73ba68c11765043c1eabe74688eb17f77a243616671034a380b01592370221c9

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae8e66feefb7afe9bcfe6b616a1afd0a_JaffaCakes118.html
Size

27KB
MD5

ae8e66feefb7afe9bcfe6b616a1afd0a
SHA1

c5a18260b38271f826e737c30a9605182c61ad54
SHA256

73ba68c11765043c1eabe74688eb17f77a243616671034a380b01592370221c9
SHA512

29b632701cbad7ef11e73b28f31971ae5689ebc582d3f8c87fcfdf6389fd8e76e0d7c0e05232c17850a5b4bd1c4274f1c75727db52a53a1ba3d3ad4098a09003
SSDEEP

192:uwnUb5naPWnQjxn5Q/JnQiesNncnQOkEntrrnQTbnxnQ9e2Am6lRciQl7MBMqnYQ:PQ/sL4nc1S2hI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12822FD1-2B18-11EF-B489-E681C831DA43} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424618655"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2264	iexplore.exe
2264	iexplore.exe
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2040	2264	iexplore.exe	28
PID 2264 wrote to memory of 2040	2264	iexplore.exe	28
PID 2264 wrote to memory of 2040	2264	iexplore.exe	28
PID 2264 wrote to memory of 2040	2264	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ae8e66feefb7afe9bcfe6b616a1afd0a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f107094dddaa30cd2102d3dd85513daf

SHA1
f5c957659594100e09486b4280319ef894b022ef

SHA256
8e20a711baef2bb8ca1a3273a6eb046c474430cab960f263947215c66a0973d4

SHA512
30bbe5df93485663a1675ed4ebb5242e65f484daa5a75c25328e575b1fd151c81b61fe42a60b387bacc24b83d8f7f9af46db9c45d3c85a04315ce964bc6e4d33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4eafddfeb53cf309dc583e571b1c55ce

SHA1
aa4b00f63127df042d8a9909e719899e8b6b103a

SHA256
17380b0dea2a2ccc1ec517d8b25059dfe6514ed24bec5b9a24a04a3434eba95f

SHA512
153c49ac47e7717e4eb570abd338390feb30c023ce93336990f15835c666ed83780a35431298b6a96e9badf55f453609db1ee8b24132cb27b41e78ac29ba78a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d383286b76ab59ed8578287d05446218

SHA1
bc52d504fe4d00875a6f2b91cf0d80db0c39cbc5

SHA256
fc48e96285e81764da107f7866b002ac59231982eaf6aa6b2760f3bb48659266

SHA512
3f97053d676d436864c2fedfc85637553091b62f053f60ce5447d0fae9a0ea9ed531605e4c0a3c84a22d4de1cc0338b5dd534b501012b7919d550298e7a491dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95d3d814d4d6f3ae9b29aea8fd2da8ce

SHA1
164b4dd2875bca8546cb96dea85489512f532b52

SHA256
6b03204061d4f3e55bbd894b9438bda45a080c7c2f58ab4ec65f479519a011b3

SHA512
6153597d9feb97e3f295b15a852a306b58d8730b8856e196c6cf11dd2585b4b8b40db5541dcbff6af722c7fd35f588d4fab222338c367da15537b401a2179707

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc692cf8b492455b8c9fd4f5f374addc

SHA1
57017cbf2cf7bde3231cf4dc215a4642ae8b7c5a

SHA256
7ef38197b4938c8adec5aeb95cb36ccb9be18d85fb8da229dae56525386d6bbe

SHA512
ff5ebce495f70d8a12703367c200f0cde00e2abd0564fad4e46ec3031914828f6927d750f67e01a674113abb25e00380b80190ca53e69084a90fbf06ff61e399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f888035c0af059bc2f5d3c9378f4113

SHA1
889f4b6c4c2a3f71023028bb2864e2ca12ea3a49

SHA256
452f7af9bf98b68ce4b794087e68d5508b31e5e20c336f64aaedffef2528abe0

SHA512
7fd629308a7b9d7cd6a3bfe571e21004a86de38ff04e748c1e77bca8b246974c8d6bee52a72a1f351ef1674a13745b424eb758d8ea907e6b11c62baa003b2876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34abcc703f255ef7c2db746bf01f0e64

SHA1
4f24af688bff46451c3e7cd6da2ac8c0134de855

SHA256
92128d5ecc33dfbf9e35fed92c6eee8932fc0e4c1373534a453aae69e3fcc242

SHA512
4614d7900c6d4f39744ddf86e00748c6d157cc47564d0914c9b69350b9aea0d38b04fbc942acd283eb300b4631e4d434055a8151c2565d398c6d2c7235382838

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1edf3398b48bdebb4c0cf85d4bfac45

SHA1
8937ff786273b82759acdd70883138e001f84892

SHA256
96f4b31499fbf39e039562103541bfd70a5cec3206287123fd5ea270053b6499

SHA512
f40b00009ac1f8b9bd4daa7b49a431a4bc9bffa6dddb15313c5448eef529560880c75ffcc5008c5c0f239f2bfbee59bdb886c6026c6ac4aa4ab7ccea15311f57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07caea255643c14356a7234cce970ec7

SHA1
eb1ba8db8056747b74d2f583182bfcd8948539cb

SHA256
5c2b96ddef0db8d86b9f8255fea7d7ff79c6781ac689d60a52db2356a0e4039d

SHA512
8f243f2f59558bec60b54d928923644a4599be9ea95c0e27213fc7f88efcfa640647a248d6ce718067f84bf7e6ac817f35a16e91bfeeea2ece0008acdf366830

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7255.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar72F4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit