476c40ac70c7c31d74d5c68c10cba1e70fa8383485e7c91d241ce16a25caf2a4

Analysis

max time kernel
133s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d7a2b82ec7a8d0caa465c55eba19f73_JaffaCakes118.html
Size

28KB
MD5

4d7a2b82ec7a8d0caa465c55eba19f73
SHA1

763aad14771c1aa80a5aa15afec30c997aa3ed68
SHA256

476c40ac70c7c31d74d5c68c10cba1e70fa8383485e7c91d241ce16a25caf2a4
SHA512

6e50cbacf538e0f93f4b8a56b29169a99a80a29908794116f681b6f94ba79968979ff78e737d2bbfb53d2c3007993e41dc8e028eb438a9965eff72d3a3bc370d
SSDEEP

192:uwvsb5nMPuqnQjxn5Q/unQielNnV6InQOkEntCwnQTbnBnQ9eBNm63/9G6xQl7MB:QQ/7to3P9G3ST

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE0A7961-434A-11EF-BEBA-E29800E22076} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427279298"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2244	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2244	iexplore.exe
2244	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2168	2244	iexplore.exe	30
PID 2244 wrote to memory of 2168	2244	iexplore.exe	30
PID 2244 wrote to memory of 2168	2244	iexplore.exe	30
PID 2244 wrote to memory of 2168	2244	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4d7a2b82ec7a8d0caa465c55eba19f73_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb2e94b97cc1aa8a47814c4a26b89147

SHA1
589721930398093701b53f52c4d055237b606294

SHA256
68d640cd6895988aec46bfc67591357744132f827824d5efb36c076c2af6de99

SHA512
b7d4fcffc7a2b3c9cab77d58d118d217e2a57c2745cff24869b83fb262ebaf35489d1f36c0c50e8bd7fa2de4575d57f8e3b116fe45acbd327bba42117c3e486c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0be766980dc02aac259d18a6d423d441

SHA1
5961d08be05f038aa5b588fd4548e00aa0b63884

SHA256
ed182f46885804a908241ceefc7a4bab4116fdc9ff28536ed44ade963d451592

SHA512
0a7854e625e42e7edb0a852354150c1bbe360eb97ca8a153730de93383d2d7bf4a7f3ea092ee416736d8d937129c387a566fd808b76505ba4cdee55142660e10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc1a278fbb67ce7376432bba70488bc8

SHA1
b4e32e4821b1983f4fe7903ff095ff1ebd9b0679

SHA256
3b09171f6b8c87dc0db64d61baca1a74ff39106f04c26296a58a0c12e50c5951

SHA512
fee7c3c49660ef610e5f46006c6ee70d4f04406cb55cee4a2af9676b41eaa13d509bb10feb235e96b63fefc41aca60404991af00014396332a4eba4618100ad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94c8f93b676d007b4d44256c20370e95

SHA1
2e500c44cbdf5ddcc72f03e90edec13a3eb8468c

SHA256
ad39bc67f8c5ee045d1bb44206957633c340e60cf6da284b55abcdcd864b4c86

SHA512
cfc9978210f547b42d58fafbb1e99955172b3a2538374e094607c0b7c68bdd51e5393427e02ce7be76fa104bbcd53c742ba22790783fabcd0ebd613aacd065dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
724d679288f49bec306c869982edac15

SHA1
0ac0357a67c01b603418fe79d9b9a3f2fb80947c

SHA256
7d9434238208e6635e429649abdad1068687acd9a555b389c4f5a691bab0b20f

SHA512
d0682020a4810c52116e5a1a6799460ea025012f70d61ba930c6036f2ea2fcfc83c984a7dda0193976c556b6192b830867f162dffe993b9e4353833800ad2710

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
700fdd525358fe205741bf40111d26a7

SHA1
6a15b6d389592dc50862f1e31a15aed4586172c9

SHA256
55a1c78efe2bda2351ae0de205e25616438cfda32de79a8b188acd73a6861103

SHA512
1ee824959119bbbb1c0416b6f4bcae46039b72ab922143a61e81b8b95910e4786ca05d9650035a64a0623f0655085ef4d6106e99e0c01396d4edf7bf87a3ffc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
634d154d1b41b57db47d30cd18c2d16d

SHA1
3968c58971ce8a4304ce1427a01761708d76c38d

SHA256
0a72bee482f435e5a4a036dbba2efd1a88aded5c172fb7f0cbf8990c4a88a7cd

SHA512
77449b0d2a9c01a54c7910a0017c3d7f3f4ca255b5f9548f16c63ee06226038f5eecc5ad1e047e9253a2e9fbacaa13b205bba8517cfe91f81fd5c41d3627f1d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34cde61164840767525bf87e5155b0d0

SHA1
b1ab20fa29ce3aac2fb83d30d7723f6354ff85a6

SHA256
49f740e1eab189f1b62284b35f39aedd315164d16134582b1bcd2c1d9e46bcb9

SHA512
dc356df6102c00f5b36c793bd182969f4544abb34d79c26eddc73c878a08b8f02620caf9d344303ea4f33f5d6d4f089aed296b52dc619f02ac007a22ef98bf60

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAE5A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAEBB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit