22ac14d228abf586a1974fedda36d53b3db06d329f441000c4372949ecbe6643

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

adf25509e39877b01f46adef4b991a5c_JaffaCakes118.html
Size

45KB
MD5

adf25509e39877b01f46adef4b991a5c
SHA1

19c61e2ec85034da8870691b4d123eb2678fb13f
SHA256

22ac14d228abf586a1974fedda36d53b3db06d329f441000c4372949ecbe6643
SHA512

fd228d3f7020b9eee775a438247f89a096e08b23b4e6f529d8c8e699bd8cd221f09727397eb9b93707313e411e40e23ad6eb3d9e9a99fe8af51ea990ad1457a7
SSDEEP

192:uwvRb5n7ZnQjxn5Q/ynQiexNnKnQOkEntmUnQTbnxnQmSox4CcPyBQjlKPFuQstw:aQ/xTx+NWOYp++vh4/S7NsbaX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F3EF661-2B00-11EF-9BF5-F6C75F509EE4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424608422"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1968	iexplore.exe
1968	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2152	1968	iexplore.exe	28
PID 1968 wrote to memory of 2152	1968	iexplore.exe	28
PID 1968 wrote to memory of 2152	1968	iexplore.exe	28
PID 1968 wrote to memory of 2152	1968	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\adf25509e39877b01f46adef4b991a5c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48aee3bc2635e0036fe8874fa22123ed

SHA1
5eb737b76a268c713b94275f4b63ef061af220ae

SHA256
2e2354c0291542f36919d26b481d8395057cb586a028b46a9e38f3ad529d1ccc

SHA512
1e60b166ffa8a53da6b1b552cc2cbeda7fb91b1ba0e3c29fa06dc43bbdc0185109e4b198d0c6ee60938253283455644bca2f605f411056a76113af9f6ee9c33e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b6a4c68eb29b212249a3bfd54898fa3

SHA1
0c5962e1ff0393da837f4fda3135b7bd5f107c2c

SHA256
5d5482a608387b024d7c0db6d332fff77f5001ec9ab1691f7e694582af1cea6d

SHA512
06ca30cdab3393bf427be97b051af2a994ed203be2541230a7179ed46e7facf8114b0ef27fa2dd8fab4a3363c17ba1d178e4f4a2dbd63958179d7122b187ebc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
908bc7551db6cc6ea768bc875b3ed657

SHA1
2674a29ff1a0bbf17ce9190adefa33e3ac6eccb5

SHA256
97ba58aa44f111bedef2543d72d5c5dc0b8ce2feb3912c06d30f92ebeb160422

SHA512
4937c9e4c27ccb3f7443f4d44a2702f20f0425b22f09edacf7d55dfe2671557031fa2fcb315b21c4c4d8147c654164e50808b1f10a060d974ea16f00cf956e79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
236183fc119e9d2b2b9cc1084c773da9

SHA1
340a77012ba1d8987f2bb67100e436aeda3786fc

SHA256
9b2ebf6d073c9f0fc57031a42a2ba9781bf91821374d5e01d2807fac2be181ef

SHA512
344bff8303abebdb2a2c7e50171d39f2ffc5fcb41cb20fa48c86ae32cf1ef3c4a8c9c67822e329f8a5c31b5ccd809e47d03917f2056bf62b6c998905a6d2a7e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e81f4862429fc49c293558777414d1e

SHA1
44ae41705fe2605f3dfd8b204f60851b85adcb07

SHA256
7409d5390fd20f504b9130bd796f50b505b240fe6f723441801b3be3a07f5caa

SHA512
fd64cc016ca5917d726ff870a2869699fdbdb8acf06441705b26c615fce4e40564c5fd09ca3e0f3c2331063c8971afd0e805e04ec2d1d2000c2229180e232900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc008dc86a57bce69d263ee2c27718f7

SHA1
4b523e2e52155a304955e857ae6c1bf38d02e725

SHA256
adb87329454d80eb6bbf0e539833b247d9b636a48b1ede50b37792d05b539fc0

SHA512
bf633d87c7c8100ad45a3f0ffb3733427abd6457765b4330f373ee27dee495b3512b030f2c48f33caf2c2c78103159afbd50dcff81e93d1c56f638124ed1fdbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12b546f3ac8478c81fdcd71f39922309

SHA1
7d7938d693e400c2f602d00ef0b231ef3124aad9

SHA256
97be9c75d92989337dd3e05e8e236e27a62881f801113a1c3bf30da2537c148b

SHA512
f775097b5ae9ce16d4b762c60f248b2bec3aba5bb6dfeba645f5a73cd4e0d5a6d9f2d8a25e321d45f638704e1fd4d56ccfab2fba2a8697d46c333fc22a0506b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b07a8c152b8f8b927a8c2e2a073a5f1

SHA1
fedbdc6a56a60553d30156ee168eabe7bc83eaba

SHA256
7ea5a8b3f107d01d003607e2d63fe59dc44bffc529cbebf812546807c3743b89

SHA512
7089495f3ad165682b77e806ca9131454b24d19098b133a472b94ad0a0b58a785d2f91dc0fefaae55e3aa3787dd520f527436532523dd2b7f3c4dfa6655f194f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65389e6f85294a09dce84b92b3b0495d

SHA1
1232ae456325c0b97958ae0cff1f893e3d945bc0

SHA256
216f0eed03323a211cdb7d56e34ac600c30ef4e1cbf41f6e4bd9486c14b0bfc7

SHA512
958a52bca838ed4e32838c39a8c2754353dfcd62e6d3cbbe44c8e133ac7c8133459cad080d70c692f355cfa495a25040342baaba21b58d5399fdf29c00eff838

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6089.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6128.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit