206816e3b251bd1c7cd73cde8d7b97a483bfefca1e8f5e049d8663491d94e7a4

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af402b4de7e34b6e6914e307bd78cfd7_JaffaCakes118.html
Size

25KB
MD5

af402b4de7e34b6e6914e307bd78cfd7
SHA1

8186e3b17e025b6e033a6e7ffe39b2e6c09da3bb
SHA256

206816e3b251bd1c7cd73cde8d7b97a483bfefca1e8f5e049d8663491d94e7a4
SHA512

9816d1f4612bd60352d24b1d0839242cd8b9f78e41aedfe65a089e8fd6120662470755c6857c5918b31fa914aa8ef85c410e4d57367639e97e3dfc08b6d39d2e
SSDEEP

384:SI7r6GKYL5n8tNl6EzOqRdglePDcudKZu8LqFUTm0sejJ79kqGGFA+Dz0HlO:SDo18tNl6EzOidglePNUZI2mv+Dz0lO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424629551"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{719F2E01-2B31-11EF-A8D3-D2DB9F9EC2A6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2144	2012	iexplore.exe	28
PID 2012 wrote to memory of 2144	2012	iexplore.exe	28
PID 2012 wrote to memory of 2144	2012	iexplore.exe	28
PID 2012 wrote to memory of 2144	2012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\af402b4de7e34b6e6914e307bd78cfd7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce085fb0f966fefb24dd8fe8ed6ee48c

SHA1
87f25ae6f3691b8ff4d2727341aa6c1b793f1597

SHA256
0f5429be716ddd40493975f093e8d5334bd7398bbcd96f694a53b43bbf7d99c5

SHA512
e08c0e648eed2ee82ccb777123c646fae198fb0e135eac5eaa4bf358bf900217570c522de8d71033ad7f0f947d7188f682ac006d03cee52a8f63d5f6cedea9cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0ef7925d66762a6ebf6b34aaf959804

SHA1
302bffbe0be43e1a870079bbe80069b456751f12

SHA256
44e6e8db4898e7c66bd692afd2cc920edb524d1dcf78a462fd333541d1a73240

SHA512
caeacef7e3fcf67e7feee70c232ac1778fea3913f855b95c27a966ce5c8e184c46ffbcc3b6187dd531e75bd751464cc73ff8b565e19cf7d5aec508a4300905d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
774cf7c97f2be1d2b00f3089ba37d989

SHA1
c6ca3a18cae23d88f5d9dee662bdf5db84f9bde9

SHA256
41ba805d77c011aade5adc293627676f91b91b446ba0bafd3a02701119f923d4

SHA512
9247e3e156e4a9a4388a916a81fe5fa54c5e0d55a6654eeecb4daa05dd5128722a96ac5dcb7c8c2fac386ce74a55e900650c876a0dd8c64c6547f3f8ffaaa241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3f7ac707ec66c1fc6b05da70f3455fd

SHA1
2457df17107dbd0b34ee18a2d4a6cef93869fd66

SHA256
927420080e44fc3cf7215280a743eda2c9f05eed7d2974aaa46e46905238a49f

SHA512
40a9a17d94c013d42e65bf685c722b58c097a86ed7d78e8be12fd1854e28e83273b09d5676af948378886e9f75a739f0ae640c4c1b0d0c0b36efc9a9c457978f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e84c7156a03596eb35b317724928a1c

SHA1
4fb32ecfe7f15c10befc4b4b61b8dd5b4aa29a99

SHA256
512c96e11b1c754a4c703cb6856e5534f142f78d7b1504b62b845ba9659e0163

SHA512
d5c9e4eeb5a56bd77b75bdbfb5509c20df08ca077d6b91d54023e66022bf3a57fb1b9e9e1cb6f086d24e50bd2df67dd74090f4627909419610d64cf5a40cbfff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57ef0775cf9acd01b34732f582617a85

SHA1
cecf6f8e86845a36f01fdf8038b367cbb12a231b

SHA256
349657dc4b7ce8a53a7bf9317255c726d1d8685735aa17ddfaba43f3f3734f86

SHA512
85b5ffc4ada51aacdb5599c3e1d932febb0cd691192d929d0b7ff90a849de9ec11084b351700eeac86e54288f58307ab3ea367004da82e5d57041c1126a05996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b91e11a55105cd5cefcad6c169c59f3

SHA1
b22e806b949f093948ca4834e20cbfe999eac655

SHA256
05dc86bc910181d2a9c13c929209534bd4798971752dd22760fa391b84f33c8d

SHA512
f6169e411f2512cc61307a1434cdb85a9a119a1d15cd637169633b79c223d1854a6fced92c2cce98a3adc52eaf19e873e6eac4d73ef64645ae4be7ff5b2475bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6566433821298914ea4569e4de1a1f7c

SHA1
97725984835c3b4bd0829c7426810e85fe20320e

SHA256
2d75c809928d47e506d139ac9bdc48691732cd4426469229e7b4202a10968998

SHA512
b24d525c668c9a38eb015f617c25880b1e0e62c6e9c1c5e2baa3ac4725447d9c1ee52979335919ff3f02937177352964cc512884ef852883b6cca34cb7bbc54c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7464a030fbd247b4a5b5c98be80b6b5d

SHA1
408f8e82f944d79340feae6ebd1ade3cc9e94c51

SHA256
7947c4b0bc09a80e2e2bbc17a7980159abd679cde8002d667c2bff27f13edc8d

SHA512
1418f8271fa19163d3e9bfced52d0027dc24d6ade343ab46638c0e61919a74fff65d33fecd27db57dc1ea498700fb6ec73a99d1d225edc21b1c785ce40bfa5c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99282ebccb2831ae1e5d26678ae4d773

SHA1
c5c62288375fd1664ba5fe33bed53b3ef6d03e06

SHA256
e0faf1467628e65cd176853734a894335d62bfb2cb494ea499cb107b21cdd14d

SHA512
dde72257e5738c5968773e5d52b169508e06a431ad6410608144612c83e33844015e79ba3daf612c4dc7cec35f6d89eaf6f6bf07fcbf3337a4c0428b1c170bb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4F0C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F0D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit