6d6b18ec66822df8ae8fc7d3de711dda32ed13462ca11b26cc18bc409bb98fce

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8812fbaa8bf7c750907a07bc8ee5ef7a_JaffaCakes118.html
Size

18KB
MD5

8812fbaa8bf7c750907a07bc8ee5ef7a
SHA1

3fd7f8c31e049dededeebd1ac39238f75fb1ac11
SHA256

6d6b18ec66822df8ae8fc7d3de711dda32ed13462ca11b26cc18bc409bb98fce
SHA512

0d5ba19b21aa6794cf7b043b749143f535358ceb8618e167c11c4da0e49949c59f271b076633565af64016b73ca5c6abe48430966b35fa90f85a312f808650d8
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI24ozUnjBhEe82qDB8:SIMd0I5nvHLsvENxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDA4CBE1-1F82-11EF-A7E9-D684AC6A5058} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423345160"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
820	IEXPLORE.EXE
820	IEXPLORE.EXE
820	IEXPLORE.EXE
820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 820	2220	iexplore.exe	28
PID 2220 wrote to memory of 820	2220	iexplore.exe	28
PID 2220 wrote to memory of 820	2220	iexplore.exe	28
PID 2220 wrote to memory of 820	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8812fbaa8bf7c750907a07bc8ee5ef7a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96f851933fca9036eac17dd50a1b288a

SHA1
d7c073a4a206d676b4493df5696e33c7cbf1e0c7

SHA256
90383518da778cecdf28cd9746880dd52f3117765b312017bd33d1f1e7fb69a8

SHA512
bc89d7d8e21c2cde7877a3e31b002e5204a3c21f90cbed032c28285d61c1a58835c24f42b02ca2e6c53abe4414495d50cafe2cfab840b4cce33ac3030c35009b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4eef51f81cd2d0d73cf13b2d33d4bfbf

SHA1
3ca662898f692dc16a6397630734b13821c87e5b

SHA256
b4573c2324f5145bc14ab85df4b701ad7e5b5b314980ff55c18366601cadf541

SHA512
fcbc0efde16990cc18f4562f444316f3a21eafc3b1e58e59905fe35dccffedb8cf6e38e4f85a945fac4aeb32d5befaff5108cf6a8f3ab6fd6b36188014ebdad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57354f86b44a3b9a3fc5e7a378da57f9

SHA1
9cd2720d5806ff813f2b42d2933c06e935afac0c

SHA256
62279e100ef132ec31b9a21fab4c920a55e46f341c99d4a219c1a00b95e8fd51

SHA512
87925293d2ce24ea835e6e9b49010385fb56faf216ed162a8944c241e93e9274ba19bae86b44236775aa2ef16767cfd57dd8ee0f27697fff2190f9fc65f00f9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56e772a6aff150b57e77497802f4c891

SHA1
2fd34544372f5363f38ba21228d0f773c87f862e

SHA256
8cff90c30570dba7ca3539874e1a36daa9efb4bc4b050b92030af547ba0d4d98

SHA512
2bcae3dba53b561493c23174d05982ac55de1a9fa1fd66f769895f7277e64696ce3c6f3691d729344916437a90c3a475f291255eb3b4b6e7b3d9929c2dbc0c2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5874a31947cdd9c1aa0aca9595dd72a6

SHA1
4e5b406004db32c0ff713dfdffc61b842b0c156c

SHA256
8235603b6eb3b20bc163ac2097a21f26950bb43268b1d1bc7dc663fbb71ff2a1

SHA512
5b80fab21920748c1224e490ef1a73f80d2dd532da86eb6beeeff480992b26985dcb9e76dbbaf7ceb20fddb56149a00bdebb43e838aa104f46d9e5d2563f6ad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39ccb1e806426da380b768b106949cff

SHA1
256de2a64bd2404ad696dfe9817e1fb87a9a7e8d

SHA256
0ae4500c247b2d46222316136b2ec5e9b5e431406583e7c34b8bcada3f48b27f

SHA512
de1d2b81ef1559218d731ef542e7f2aea93364fcf7198bd795787124f194c5173ffb6804cb7634abc207afdd4fa1eed7ee6e8ee317ff3629f6251b07e95089bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
553f4be0d9884f73e4f8b90ffcdac102

SHA1
8ff34158ac1724dc33b9d4279430f6b66cbdbe9a

SHA256
6e0cdc711f75d7bd108bdc558b11d26a19eeba5140db2cfc0f6042c8caed9054

SHA512
fb459b2b2fcaec8b1e9c929909a634382d8480ca75a96f30d0e296c4d65eedce33bf7552f22cd81c54910c70835a0885f96e992f3153391178dcac44d738e9dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DD4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit