6887577c10d7fdc60916a5a496d8f6d386769774b92795242cccfba4cfc9b9ba

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a449acb1f47c9eb892946d006e1be8b_JaffaCakes118.html
Size

950KB
MD5

0a449acb1f47c9eb892946d006e1be8b
SHA1

3291dd03c47f116650d3a85076240cf469365be2
SHA256

6887577c10d7fdc60916a5a496d8f6d386769774b92795242cccfba4cfc9b9ba
SHA512

4cb7b244f0c02a7d08d77d383b31f833f850a564ae62f05c1706cb68ae0f0c433f8845a4c5cc80cc45a31403e043a8bb68baac9f66d238f63adc20cf39048f6a
SSDEEP

24576:E5Hq+PH66McBaaAKwEchGzizzi55+zlAaAkmJkWgbX:Oq+XaKTchBK/+zlNpmOWmX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7AAE22E1-325B-11EF-BF93-66356D7B1278} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425417263"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2040	iexplore.exe
2040	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2520	2040	iexplore.exe	28
PID 2040 wrote to memory of 2520	2040	iexplore.exe	28
PID 2040 wrote to memory of 2520	2040	iexplore.exe	28
PID 2040 wrote to memory of 2520	2040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a449acb1f47c9eb892946d006e1be8b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c2c1abbb57e814c295b15e8d8d33e48

SHA1
566342c196b675fb5cc6fea896f44254cc4eaf6e

SHA256
1edafb6a7006b404f1352137315fd734ffb5eb50f9fccc8641a2d17306d06320

SHA512
99694a10ae1bb3a7b7771ba083c2edac3f5316598cb669c4d64d878459c6a862337c6a6273be5ae0e0b7103a12f1845a0378b8b7791818937f80ec1a5b1e7483

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd7b85f09a215a23d4dada44437cbda8

SHA1
716fc67d4794ef45efcb5f3e1c0540cde3cbb51c

SHA256
9b164d0a6aa3ae721e2e6132e66624dfd0414db89fc6c778d8c68bd5b5c3a73e

SHA512
f43014e3a38ff40fb1a4f1ba83d8d2a76f29e886cd2f0f5631a9a1bdad6ee0a492b0a6ec47136df0ce89a0005daf092e1453c3c35a93650b2891cc2e973a11d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7459b1209b81316ccd526d32c206064a

SHA1
ffe7e599f984533588e07bfa1cc6b15aac6e2305

SHA256
3331c9bd5801b775174121a7dc9b28a0002d6adc3e49c3198b6d19fad7ac7de6

SHA512
666641ea6863c5f7acf20811fa3d96aed72a1ecbff454e54b5272ad300e6b3c2b29366fd0400de2064960f341d3d4619364da0a50e57d03b682d18348c3051bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15cc140770758d9c8f2219c74871ab2b

SHA1
3d839071a708902f53db8c142d72f6d0ad096000

SHA256
96e8bd9cf8786dcd8d86fdb904455e92019dd169553722564ef1c90ed6bcfbab

SHA512
f3d6509edd30208677b56561e37b83bedb1a5951d71498ab64b6be33fd210398cff5adb67489730475f8f626ef84712502e04ff547da0cb0f29e7a0ad2910495

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77c3d13768dfed4209425e1e9b67a106

SHA1
3fbf48bbd145cdaa64394b1bd86f4507388862e1

SHA256
6e672f1b39633cf8c8daaadc860a0d9dc5fa519e1e9fdc31f5502d8372e5223c

SHA512
11fdfc42dedff5ddf60649d84049d04f918b5d4fefb1112e8c8c7ddb98ea9bf8c3d94c263ee4b2704a00e0b07873e4c15addbd041c72c0b380fc14c88ca44b0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c84dc89d60672f3aac52f468cee8787

SHA1
2c957849f92a975e44bf19d480dc1cd431210eb0

SHA256
e1f9fff1f1334748c85db4ead7e5c35724fbf3c7d685251f6890f9a7d7198afa

SHA512
69a97c7724e8eff8c31c9d6457e80bc3a19f00a98c52b430493e844dc6a236c8ef72f1c0fd9070b8a4358acb1a185d2709d49d67f3bbf7c8d4613fac289a487a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a8e4c1965ab27c6800195fb3d97b40a

SHA1
56765f6c2ae9b8ad0c472d7c49a574019c121a2b

SHA256
5f4f4be232dd8b5f1edcacc22ef74a44bcf26bf1b1ed1bb405e7285bd1821620

SHA512
deabf4349e9f1c0244b6bc4598f0dbea45bf5a148ac809e1bebf336beb425044a62034383d028abb211399359aba253fb0c2ef2fe92b000bb1d6e32da50de338

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d78e0f88e8137c37b326db3e49df8694

SHA1
31146f3d789a8344cc6d2ca5d0fa83929ab85c95

SHA256
d4bdadf945a31255c443db4a99aae53cbe1b224f698f5dee6207cdd867976d4e

SHA512
f1df7f5f77d9a0760cc6b394f411cdfae4f83e8ebf4c3f8db528eca56d38996f436c847079dd46c36e67c0fa8a50ffc0eb93500a76fd84685a028c2aa0a1655f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
939f4752e1e93b0e677f7aa2108d8147

SHA1
5007e25f0d1407d123bb7cf31e3b6b0ad7a7d857

SHA256
5b2d6b5f082c383534c22977876ddb4f7b395ed082779201c742cb2d056c0214

SHA512
11ef048a62ed56d8be7c0695eda12ea82e9db9f86004d8346d284b29de9364918f7bd54d31c9b7809ec4437e22a9334db6a018272fab3a49482da1247ec97e3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF4E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1020.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit