414fab146d2109b027ddc01e3acc093c9abea8cbd868cef690e9672fd259d3b1

Analysis

max time kernel
131s
max time network
146s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

608a8eb2b80421351ba6e45d068f89bc_JaffaCakes118.html
Size

22KB
MD5

608a8eb2b80421351ba6e45d068f89bc
SHA1

bd29e4ef799ac6d90d1e2a899dbe542d3a93ab3a
SHA256

414fab146d2109b027ddc01e3acc093c9abea8cbd868cef690e9672fd259d3b1
SHA512

9af2c312b88e717b1feaf4ba1787ea86ad8bcf54ca772cae650e51b497b3ae2142c9d3f55c77741ef9146e46db016b2940b47e5e706da706b8c6bb3ed1cf470e
SSDEEP

192:uwzdVS2FZJWqab5nOa29x51pv3Zc8REJCnQjxn5Q/cunQieoRNnSrlnQOkEntiY9:oQ/54xYB0b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73974181-475A-11EF-B5D6-E21FB89EE600} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427725796"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2704	iexplore.exe
2704	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2556	2704	iexplore.exe	30
PID 2704 wrote to memory of 2556	2704	iexplore.exe	30
PID 2704 wrote to memory of 2556	2704	iexplore.exe	30
PID 2704 wrote to memory of 2556	2704	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\608a8eb2b80421351ba6e45d068f89bc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2abcb79cc874924071661c9ce4a0d791

SHA1
5e6ab90ead998733308eb291c5adf768f6da043b

SHA256
b5107115d38c4085803dec0323001359c55fe1c5688f2e31edb1a35062f7b9ce

SHA512
c410d15a6dc83aac6d56f7d00dc9c4f8d5cce65adc8c50288c905fab5c4ce971c3efb0ff32796ce2cc59ee218721d9666351bf22f413615caf8e3c425f313429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f728df6a598bbdde18e385d85abbdff

SHA1
89d401d89fdda128af28e3c916e1d9ff5bd690b3

SHA256
0e6713b97e69b522b98e34b8bdddba454bca4582dcc1d19e9c269650f506b609

SHA512
af0b09bcc6b16d500c30a966238732721989a827da6a587d1fe79f5582442e4682557bb93786682876e8394ed4d197409ec26e6fc719194ba9e88e8c9cbd8897

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b764485e6d8c46d9c096dd373ea9c05

SHA1
2f35a1a019f09560f28833cb499612472f3f2f4d

SHA256
41557deb009bb54b0e16045c8761899a95d6a9cdbac020de6e6dbd68d79c186a

SHA512
830b615865654f9d160e9007f35505305f5c53f98212d5090b3f52506a9f5f685494a734bc1c1f2a92412772b65dc0b56df0a571c63c094a393b4dcc0b5b0a6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e94cd391acf3416b877157dbc1587fc3

SHA1
9b7ed39b800ec94d5670263d41ef99c36055fa6b

SHA256
9b67f6caaaddf5fd69f3f3655ef967bba15c3d23bc04234098913f8667c26cfb

SHA512
9ce1359353d6946a8159d187925acc823d45b753a443a978e80c49088e7d9e57b70c5b9950575979133ed107aa550b57b9f2e7596b0c0fe38a59767b5fd82cf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edc8f9584843f6d45c7f0fb8aa6ca82c

SHA1
5538eeb9fce54fffffa4c01f57ed4a193965dba6

SHA256
e28666d6e0dd4a07123603bf382087c332390309062b5d7663fdfb6c36a14b4c

SHA512
c78d5a8f03587dda86f5c10bb60fdbe5d1629d238037ac7cea8ea5a150a340646b12b1da763190860d835afe63df3e44ac7e7d03a1a47b637992de45b7849955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d658586884b7811c386d1978d8048501

SHA1
999b0f42a1cfe9a4e1839cb383e431c37dbb8c58

SHA256
31f9c6b37119e4711e8730b544044ee34f16a74b0d159af9daf947143fc6a68c

SHA512
bc6cfd77f817786ce03f4302567f361a7a7d357195213daa1b1651c527d8753b3e19abcdf4ab0ad6687618270c03b82feba427bb3a52370c9b0d93c1aebcf268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d773abf6ff14e8b994d369c96df7b91

SHA1
f0f046821db68e1de79640edfdff3d3dde9e2790

SHA256
f6a65b45cb63108a97c69a4129125d4faf5fb289ff4ed5d236605b4dd4c9982e

SHA512
09e23711d75ad2b4b0e2fe114c586d3bb11bef78e23875fe94fb31eda527b44c85843f70607547f7f57243bf2025f97574cfb49d0c1222d9006635704a588aaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be9395b7c84e6fbacef2ecdc3ae45e37

SHA1
d964f2d8f5a786c6c904ecc5defb2c6e8b41314a

SHA256
46027e608c18e71ea75f1be050c629c53e7aea0a4a391b526f08c217eebe3d92

SHA512
e136f658e95fcd03b178dcff303c993e32532e40b6d8ebb3cad1546135e8fff71f9d7ef41f3acadb81c36a7d34ea153d2f322c36e04e1e6fd4992513039f9fd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0c51faeccd181d12bbc28c4358946ba

SHA1
5e278de5f81e6a90675285b2f1a80e67bd2f9f4b

SHA256
97f26a24cecf3ab79c843d4e63b476bd69df56320213f0051cba27ce34e32b1d

SHA512
a9f5f195be26daf11c5cf5b14c3137e01a28f3c712c385fec309ed484f4c3ffbe8de01fee59e651c628f4d5a2dc228850b4e2f2ed6a96f5249850e4abc52fd7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBCCA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBD4C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit