b11172a10d40d483f1a984f113a1f992d9518dabc174486b7ffd93d9523b1b74

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 06:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

712e03d8e90f9d4d1d095802f1f84e00_JaffaCakes118.html
Size

24KB
MD5

712e03d8e90f9d4d1d095802f1f84e00
SHA1

e27078046155d3372a83e444daadad3277eb2fd5
SHA256

b11172a10d40d483f1a984f113a1f992d9518dabc174486b7ffd93d9523b1b74
SHA512

1012c6b00aad0604e10a407f5936f7919ae77d7ca74a221388d813056a7c21799f218044f9e947b5dd8416966a056764a86e0f2ba86491b12b26047cf3659fdd
SSDEEP

192:uw0dfQtupncmxb5nP8dfh5+uEyi1wErnQjxn5Q/l1nQieJUNnRbmnQOkEntLJ6if:vQ/WG5o9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B04B63F1-1A63-11EF-99EB-F2F7F00EEB0D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422781960"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3068	iexplore.exe
3068	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2888	3068	iexplore.exe	28
PID 3068 wrote to memory of 2888	3068	iexplore.exe	28
PID 3068 wrote to memory of 2888	3068	iexplore.exe	28
PID 3068 wrote to memory of 2888	3068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\712e03d8e90f9d4d1d095802f1f84e00_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09c7404d30a6a38988a48744a2a9f7f4

SHA1
2c4e028fec1f2f44169a7478766431c26881dc95

SHA256
286bd3f8988a9663c8d9f6f66e712d85a0e93cddca8d738f34fb41bd9449ee07

SHA512
f7d341aa67c35027e632e0278c6e2c7014edc551d050c152148d99bf6e4425faadb2465bb1b4956843d54021f5dfb4e80e20d4b20b35bf1d048cf6767de6cbec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27212f0894bfa7e5778f37efa8fcdb92

SHA1
d2dea4b86ee949cf2c8bf1b279e129814792f6e4

SHA256
fe843088582f9e3337d17b223e78608b75140f662470169d696753a5514261c3

SHA512
04a3bfecec28551939fa7da00ed74ace117c1cbade5d3bdf7403783e375df085459cbbee075e608ef1787a957b768e321136f6038bcc2389e69d203e7268ab17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44100dfac0cc3e79106a053e5b857bd7

SHA1
e40947735dd1227e1bfd8ae8e2da53fccb8cdb20

SHA256
1b689fcb6809c35c1575e932ccc7e859ec3edd27a6bb618dfee8a3dab0b9a383

SHA512
43d32d44793435a779bde3359ebf134988884b7c0d8c1e04f27eea94c979c58d6a4e3b84a6c0ca9d13916a17bae8e8f6cd7026543312b9377267284447bb9065

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
befb9cb75578e7c6c0d9eecb576545a8

SHA1
3114b56a19c0bafa657da7ea52a33fc8446c17d0

SHA256
804f2527cb14dbb8fdd35e0a7a998656023bab7e0544c56a03c197e66d3c720a

SHA512
ae6de11b6a4d7b9da48ccc067a0517dcb18b7a35c80f26028323cc929cd66d2440f6cf3b445d7a991bd68fee441b5ff97db41184f2cb9c68d7d491f49a9f6c45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d4b94a6d1f6fcc36305180e8f94d25f

SHA1
e5309af71751b0b20bf4c2919bb4dc2402ff921b

SHA256
e8247a23cc8c070e3cc3111584386dfa4e9d98e0f3594cdc89a049f6992e7597

SHA512
cbf8570aafcf016b3ed0ae2a30050699ce17d317fe408d7212066b00632ffc0fa70e5a38611ab7116289ecd9001a019bd96cbe16967fc5c5de8b857a51073128

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
537b016b3d4a25091af54122cc29f205

SHA1
c795cd2c6491498f414ef478ef317bcc820e23fb

SHA256
2f3f758443bf4d0cb26f2ed5b00327061f0d8498d9922474d49d33ccdde8971e

SHA512
fc290d12e2b3ace7363cdb54d2896a3865027d1d20523274db5434b8b6a4cfcdc98fa71f970a66335d26f88360331f1b735d49a27a76ce02b6947095af3a1b50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8bf7273b7778ac795346be70d9646e9

SHA1
3834c8f4133dfe707fcbd987ee8e86e8102d697e

SHA256
b0c9ae22df7e9ce5d410892894858f44ffb5c0aefce43054fbd0f233d8dd9beb

SHA512
1dbffc258b35bf9bf0e2fb7e773ff17bc2f0b788812a15ea4af6b7b3adf016998814689fc30e4be3ede4995fb6449b608e990b91eaa76ce99d3773a4420fa632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c97fa619a6a187eeb2a2034eaa04528a

SHA1
0d6a40312250bff52164bb13a202b46b51f5269d

SHA256
9f45a242109c5eec31814b5481daab81e0e00fee5ed13920e7607d2b4b5cb001

SHA512
1eea5dc1c7e5ace6699421f77d1ab00826f57e280a1c2c85d9f7be310283209c6e40a23bea45ef036d2ab91a59e3dfb2dfaaaa16980103a80d5c36c620512bab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e2e3a82c1bb0d887b3373549c83457d

SHA1
3ab2db7db4b621ab128095cd88853aed4a2e13f8

SHA256
18664eb51f9b0b756b74661e2cab3a23a156ab84f58c686eee9d6cd3fac64a4c

SHA512
9148969b828ba7023dddf882ec1e3f183574772a86cc5ae99cf0cbc318126383eb14f40b317ad6f9a3d88643ffa638f3b10f8d1bbd0c27821b4cf34b0a1fcb03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab23B8.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2419.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit