4857c01b5c

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad96629820f4633b05d32cc948f99b25_JaffaCakes118.html
Size

31KB
MD5

ad96629820f4633b05d32cc948f99b25
SHA1

6c7972eb04e86a64cc12fa7c94e548a30174d404
SHA256

e2e7b1c1c2e94e8d49f2650023d6fc95588f05f93262e3b22892ff4857c01b5c
SHA512

5d5dc09be1a0b878ada82084e141a1b55a20e5327af380922731d2abb5081dac17d4653df741811dcc41e93b924bd5d3d714bc406f05d36d822306b981aca7cc
SSDEEP

192:uWjLb5ndZVnQjxn5Q/wnQiejNnLnQOkEntU2nQTbn5nQXMCTA8RyFLqDxcYLujZY:p+Q/t99yFuVpLkZQiKJqCTO2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2FEF63A1-2AF3-11EF-A3C1-4A2B752F9250} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424602813"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2808	2084	iexplore.exe	28
PID 2084 wrote to memory of 2808	2084	iexplore.exe	28
PID 2084 wrote to memory of 2808	2084	iexplore.exe	28
PID 2084 wrote to memory of 2808	2084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ad96629820f4633b05d32cc948f99b25_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be86a8b67dcf2e9e6bcfdabfcd0c05b6

SHA1
3e283a701b4d4a9d0fb1c79f3f1ee7e6f1b41c70

SHA256
69703ea383e40da71abda733ded3239b3c66d30ccef462878b2ac4f2f58a7457

SHA512
9906fef7bbccc0e40aa074e727080a75553fcfee3c7279c5432fe16ad2827e47d807879cd357e0b9e716e40cb58f5709bdb356425b243786b0e4972e2dd752bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d72dacae197cc31f1d735094085cbee

SHA1
a1e75826ec1bc3cef609ef3c605e9443ad3dea27

SHA256
8ca9c685ee6954a4d7a644777b869640a7bb4d93af946e6c30d97badc325a9ba

SHA512
9e2a5f765de464809a0dee8811a2a7c6983db57f36b60cc4381b1e07fc06555f1d2cb8941380415346da97e381d7d04af9d4e73520e3e08df5dfb18b1c419889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccd422889ea7e9e709b700f5af05afc4

SHA1
5bfe8ee44f6ad3f9892f961963a6da952559b5cf

SHA256
481a4078847d6cb4ba1cc75a94d9da77006099ca89568d2b4aba61b1c1f971d9

SHA512
56267ca74de83560f6bb48341f039d087aca196bca8d2c1b20eb25b0d55baaf6255cfd51e7e6b2be0cad8b6ff15ce069db7b9b74b0ea06064b848b669dd680ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45b62387c6f99a47d17692d43c2ffcfe

SHA1
9199a61d22d4ed58f32366913fc76e7a4b1e23e3

SHA256
2aa2b004db3e2bd5d07a17c9ad3892b46235d98b1fe60f0b1b95c5712104ab4c

SHA512
8723ead3f6217c09bc25c07d90dbddee21b6b9acfe2f541631b1b199e9fe4b254477bed00115e5da854cee3debbf807863099f80a61f4c9cb0771a35048eb515

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0dbf8776d52c408fc92e12cbb0be900c

SHA1
371e1f4a053e613d92e011e51e66462320be8023

SHA256
517307fe4e278e776ad35c0f90f8f0f399616f8c393b053118b2db1c1557c743

SHA512
992ee7194a24865fd29b703f726c65190c7dee81c346a247c78977e351a2d8f3f562d197b0df66bace82514c17d3424bd1011209ac4e2b350ab087ad3747ec31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78f0796722faa8e71689a26f7f366431

SHA1
e1471b8e3df11071d2c6f7290d72c5d162a88cf3

SHA256
c15718a21606a98fd90cfbba1d6aadee2be167a8b447077e226c116fdd50c758

SHA512
dd0d1c61192f75bef01e17236b453d13c8ce06b9bce505d839f898075517b1fce12ba6f02352d9009de6c0d5dbb33bb8ac2a91c8c6d3bac526f72be4097f8e15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db928ed834e3569122f45d44b914e840

SHA1
2dac5ed70dc4e2fdb88d97a7c4b191e27fd61944

SHA256
2c1a42893760129e9f2186b4dd3273fbb1b14353a8b72054feb5de6bb6946820

SHA512
bf0d8fdb679ddcba01f713c812753f5309a9f9e9ba6ac808e80b2cce401b71ab256290d7379153bf01710f141442bf94b85ef03dc155f6eec23b08355270c647

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2e7e3e5714662967048b04dfd148178

SHA1
86032998719df8a8bca66088233a216aa5ddf5ba

SHA256
52218c9ada0632fe563dc811cffcb4e26f9751b9bf2e94ff8808b7cfe4514526

SHA512
7b347b491714d4db775ad5b134bedd481ae9eb59f80eb624c65389efd879e0639e5f19e8398a86c6ed98d9bbf115df168eb48ccedc6128c3947b295df25685cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18b4c8c17a67b94372396688c9d52e06

SHA1
13c348b81c87710ec2ef6134fb31a7b444f6c9d3

SHA256
c63514d549ab4043cd801b9fd7e3f30650234037872a65a62234920735bb0341

SHA512
0b3ee2a3562ac0d307a5b7bea08a22181d860a68bef022e6d43a0611650fb5bc47a16e44707f10260757a51e2eaeb9991e2173d018d05de47419889e3dc4871a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab758F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar762E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit