a27631e3dbcca51c5eff2e7d3c88667ba351fb9979a5b12fc6b5ff5e872dedbd

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5c056ed916445614d5864ee2b1b25808_JaffaCakes118.html
Size

154KB
MD5

5c056ed916445614d5864ee2b1b25808
SHA1

16d5b8945bb53d90734d2aed31da10fe1fa5e71d
SHA256

a27631e3dbcca51c5eff2e7d3c88667ba351fb9979a5b12fc6b5ff5e872dedbd
SHA512

69cb6dca8f3a0d66e4567c33d311fb5d1b5986d68bed8892ba4239b70ab922880812bcaec1faaac557857b3e8e0e44678964b3132eb68fe2472f233ec807363b
SSDEEP

192:SkTaBavh3Z3dVho83HHMWsS4uXRDvT2FVppMaC6T6GvPqOdCcA+1GvpcAD9GvpcD:2Uxhdn8W9XZKlva0x9P2P7v

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CBF8D7F1-45CD-11EF-A3B5-DAEE53C76889} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427555435"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2748	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2748	iexplore.exe
2748	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2240	2748	iexplore.exe	30
PID 2748 wrote to memory of 2240	2748	iexplore.exe	30
PID 2748 wrote to memory of 2240	2748	iexplore.exe	30
PID 2748 wrote to memory of 2240	2748	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c056ed916445614d5864ee2b1b25808_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9aeea7cea42bcce724eaf9534319a18

SHA1
85509ea8c8a500857bfbcb1e79e7da9357e1f5ab

SHA256
ab6d78ef7b502cc886f826ec636057fdd84774c42caf4a6031e7193146fe1dd2

SHA512
485309400dbb801c6d4611bbeabd4009c983791387ad40328cee4bcc297eae8779ac9954ac30f6728030f8017a6c731e33d67e9eb314914e2902bbca34b643bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
265671a6acf9f175e15f5646b0363c65

SHA1
78b6a981af44f5034c224e6a0eb6e4e96792f924

SHA256
a7cabdce60fa5691d0ba6536ef9041702c86399b4b3dd3bb80fd78dd8f3ca9a2

SHA512
7abb991b1f87f4f8efcb190e6aa4d0461d0c5753213ce600e9d8b66be2577a05596ea39891abcb79cbea3d814e6a5d6f116dc8e3b29d9d0ec98341a27a4c7dc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfd452bbd2a32c0053ac4ec0af78d0ef

SHA1
1cc8b14d282ddae1f9f44c921ecac6e762f4c88d

SHA256
8dbaec475b27eae22e3ab303c89f949c7647e587833b0298ab12b1e428553c88

SHA512
7042cdd12292b9bcfe0c6edb6f3604cf6bcbf2e6849f4d22fb5e24b23974eace8c7ed19fe2ac81b236f2ca7495f558dc549b67ff23682f034ecc4733d567ca32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e605c74ccc5eb7f8118eedbed2130050

SHA1
78fd5ab810d7234595cc1a41e0b1f92d9e7491f2

SHA256
f6a1b10c4c987e0849e703e69a6358efc733d490c88c8147d7892d2fe404b8ad

SHA512
a90c3619c2493bd86558f34b465488dbff4e398c8645a4a67a39a8f7b93594c6a7eb3c7006c1d02c4572e45eee8a734946fa64dc4cf9049e40a539e90419b929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
663a3ecb49e50b9857a4177b391892e8

SHA1
5490440648a9afb7edf1ca22019087fcdfedfa53

SHA256
a9bcd21019b6f59595a493e6f95a7d5749b7b5c85fe2409505656c3f6a47fd97

SHA512
a20df8a5634ff95c7e6556cc357736dc4e88a926a830d50a1b5202f4aa93bf7ae70ed322b50bbcb3dfb837367338d7be932b70efcc3ab2eff2d94373f0eb2c36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5494379ed68eefddf5478f14e9e02cb3

SHA1
83573cc1f272b61df6c3b09f00b39a6d145ebcc7

SHA256
d25e0c65c237b2355be9e6c235d980825c1116f286c26cc597a83bd98dbd94dd

SHA512
549e02bac1d8e19c3eadd9cd7e15ac88d2fa3a1e920af8326f6a8e34d9db73064b82d1096ff04937b4db026abf1a75931410521a39d6cf16b95dbbf4dda0c78d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44d0de8505376d53286954d95378eb1c

SHA1
020bf6a8e5dce5219d12b94c6009bac52b5a35c1

SHA256
08bd4313021ef8d1e898faca5710cb97fdfe148cd42c13d170afff1f26c9a108

SHA512
cfd4a10b27da81c36083e7318677f045e1f8c76b1b756d0ea5638a7509a034b9feb12396464017e3fecf418207efec438d79a9ba0d209f805c397617d9fd4499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e665b209a21b94f9d75e0d830e20a695

SHA1
76d82e16cf15ffb65ff3e6e1f8f378fec9fe7c9b

SHA256
cfcd37baf5de40f4589ca9679f249e1ba4c9f33e5265fe7d9f2dfb157284648e

SHA512
0f8c071c81b8b2c3fa86a8c9c49e28dd8a965627f15e0460eb83fa1a644b2fa050afd732bc8045719f061b5a6b822949b81c1b2348cd7a09834a0ec904d4ccc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ed06c19fcfbdbfc285bcc55e593810b

SHA1
5844eddb64531efb2ec1d4079e6e2bec34df1b2c

SHA256
9c1dde4f6b98d70bb8e827271a22f906831d16e1914320f407912b67d1e11bef

SHA512
aa344ec9e32fcbe867e4c4472246eee0ec916a003648b70535af8b2f7001ce14173fb3f09df616917b1badbf786bb0cc395f4d4050842d7ad3ffc83d3b678193

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab280C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar284D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit