b2d2610830d2d1319f2d6ef72f4e4380ee9bd03c2daca62cbc2da9db4c8d5494

Analysis

max time kernel
145s
max time network
152s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6124b4e4b9441e5d0501af3ca1ce277d_JaffaCakes118.html
Size

35KB
MD5

6124b4e4b9441e5d0501af3ca1ce277d
SHA1

c9d5f65d0ab46cccc2f2063d390a6e617ff82e8f
SHA256

b2d2610830d2d1319f2d6ef72f4e4380ee9bd03c2daca62cbc2da9db4c8d5494
SHA512

bb48479a0d69ba19f44040f4f7b80865e2c18b1651898faefeeb98e138592a56cb2c4d3f23dee1f4802aeebf2f998970636a122261e5d50036385698c0eeabe8
SSDEEP

768:SdsfaYT//ysnzNm9F18Hc9snzNm9F18HVAv12CSTUcpeY39zJZris0pvicWID4fD:Sd2aYT//ysnzNm9F18Hc9snzNm9F18Hl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422406274"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F9F312A1-16F8-11EF-B195-DEECE6B0C1A4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 3032	1712	iexplore.exe	28
PID 1712 wrote to memory of 3032	1712	iexplore.exe	28
PID 1712 wrote to memory of 3032	1712	iexplore.exe	28
PID 1712 wrote to memory of 3032	1712	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6124b4e4b9441e5d0501af3ca1ce277d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88352bd732d4d40136c04813a6e4594d

SHA1
a45092c34e23fbef909e9041ac4c41598aca2ba5

SHA256
15d47c213b7653ecf636b5fd0a0dacb991c38ede0d7d409d8f1f781f673eb80a

SHA512
74a4636bbd86921aa7d24b3a82cd17af991ca81696d6780f8ff26e0ab0caac5a22a9dd76c00cd813b91103323a36a8afbeb160ea0dc9e2b16f85ce096f72e597

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4de21ca2e4b0777467f2bedb61b7e07

SHA1
be05f587893fe2976ec4db9f2e2d0babdb5325ac

SHA256
914ae7fe51a266f8b8702caa64027fd87a586c988bd92e1598d5a9f875155467

SHA512
c721670525bb375f11adb00338854e1c8437b46b2818dd4c3e899a2cc7880cb68a252370fc0bb58d24a01e067a58e12dac112f4e3ac965c71a392cac0cb2c770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b177636f23bfeae8443e9f791d938047

SHA1
96937f183d6816331b4107ebcbbbab2126a79006

SHA256
c239c826765b70e3edc733bc0527c6565b14c973dbf111e2ce87658d712717e8

SHA512
6f246d12515d48222bf46915f2857e6046c665d213742744589d9fe876788ddc1fb4e647d666c9f1b8b3115a9969cb35abe4ec49a65355449f6f9f6b87ece45f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e802ecf51460650bf1bf9ec5d20db6ba

SHA1
419ccdf90dce63e51e5e090df43a318d0f754848

SHA256
a7853d5dc59a060258055bbb8d5e807c32c9a05fba9c5098c0855d90e21abff1

SHA512
61169164905c93f62b699df1bed7f9d76b50a86b879349b047db98bb5b2bbe56d9c5462fa0b0f26ea04d5785900aac7268d665a961e7792c91d5e8af8930d80a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c7e1c52fe277727570f328785ecbd49

SHA1
f387d5c5aad4b1874f34ac2001d2804ae6bddb4f

SHA256
fc4b6126d020cce6aad50e8f84f68bc1b5390bba3e3be82d2b1662cabedabd55

SHA512
130e214f5c3aa4ed6f94763332c92d3e61f0da72638406bd47a89eab5b08a47028036398e0640a811fba8f82ef1e1f7787af29139168ef13ab513ebb697f06b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4e0689942b3b475e373c7c9040f3960

SHA1
5298b52b6a8b8b98a4b0880593061fd82cdc3c46

SHA256
a6ef7600f6b11d087600c9f421aa204874c8779b8edab649c93a7026368066a6

SHA512
ee7c888fa9939cb2c177f9e546912975d6cde972b05748783af0294c45f6fb80ea28d03187b8414750dcdeb6e961d8688d78b11d7a5604980d1c402dab78d04a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf5aa8cc3ea3d26addc93299a04d53e4

SHA1
ec40aa33c3e5566bb36ad11cbe523a824266e438

SHA256
754d993ab527a2b38ad5df3e69dc94f5efe62950e60d26118f5197892f14e6d3

SHA512
8665fa75f921d9fd4be59736b04e65a27fd324a2ceb638c94e9c6bd0b37fcb85804f5d60da90f5ac67cfdd6d3a0b7f29d7dec302d30f621b134283269d5a950f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38e00031f39059fabefbcd473399b644

SHA1
a4192fcbb8c28590a2194ab3dfa22b24ae48d1f6

SHA256
00f2337159cc91ee5d8038257df27c902b4e13cbbc40009cb625bb760c12fc28

SHA512
e750c821dde6d5eb384846e4d4b9d0f14e146c2cfd045e26c138d4a0bedcf263d9ad99ec742652038b88d8296768799023417d5b2a080acbd325332644e81b88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c7eadfbf7582823e4bd311442f9ffbe

SHA1
d2ea8d0b5386b8b456ca5a25e3eed5a852438ea9

SHA256
ecbf4a9698c50bfa0b1890c2c3d55bb08fd3a1dacd8ddcfee1b3dca2d03514ef

SHA512
2bfc388260c8a65f384eed7ec2042985baf1687df2b02ab5425b884814e532a348ff2157a524f652ab5b46ee7793560dbe33bcae4322fd5d428848b1c9b9d01a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d9533a1cfdd7b2260ec79eaa197992d

SHA1
979393e5c478a63e7474771743dbdf030a6391bd

SHA256
7065701c0bab6a06da98f60a4fc1a95bf1ea25dae398e8c866b302e12613ec08

SHA512
0fccf05db27b568928dddb9aeb021b70dec407efe8ddc8993b170c7ddfe366f423b6ff14faa62f16c0134859ef9ab0ea850c76ad034d023800c598ffa200b162

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\WeiboShow[3].htm

Filesize
20B

MD5
7029066c27ac6f5ef18d660d5741979a

SHA1
46c6643f07aa7f6bfe7118de926b86defc5087c4

SHA256
59869db34853933b239f1e2219cf7d431da006aa919635478511fabbfc8849d2

SHA512
7e8e93f4a89ce7fae011403e14a1d53544c6e6f6b6010d61129dc27937806d2b03802610d7999eab33a4c36b0f9e001d9d76001b8354087634c1aa9c740c536f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8SD872Q\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\WeiboShow[3].htm

Filesize
241B

MD5
f5ba896d004fc2ad25e2efb56b129b57

SHA1
f4f586a75c24d595aebac0d105fbf989b7f723fe

SHA256
5551cf9ff3d42d87dcd453c15951f650effe152236573faf7e3fa6813343bb7e

SHA512
7431e23775359b0a0d7cad2990b3890d14ff203a8113e404b0439ca9f5019021ed395b5f2c9e4b5ba59a398659578205bcb5c92ebd3f8629b70ab8d97f5713fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2992.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2993.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit