29bdcf9ab0fe7cbbec8b94ea7186b7b0e3fa5e3a245ef68c2f694440ee6ba946

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adbcbf35aa94bef604dbda2cf1415991_JaffaCakes118.html
Size

23KB
MD5

adbcbf35aa94bef604dbda2cf1415991
SHA1

52d78d92efcbf9739185c7a102fc35d69342d501
SHA256

29bdcf9ab0fe7cbbec8b94ea7186b7b0e3fa5e3a245ef68c2f694440ee6ba946
SHA512

8d2cefcdf8b261fe4abe8a7149ad81aae9e1f5750b1d9632243031830937968733f601855dad840feeeb8b582745d17c75d4005294d533c051e3fef3806f7a05
SSDEEP

192:uW34b5ndQtnQjxn5Q/cnQie/NnOnQOkEnt0anQTbn5nQ9CnQtPwMBfqnYnQ7tnsB:BGQ/+RPp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80E1A431-2AF8-11EF-9BF5-F6C75F509EE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424605096"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2152	2248	iexplore.exe	28
PID 2248 wrote to memory of 2152	2248	iexplore.exe	28
PID 2248 wrote to memory of 2152	2248	iexplore.exe	28
PID 2248 wrote to memory of 2152	2248	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\adbcbf35aa94bef604dbda2cf1415991_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ced036b8ebef8d92ac463ee217ff48c2

SHA1
b94744f5aeed15d2b0f2f3fcbe16a37b186baa37

SHA256
6c4c9847bff8cb36692b0bf7c7324c305548ad1d720261a87dd05df94b9f7f37

SHA512
4cca216ae851b99123b4b15053d20d5442782cb8ae610b9bd552cb3a819ffa030e0f2f1f6dedc748b52237aa006a7f4bcd694630da4c901238344e01def870b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad39d204980793b9fdf8947b123ca0a7

SHA1
f01f33568f157a1b4c5e619d383c61c84d8ac6df

SHA256
76afb53b34e419f25d3bb79b9162888707bc107c31b28328a023789c88add9c9

SHA512
fa4d941b19edbb8cef807b631247f7aedd6479963926a2e1fc5b17e1847fdf64ce69c2c41b2bcb4644515c964f74325f23034f9fd8403d1eca305dc6d6fefa74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3814bf2e97f9993e975015f5da94b5ab

SHA1
79147a669b0dffa58835b581d67492430b3c3233

SHA256
d8a6fe00d326202d9b987f826344304dac598bfb43113f30905e9499ebdae0c6

SHA512
e53daf4e2ecb28d955711745d88afa4d2982c29873eb377ce76ed374b79a9815bdb75eee374b057464c6baf101e27f0d40654681f8884abb14832c3761ad1f35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a16fc71f0008b12f742178bf06e4ad0f

SHA1
45ae3dfcedc0443ee36ef482b25a88a35cf10e74

SHA256
11dbba50dcfef188840ad13345295eb2b744c7ec6acd3a6c55761a95bf83ac25

SHA512
a0dbff18cba2c0ac66f669641f67e7b1d1aa08c562fec2d1b198e8a88ac8b6dcab68b8d628984c835e79135f9a3fa159bd7ad208a3fcabe86e9f7fa87c6a8e3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f91ac24065725ff561b78a18f9f0c0d

SHA1
412fea7b2282a81e93d3543e2db7407786d19d7b

SHA256
9c2d05bd0719249e876f20e8b53de838bd8630c6102f732c8067763e46bcafa2

SHA512
ac10e13f8da16f95f41b6b316a38aa9eb1a7d7d47e53b1a1f718181bf3266a28badf1ab2ad659a8deade00bf9220ebc85697ab31d1d239edc4a239ce399c7348

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5b8051120be50a9cef6ea35a005107c

SHA1
b68bd5a580f94d9ef6c357da8d72f66a7996f3aa

SHA256
f325562510157ceafc7245513aeaf049390fcdb90be4ca324b29e4f348a64ea4

SHA512
bd98819e283867253894efc368235d91948e73f6eec5cd1257ec3f5cb5b2534ce26d3565d0fe668bf51490009bc801a36ab1af87d910fc74df685f4f52c21a53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f83f2eac02485d729d4c9965b06c5792

SHA1
0053548f0892b90f2a9d8bc412aea90b3b1b9ec2

SHA256
e0dca35f65890738dfa071ca5cb44f5bd5ff96d5adb150b9a39dabfe587f8351

SHA512
c90ab6f937f41ce270012bf81751618599b186bdf9107ac33814a9b98b69a6850b19761f9f5d71cd00e6b427e6382c5ac384629ae4aa5078f246fc2881331881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25ca2a3bc667bead08e47cf7e1aeae77

SHA1
1162f01015af34b35f4e56391bd7230cdabf0aa4

SHA256
00e38ecd76048a006cb148717e958adefef69d7f868a30554d006e47c96fc6b5

SHA512
4de3a0861928511310adcc88f34ea2eda74a68d2e968fb753af3d809ee45b0a93e8987e567bd7add34196b51a9be2a2e404cec6c98adf0156f3580e98f2e3c00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6036d5f9e62a02b7e22587ae20603e0

SHA1
dc6257c20e604d054645eef317188eb344b69098

SHA256
192db69f64a2df998a0b1b374fec78120ccfa3294868ef23bb72ba195fbc6634

SHA512
2d50b3e574265954a41a10b64a7e5767c6f1c2a48d022f51d13d00acd885ca03be72f470a239bb5685e7bd61f6ac1d6d3a9a4b6dc4c0f1238cddbbb46d79da96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab647D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar654D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit