0725e861b4f94a28c7516be549e96a7ce2e9d7de01b4d3fe92c01e9794b6096e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 15:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aefec9411cbd62d23186d54ed1384166_JaffaCakes118.html
Size

37KB
MD5

aefec9411cbd62d23186d54ed1384166
SHA1

3f455ba150aed866633938368f780445dc7210f7
SHA256

0725e861b4f94a28c7516be549e96a7ce2e9d7de01b4d3fe92c01e9794b6096e
SHA512

7fc650b85a18872867f6e1f2dfbecc8f4480addb5200d84096a5a8bf1e94b5fab15f04ce5375546457f3924944b9fa01198650bd127fe7594598e0c6ff8b5002
SSDEEP

384:bQ/GIpgUOo5zhflJ2NrgEaZbyyX1QnavaKpo5Z9v:EZH5zxl4JhiWMcB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424625624"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D0C2B01-2B28-11EF-B9DB-4A2B752F9250} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2776	2020	iexplore.exe	28
PID 2020 wrote to memory of 2776	2020	iexplore.exe	28
PID 2020 wrote to memory of 2776	2020	iexplore.exe	28
PID 2020 wrote to memory of 2776	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aefec9411cbd62d23186d54ed1384166_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6df59b03dc6635ea864fbf06b850121

SHA1
3dfc186860239d02f6244d5162d65d06e908ab22

SHA256
2e7886e5c7f3b47a2fb1a07229b6c9a307fb1b976a373fe391cbbf32c2078365

SHA512
b80cd41c984b0478be08be11733152dc9c580438fd5d38521ea659f643d26bfcf673cac9de0e87ca6766de663b2ddaa49d517148ee0eb573074b20ca48bb6c62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc1dc5dd4897fdb60096b1bec52589b2

SHA1
4f392225234559fc1ecb141f9c54d8270dc8ae84

SHA256
0184c4639e758062487379d14a0d50812b3ec56a67cb54b03c33cd7043be9127

SHA512
cb4a81bdfaf21cb5ed2dcf1453a9f1a13f0451d9fc46af13196d6f5ec6e7b9466c14caaa3c4fbb1f1da22c312880b62a31b293209710f65fbaaad90ee04df90f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b2eceeab3aa21eb99ce8424bcd29f57

SHA1
3899bef858ad5592040bab59d294afd025ebc357

SHA256
7ca11ee40a486e0a799fbfda97c1cc7e48726d8f56d4096026cca955fba7e329

SHA512
6127f896c8aa4e4100a4b38a68839a73f391d3a3f62df204beca721a3f57cde996b8250dad5952d13de6d882550ae8c86de1e339acc7267a3310b47aa5e27338

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ae6997c13f8e11c7a48f0726739da04

SHA1
e0a11fb57017db4d0174eb09de25a585f270c41c

SHA256
b8c82c73743ac73cc261eaa0d9ad71cfb638e49eaad23fef17a0108092d5d7cd

SHA512
2fae2e51b0e1e308def021ecdc86cf3c9b0808bf88b967e6b8afd69802c3594df59eef056f3afac0d8e6c5a86925fca5beb69997ff909a057659552904251589

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edd11e38833d36fc672522cc8ee19138

SHA1
b964f7eb13e246bf17695f98fe700dc0c6411722

SHA256
ff44ff1281d2a0e61cb25058c4f5a6472c1f1683120aee10d420293c3218408b

SHA512
102c6d637dc34aff325459cde028069255fdee578f16ed7837917dc0364e5bb9f9ec931e6ab27a2f4a188ac15e3e92762afc3452dc3960b93e3b959bc2013773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a3fb45ffdf3fd645720871e513b7682

SHA1
0fa176145704ecc8a9341de2a83c3c67927f5f8a

SHA256
88c3a08d729e1791253d1872186cf7498cbbee2fc81c6fce14a2bb0c28e46de7

SHA512
3de01b0f46ca2335477f4afeb918117ddc6dcca2b4abb64b4e7cc3c394733811c1c4aa8779a0264c2fca59180dacbc0a9b66e7c453e8abb64169cee038e5fa1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9c24969421d69d1e1224429ede2506d

SHA1
ba6293b0f43fb2112d37f307a0e83faffe29e9f9

SHA256
30d4b4a17b2d911084d8c047730e203f6e9816b0380803eced2ffb5c30592aa2

SHA512
04b64a5caf8d5bc93e94c372f3127bb5f54ae07dcc2c942ec220deb72c178556c319ce0d939754d8624cbbcb816d1456599fe5a1db15834ad94211e35efd940e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5556a5ceb46d5c5c7b4c294945a3f7b3

SHA1
8b237564c89c2d8dfb169270fa1bc941acb40c0c

SHA256
45de583fdfa642e5cbda71c281e5e363d50711139f0c6d8933fc0ef20a019161

SHA512
c1176083b226a5809c2eb170d49dff7db724edc000970c7a43a7924c736c7b207f58fa5dc120444a7918b0cfe7713f8ac180900d95b29b473f3ac552d9a8ec90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62331f57935c92dd45ec9cba1f402843

SHA1
2cca358b3eb34c87decc9a4cc351a9831b9b1e94

SHA256
ddef074c41c7d0a407f35504bfd21902fe7eb873601e7759a721b367aab36df2

SHA512
1d29d583cda1fec44b3d888c7c7d2e55f69f83f0bdd0fbccad548ca4e71ef8a4c9bfa5d26a1f57b58ac8c4c0f8de6a344e34c9e6cd5ee3727cd8737516a5156e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD1D.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDC0.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit