61ef79be10f69adc7577c255ed3a7e8eec87c18cc6dd085bf53ff7903ddf157c

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0723d9c329f5c0650bef273fb8a25688_JaffaCakes118.html
Size

28KB
MD5

0723d9c329f5c0650bef273fb8a25688
SHA1

6434be77c5be1ef0da1b5efb7976a6f23e784e5a
SHA256

61ef79be10f69adc7577c255ed3a7e8eec87c18cc6dd085bf53ff7903ddf157c
SHA512

ae60483fec3d22cabe7793b6472b7f291bc433c0ac11642091c3d6def7dd058322b37a25174669e7a8bad5ef29c4f8fd0c5cf1b37acbf77008a34df7d25ae12b
SSDEEP

192:uqgD7qb5nDQVwnQjxn5Q/fnQieGNnLnQOkEnt9BnQTbnZnQ0CLtJVevo7NtlFo+7:n4Q/8IgcGsO1gp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9A435D1-31F9-11EF-B848-DEDD52EED8E0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425375333"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2568	2080	iexplore.exe	28
PID 2080 wrote to memory of 2568	2080	iexplore.exe	28
PID 2080 wrote to memory of 2568	2080	iexplore.exe	28
PID 2080 wrote to memory of 2568	2080	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0723d9c329f5c0650bef273fb8a25688_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
394fc236f36b6a3a134a87f9c91990f3

SHA1
302e1b77585c472808667eb44c163a40cd08dc84

SHA256
7f80dea96cd01fdeb77fa58a5f1f830cbfea92f794cdd303deb530e69c18f39e

SHA512
319d3c3d5356e25ee04ad306d4ccf293f70dc3f1ba8a0c9f1d2e07c5eb3260caae9dbc368f26b2f05f2f0a89dc97fd12453714035a62e68ec41d984508522d2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
889730f414e043cf6836df2f9f02e12b

SHA1
df3860f8eecac324998c4fef5120f392c25057cd

SHA256
44552f7958de3d2e2068d078ed0fe22557c6013aafaff8d20d15a157a62495d6

SHA512
8f828b8b3fedc57ce8b74902a4d86d154a50cd4341f49d17c8aa574a911b48c6176b77e1b9af0d39f0c56feaf83c0c02ef4adde77d486b14b4b14f20a4253c16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
519c4eeda8f4bad4cde5db82a9a0bbb4

SHA1
cf5557cbb3f7293aa5a9f9b42703001d0b0df1ed

SHA256
2265571ed2a6d3284733b3d71f672c0a9992d4b00389a989554c7e010c6eb9f0

SHA512
ff2da6b4c03ec9019b44a9a1037e5fd67512cd1bd0095d705723f46da8574d5eca8dbde87149c574d411427c0e04dc1f67497ae71c2576e3e39f87ee2d76a658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
898ee996e0037853d804217da520ab87

SHA1
584a285de2d789272cfa39167aa588b1a4a1af87

SHA256
ea433421d66f7ebcf6e3d018714fbe79d30458f3ffc17de81cb1b8d243d35c28

SHA512
543f2dd44c2fb3ec5f167a90e344ac9f59dc8a8536bce67bc763f99ac4c3bd009589928bcd9c04190c59e21603f1343001e3e6561637ffd73db9a01f47fc79d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc53e5d03533ef3bffa04ebb5c5a9952

SHA1
f5aa92e940c358652ebede8e3892891356d61892

SHA256
938e1ca144c65559f3e69008921e628df667a06a9136e43951692dc2e86918cb

SHA512
4bc21357f0bb9bbfc95af02de9346e200d3357b3910811da4103bb731d7b8fee578c65f2a5a9ca4c787db81e87d423737ddf8d3437877ac7372a64650da43ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b287005563e069946bf4062aa5518ab3

SHA1
652c553c3cde07260997962c683aecbdfffb1cc0

SHA256
d4a3d7eadfb781a707ee5e9c5e05d4fed7fbfb50a56764ddb83599505410d1cc

SHA512
f1e7248dcd1d46b001cfc36c436c6b0fac859e8f31628b45bedc791bf7b9705d3efaf6b95b51b895119a44184342eee2dc1c9147ed3ebb0f71b6705449840454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d360c97bfd797b32e089df8dfdfc742

SHA1
af8caa62da2084c8e53ad39a936cc086d1cd90b7

SHA256
ad1c22888b9b92f1845d7c33612e01d118d21430a179afbbe0d73bb7d449510c

SHA512
b6466c1c41eaa7fafcf5093ff7210fdb5bc33caccd8def17a5aae59845da011db94297a1750627e2ec26dd56c1ad6af722dfc389a33c10e0d1bc8ee211d12c83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36cdd6a61d80b27082dbb7b8b5facee4

SHA1
c7d3378b08dcdc46c3b73f630059771b1c727301

SHA256
d0b6fcc4555a347a61dafc79c95229ead08126e1bd7e37e67134d2541e6143cf

SHA512
d5309fd9ca2079e1658f6034c2517da26c8e5f1156df0e1319670ef4d1d37a7626678c3db1d938a98cf3b4e704e2c9e3dd4544b387dc4b115b3a8331122daf65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5C83.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5D25.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit