4b7138be83cbfdf3c650e2d790b0bf0294ce1950833e092fd8a6564c072e71b7

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aec88b7987f3043a829c7c7ceb058a54_JaffaCakes118.html
Size

23KB
MD5

aec88b7987f3043a829c7c7ceb058a54
SHA1

f79db8913d0828f36c98229e6de427ae8383c20c
SHA256

4b7138be83cbfdf3c650e2d790b0bf0294ce1950833e092fd8a6564c072e71b7
SHA512

02d684c0cde2991dd5a6ad01e511e25947467139e4fc022852d711f1ba99fc074cadb8718a7572c68dc913e72bd4c6251a2f3323d77e38516d63053390214c4b
SSDEEP

192:uWjAb5n0KnQjxn5Q/rnQieKNn2O/nQOkEntdhnQTbnNnQ0CnQt4wMBqqnYnQ7tnk:9Q/4OxIbn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8CDD9371-2B20-11EF-8303-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424622295"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1780	2080	iexplore.exe	28
PID 2080 wrote to memory of 1780	2080	iexplore.exe	28
PID 2080 wrote to memory of 1780	2080	iexplore.exe	28
PID 2080 wrote to memory of 1780	2080	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aec88b7987f3043a829c7c7ceb058a54_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
788557c45e7e364a57914c5c625804fb

SHA1
e8bc131dd90a29a0edff12bf7bd8e8370e23586f

SHA256
e74fe624737d09b9baf4acf8b3d797e6bc27f88da30a25b83f2fad5741d20468

SHA512
39daaa5b990532674c37082977b4569112f4c476243b6b4ba4d2160227cd18d58fe0160ee4a7a7b4cf1ae1479f24f8c4c55b45307256548b0be202fd0022588d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6206a602c7a57304330d447671dc5c54

SHA1
de63bdfa6c434f79298d09ded8e23aa6a2fbf53d

SHA256
ecee9f72441f19c80dbd6cd8d5271a80c7c6ecad9a5de70d4692a5ded68621e6

SHA512
dd775e66856f2e47634080e3eaddd1ca910f550eda38d822c26b240e0a30720eca9d3f57ad1fa6856cb4a16e537b613dd6a8f071f806b02d291fb3ef24b3d7c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b308da55497b1d3d827ec17852ddf49e

SHA1
95faed205075440590368f6f3df5c2ec16f241c0

SHA256
3247e6d507732ab55709d2997746e2ab3cf6fd89e8b43cf0b144426c157a8ffb

SHA512
9996696aeb62d672752670b8e725ca325e4202e94e617151b6680cb1c9075e4d3d5b67201b68c484a14cd89d370ed611e5da3191ae880e71239012c183183cee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15ea239958d0e96a8a2e5079aa8e01ce

SHA1
33aa67981ccce157540da21ce17482ee2846d13e

SHA256
7efe40164072d050218b2ab6d293262fa0501d05e46e899ed6f7c5cce8eb7201

SHA512
19486d052fa760b0e64fadef4159a4b9077fe74d830b15c8a0e340c5870972197ac170d2aa5749984a5dadc510cbe423eccb7983103ce9210730a34ad012e847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca45f46c5994c2d38217bb141a79cdf1

SHA1
63b4ea5261ccb2647e1567793d6dd19373a15aa0

SHA256
11baecf1bc8bf6347bb5013d59a283a8224005a399388d8c2e3eec3dd746cd45

SHA512
4687f4e794ae5364f730935c40e588aa7494b553bb8cb887e44ef80bb2fd5e863af0c7cccb8fb6bc720751bf72a97d58ca4c1f128b4650ec35ad0ee3cbe73fad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e734b1bab5c0c0c136625e9683233a8c

SHA1
9638469f4f28fa9ea22b44847b589a2cdb635fed

SHA256
753fd06c07272f5f2275f658f8c7062bf353856113b7d0f64e2fb74c75222d04

SHA512
5f39ce386c07c25c70fa3d725336c5f8c92b5162efdca56b13c8d55bb14035f3911504ccb224fec202eeb4ae35dc16b636fcbe1c2579424bc4e24d8c3e5fd99b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5564cf8fb28066004adeb82ccaca5822

SHA1
54856b546d4ba05564df6f7a34508b2e87aba50e

SHA256
0095c5f2ed0ee4cc839e164dcfa36a38c13e30be72601cfbf80eebe757b9dc91

SHA512
b5780c678dba28a1edc58afa3d1e18b03d323191c11926670918d1753e194e41c1783ae2273901a9a2a3d1a3b2f0c81ae423c4559b848cb40294e6ee424db61f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6613b5baf17d746a34227eae8b92db7

SHA1
bab9216203c244049fbf96a849606c6b563c5112

SHA256
14f58ccf3deab6e52c7c7d84ba7006b8a113d875eb71c898e2f63317aa3eeee5

SHA512
198337bf9ceb1f64cbb21299d7b4fd7bc040d5a29834dd31bf4ad65fa389dddf0426297b684af9efa3c8011049660eea1ca244c317d28ac35370ae58043cafc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbbca508f06abfb695a844103077ecf4

SHA1
75321afd0bb5eec14c1b3d3491cee6ab64608432

SHA256
473609862ea3fa79c5c9de6790fa76b7f323f34bbc2f2541176169d883783265

SHA512
2a7fddb80495ed98fcf4d1d2708454692cff240b86de87cd34b2a93be113489146a219a4fb988e8194bd24d29d65cf0a21d2aed96a8d55129674c16f401d7581

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2923.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A01.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A37.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit