73a9ea683178fff1afd29059e02d591e363cf059cdb08545f87c944781e126fe

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b6110a7c5ecfab980d1c05b8488469b_JaffaCakes118.html
Size

12KB
MD5

5b6110a7c5ecfab980d1c05b8488469b
SHA1

f447c6f91d809a7dc9681f541714d3690e8da5cd
SHA256

73a9ea683178fff1afd29059e02d591e363cf059cdb08545f87c944781e126fe
SHA512

9f76a860596f83d9cc8f5ef0e330242fde0b934912ba5570bfcf18e7276954560428444aa2f8616489d18328abf520f6cad2da30e6cb12c86e5ea1b59ead0469
SSDEEP

384:VWa1iuS9SqGu+k0/ezW92YnodQsYhq+KwmJu+kvkVXipZ:11if3Gu+k02MIYhq+K/jZipZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA44B201-1620-11EF-BA28-C2931B856BB4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422313370"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2116	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2116	iexplore.exe
2116	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2612	2116	iexplore.exe	29
PID 2116 wrote to memory of 2612	2116	iexplore.exe	29
PID 2116 wrote to memory of 2612	2116	iexplore.exe	29
PID 2116 wrote to memory of 2612	2116	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5b6110a7c5ecfab980d1c05b8488469b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56d9b95cd4e1b9103d37ca214de79d64

SHA1
dd279ce9c5a3d0211ae925bfb28b427197769413

SHA256
c8c408a0f8df690b8a6e68782501d7c983afdd0ab0e0e87d76f4af02e5f58d8c

SHA512
514566c47aaa83de09357f051d9f1158aba1271adfac39add8fcedd65058daeb8dc442890af8b554fa63f12e0e588829dee0899f08258bb04ba6ccafa0ba2760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24fd48a80af1ad4c06473988e8c5ccc2

SHA1
ea88d76842cb937014f3387d8eb2a4aeffc8d8db

SHA256
2f8594fe0602462b6976a7164e11a4e62cd3a4c045d72c10a2502342a17cd5f4

SHA512
8c64aa228e94f0d58dc3627f72542aacecccfdd50032b9e94a78b9a891e88e5af949d090dd96d40d34d991e53c3b69715fb82d3bf28177c8535f82a3b658cb9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b2fb5c6422100a759a00b0dd8d62a07

SHA1
b67cf28789f0ba6810b82871102fb62f951e1b3a

SHA256
d9b0edbb845cb51cf67658dbb926fc876df0f32cc769992bbcf440fe6dc1f0a4

SHA512
849a394ae88e0532758ed6f21d6ef831367c82d2e4d8bb98a18e0512944b32a7e3a64e1e271e184451be6b8cce0c9f494a06af969190f502ea5ca6cc12921d00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9621191819596fe1fdf38d2416065a6e

SHA1
f192f5d4e782a51782b9713c4971dbfba968bf39

SHA256
d98d04391f7ab029f82258da30633ab12883e5fbb3c683e7f7ecab2c5efa1ca9

SHA512
d36820f477f2592e803a49adc27dd3dd82c1dde8096dc7d280a034950f40b79606857bfd9c78bbddd79c46dcd58fea13db3046b6b77e3e546289d3b5c468b199

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ecce6abd9c62fb721165b7229ff6ec1

SHA1
85104d1abfdba648eb49b22773a83a919b0b14bc

SHA256
44a126b1b37adfc10e5ce9730e49c7a5ad62584b20e6411a93e50a78f4e1fc8b

SHA512
6685a218dbdeced986115786ca19173af576dadd6451dd4bb010c7b1b8ca270f1d712174db0b0f3f67bf90762a6fe1f9a2da6c37c7c8df819598c45aa7d90fad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7999fa8415fcb1a04c99ae6b143a3e9

SHA1
562ec3f52172410c4d9acaef31e551e0706b2704

SHA256
e4f9ab89bc0655ea1c6c718a1018264694f0e38eb0833b87774124d6bec7c7de

SHA512
34555cbfbd017e4c00554c3a505b0420e40bf9eb83d054f67a9d7958dd017107a73d2cd464b0c3599f8b5afbfe90f1c086d35927a086d5f494748ba85614482e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a787ed7666b4b6990cb6bb9f266df79

SHA1
46c483bdab5ae9c33a328621da8e289827cade4f

SHA256
7596c6542b1764f36fe023c2df68b004cfcb1ad022efdc5074dd33d478a26134

SHA512
d6562f2f731a03f65ad5037ce9f2ead6bdf9ac9b342eed1f8b9ea1c04268d69d8b4b782e5c0e3ebdef03f39ef1d6a56d7a3133a198b9c5460f62c3b1860ed082

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00e21e6debf9121b83111760f26ba8f7

SHA1
f16c9a0936045f7e74453b148b421f6eb14d3594

SHA256
a81368c36b81bc8e4f3f9837e933dbef790672b9d18025bc8c64c89b82daf077

SHA512
5d65ae5d6c21b1e8526ef51a656e12d2dc3e8bf4204387fc246df007941b16f9ff48c8ea631257d6f9a87945d00450ff0267f906b98eb165a526c26a89053150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
803692ec88519b439effb73ec0e8d2af

SHA1
970f1a3e72431e5700d1e8753ae6141c9bb89fa7

SHA256
c1b6a417545b4eb387d14f82260e09dc03e651eed3e19ac52e0a9127bde381b2

SHA512
53f97a5fc4a53f3514e12f025f5a4fd104e93b2b2fb22044540d9085131c80e6602eadfa42170808bd0146a08109c9aa9d04ad7a5e3bf21fcd8934569f820cee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab166F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16E0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit