84e88657e13264025b555024c086368859a8e0c3b6ea9fb7e682dea497edb9f9

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af784962fc4e0b9284f7ad5b243a934f_JaffaCakes118.html
Size

27KB
MD5

af784962fc4e0b9284f7ad5b243a934f
SHA1

bb147f8886f65966c780a1689a7ac669100cca22
SHA256

84e88657e13264025b555024c086368859a8e0c3b6ea9fb7e682dea497edb9f9
SHA512

460bf581ac4051cfa7b1ac3fded9e1b2c2ef948cfc056d8f2852431991534133655d28ef5966124229311fa8e95f10c3ab512876bf748f6597ec0f4b0e4ae851
SSDEEP

192:uw3cb5nA6nQjxn5Q/7nQieKNnLnQOkEnttFnQTbnaynQ9eEym60BisQl7MBqqnYS:hQ/19aainSgbQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A2F9391-2B39-11EF-9302-CE03E2754020} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424632867"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1996	2180	iexplore.exe	28
PID 2180 wrote to memory of 1996	2180	iexplore.exe	28
PID 2180 wrote to memory of 1996	2180	iexplore.exe	28
PID 2180 wrote to memory of 1996	2180	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\af784962fc4e0b9284f7ad5b243a934f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cccf0a98dcb06fcc035fa32987bd4b3

SHA1
b3ecb0d8336d706538641e3e8de3d57a4ae661fc

SHA256
89238e3bf4e09ac63283818ec6bc97689ef7dc0dbfa93fa0457f4ea28cd78754

SHA512
4f35102bbbbbf627b27ce051e9e4d237ae18e8e1c148903838ed243c447c8ced732252370ad1d264bee804da887b1c735a3d91eebd253653dd03776ed706cc10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59af1b04c7d346a0094a6999091b713a

SHA1
306322f0be7910a0e47f55b4b659a15e86d0747d

SHA256
95bccccc6336e83cae5b1c53103c6f311db7e36e4a57155ede08cde236d0390b

SHA512
673b7ced196924df02d2453e5536497c992e1b78d0a74cd84f357eef16dfbc49b0c4cb4f1e0dd9415812e8c828546ecc4a0f0798cd0c1cec8811af74f4575fd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
762e7474a0e48fe587cb0ca0ea10258e

SHA1
277f83db8b16508b4e0905b6987fca00ececc636

SHA256
ff57391e7ca4f946e1b2aee949eadf3f9772bea5b02ae7e88f6ea846e4e0fd1e

SHA512
f4b4a568402722c1ad7910fc840357bb0b051d3a456e9f3bb55f3d62cb3cd3c1a7a0eca50a57475b72257858f8b8f07c8e201fc2575bc6211c53ff3a6897ad09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12446fe16a388a54200af8da89fe0691

SHA1
f4f9d05e3f4486094b70d3e0f0b6c8e052c1270f

SHA256
72f907d2305c7654de5926576d50640e919a2ceb7674dc401bdb6688a9830acb

SHA512
fe8388a1786556cce5cf3b14bfb9d7b09594c040c158b2656befe3f17341952f642bc1125d7f88da24f7b2440ecd5c6f288a42645bf7c9a5d8e011524d08b23a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
531421da7a181856737f4ffbef05a41b

SHA1
3d454360d4fe20cc29abdbbef389ba6340f76450

SHA256
ce7b27b37cb3e67f6b42f7c7edc5549af4dd5c246b70ca3528ba5e800068dcf3

SHA512
517944069eae31fdd8d6e6cb2de706a99a4760fa962d2b78f7f9347d2b72b1225622b15588b6d905f21c1baff38243309642033447f8fc96785518a7f9bead29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fd85a6a4ad43969160235cfba7b5fbd

SHA1
a2711b30a81cc5e26c2ef97b0aca3e3732846c2d

SHA256
db95037c2b69286d294db0fc74eeff22e941f735a1bd1af2457224775ba527bd

SHA512
1c0a276984f3df82276dbad8013ff2bb1afcf6eeb1ae7c4347abf0900e5fd3f528b6f8be6de0128e860904309c62ad5ebeb4abd02dbcbf32c5b8ced11e7e1c12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bef97bd93945d03f44a3b17d33e855c4

SHA1
54bf6a1b44b1117c22d1c9633d97afcb0b05c175

SHA256
a4949f12897532df4531dc50a3b5e78072e09db02fe6d5f28237fde7954e041b

SHA512
68ebc66ed9b3f096af2cda792593380bc37015b7d0641bc76376dcb9337c6982771d70101a067dffeb9163a5ce808d46ebedbe7de50cd2d3eebba1514187ebe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ab5bc37324fcd593020859647dc38aa

SHA1
036d9601b37203a774d4bbd626f042ea5309d046

SHA256
86ee6537e04360a869f992d09ba156361986274f22fb928dee28c7a8b6c0f2ca

SHA512
431b1dde462cd770cff48b1986fd3475c642aaad8328523edb0e9fcf2005ec3f00a4adb1b821d54df4417e1e539e3a187250515abeea3e6190bd625e76906549

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56ce8e05b8b2f7952ce6e8e3bc132bfd

SHA1
c71b0f98a867f65aa1b8c566d5778d247ebada81

SHA256
64dd5d5dc33b00d25c120532d825091742cd2df7b5c3cbb48a4dbd56664ede82

SHA512
af91d58c6ae3f8ff827defb35a72791f7ec9a395d0f0922a501ee82ce6c469259258d67cdd92bc3683295f278996df83d8b460342c11d69ace532455010bb5d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18ED.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar199E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit