d5229e31aa309d30b71bbf238a5171796789d68126b97b817a666b2b4c7dd67c

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

178514f42ad8091f8c34fe4efc7e0b38_JaffaCakes118.html
Size

34KB
MD5

178514f42ad8091f8c34fe4efc7e0b38
SHA1

cbbf4cba42b2d9a165675f0fb06ccf6c7049787d
SHA256

d5229e31aa309d30b71bbf238a5171796789d68126b97b817a666b2b4c7dd67c
SHA512

be3d94d7659a6f5d4e20cff1ea73efbe14578cd11a909590262421a09fab7efc87f64c75d0be47ed00404107f39127fdf552a0f150710b022ffc1a30444b54ff
SSDEEP

384:sgwmPoySy1loyjYfO+EQf1v9y2AJjNA3WCQc1H1S1H1Y1S141IJgoQlxZcN9viBe:pwmv1Lj9+Fea/GNirqIQFdhIeWG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB5C5221-34C8-11EF-9028-46C1B5BE3FA8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425684089"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2092	1936	iexplore.exe	28
PID 1936 wrote to memory of 2092	1936	iexplore.exe	28
PID 1936 wrote to memory of 2092	1936	iexplore.exe	28
PID 1936 wrote to memory of 2092	1936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\178514f42ad8091f8c34fe4efc7e0b38_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bfc341f5eb24cbe8222a6a60fa03a3f

SHA1
f6d40b80e0fccc8fc53edccc4c5ea9ebd72777b3

SHA256
f367777dd3c58215c803e97b218562da60792e33f89355e128b6e9c53511fb93

SHA512
0d7e2970602c8e9cfde07fbc327db3de454d0849eb34e9647b1ba98470da270f22605f0e2ded610a30944194a3507d87d74e1945aa11e17c5d75ef5eb0b88c4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0dc81c3619444de7208d6a5bebddda7b

SHA1
b7a8da62494a8b159fd67af2ca9d43ed1c233858

SHA256
ec0d05b8be88d69a4662ebf329aa5423649053f2ed5bf37affa3103b1b9929be

SHA512
4497a69f42e1faa29cfd4984f9c064bdcb213d1f0e786de591a11efe9a2917d15a901a510c204345c39803a366a94571fdce3388e5028788d948898c2c18b5d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b1477b25758e403913811cf4cfa54cd

SHA1
8c2632d451de3cd3bd2fdcf41838ad40d6d238f4

SHA256
78e326ac1d8b229f25e589abc58f42a2f7130eebfccde2fd806dd44770d76e65

SHA512
7682e3015ae091f2775428d05375ee18227194d679ef74ce302b0fe41b0507af53e939d0a24a4fbea5b6379766f494117840869bfe1556d0267055dd639e3b0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5ce7687a17ed75c75bbe18c8a0eee9d

SHA1
db206766ae4d0d6da4c3246b804aae64e9c1df27

SHA256
c17eba9f40cc920376d7120b268c7ddd98cc63dc67641ad6bb3708c5d2369b5a

SHA512
f6da8067a0e7698c7dc6963c3b3dadc14d7507f856e6ec261c287c6f839b53e065a010fa874645dded229fe958fcd2020c200ff7de6b52211a3979e331439f77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
747e48e5b78b24e18bf28c3fd518251c

SHA1
d1ca59813e6fd02c146314cd1e2a708a473fba41

SHA256
113dd3012e6928fabdaee75b0acd2ecaa98f9fadb95d35e5309b62a26eda09bb

SHA512
3a600379f51ca4b6a1460a994cfdcd5e433e60583a32578ca42967c5f607377606cfdfe611c6d12832a687cd4b9122c36541b6ff0ba6d9267bb13b7e370ead57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f0c16aeb5e810eb7258c9b470dfb6e2

SHA1
3d7bbf006d35a14e0c0101c3ed0b2ed628c4f6ae

SHA256
cae88959d2e3651692c68c66a3048997a8f4fef38e9e9b427680e31a66e76cd0

SHA512
0e53fab48b7bfe40e57f0356c075230a93ab8d28b8ffffabae34625c9f29c0c8dfb686ae3f6e71dce7412156cf80688b9801f7d8ac619806e64b12d907e4b536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07235e75757ee32e5b86d603103a6447

SHA1
f297c211ed1ca1c887d3002a919642288634374e

SHA256
f5880a2871fbdf1b3d736dea82d7a1c27f208b074d904f7fa3f5b7f7c275e479

SHA512
af816dafd5a9bc8f79e5e880320224fa5ecce31346a0c7be1d53f7313a8171951609fce5c8d9ce0a4378a4655adcf3d4434f9cd3d3b90690c3d27b443f03f1d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7eb34043361592e02ad3e0bbcac76768

SHA1
5a269fbfef924b94443646cd9f2957627793c533

SHA256
15b1d8223dcbd62e7d01e0e27d292c8a0feab5107b79792c7a142f1b4f51ae4c

SHA512
ed4cc392db166aa01f8afc0dab6b861e37fe8c3dc7c05ff1723393808ce1d85078032c21f81483ef1dd201bf8d96987f4f1303190c62b7fc633ce6f8d2056e35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bd64a3f599927b6385f753368c89e89

SHA1
1574dea17f84e820c12a7c1b7e6c31b10d145d58

SHA256
a69bc7e78859425d1d0c81901bbd5561a1bf3a580ced0d126ab53b90b09f21c2

SHA512
3aefa4e120043d6a7c768c77f24b8518186ac65cc569eaf7b19c31d0cc5034905c4e04aed3b0398d9dcacee7f6d016c0be259f169160316edc5079aeb1cbfdc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13D1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar147F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit