b64d3099e5f324c7a50406e2f2636c73ae792fe0eba565254a0dc00c2b3c56ca

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a533320d5669d6d4b4fe0c20d88611aa_JaffaCakes118.html
Size

42KB
MD5

a533320d5669d6d4b4fe0c20d88611aa
SHA1

49abd4692161ebf472481645490750cc1e7096a3
SHA256

b64d3099e5f324c7a50406e2f2636c73ae792fe0eba565254a0dc00c2b3c56ca
SHA512

0ccc90643b38fe696bfe6cf9728b99fc9a838be0b0c832e5e79dc4ba19c33a52335208a6941288bf7dff4e3150f971e7aa6ff0079212a821356cc99310ac9664
SSDEEP

384:8Q/VZpxumgMkRpnL46Gx4vwtKWCnJ5j3fw7FhryTe6LB2vlaC/Z:2nL5Hkvx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A1E8D2F1-2974-11EF-8144-CE80800B5EC6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424438508"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1252	iexplore.exe
1252	iexplore.exe
1420	IEXPLORE.EXE
1420	IEXPLORE.EXE
1420	IEXPLORE.EXE
1420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1420	1252	iexplore.exe	28
PID 1252 wrote to memory of 1420	1252	iexplore.exe	28
PID 1252 wrote to memory of 1420	1252	iexplore.exe	28
PID 1252 wrote to memory of 1420	1252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a533320d5669d6d4b4fe0c20d88611aa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a3e49b7bbe991e27f948aaf7f3efbdb

SHA1
659c26866209b9d4f95b8255006df55b5724d1dd

SHA256
558eb23c29725d62dfa00a89ac98c0ffd1cfe3c89dedc6f0c487ea314324d799

SHA512
6b58cc5640a7456c284c7fea1468c82007e6ff0f810a97399f1e246fd7441488a1aaa5bd458e35167ca08bec08ede3b2967ea2a5f3cdf9cd7a99cb9d4a5e23fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9764ba7098377eafcdfa2ca58e407d85

SHA1
b38dffdb69b1b90c3e084c9012904e341144dcc6

SHA256
2257546881c7f0dcdd400397ab60415199bd5adbad35856271162312f794d53c

SHA512
c7f8c62787b3d4d294f38178682937e1423216959c021421ff6897bab29b8d32cbd1c7190646a9541a3800b498c08261b38d699f9732b7377d7d7efa1949c785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85a52c7ea6ca247f4f28b7045b2a4f69

SHA1
f53181a5ec22b0b4d08c4f41a42984452e5b3c4d

SHA256
c6caae2598e1efd2fa1e3a9d93af19878a3a28520fe138728ed571a0e417c369

SHA512
79d33ef3a3cb94d5e2a335319cca8d4a89774b8109f933b54e8e0dad94972782c80ebce568e960868a946c9833b58e2089a936f0469d6d4350b7d58ea11573fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60eb9951ddea6948cb2f1635110fbbb2

SHA1
7ce4d9fd83d45dba7ab68aff98338746afa34378

SHA256
4f3715537cf90697ea5149ca1cc21842ee9f1eaaff06d0d364e6a44aed85054a

SHA512
69c8a30c000850905cf324f4802576e184709e3a182b2369e7d830b168c1650248d3b6e1af3683a20387650620eab8861ac1af12a9de67762f1dde5363cd578b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb67d29eb67bc9acdc5391c9da68d4a4

SHA1
7a3f275f44d940af62c8fcdead8db9221c8ed5af

SHA256
095600e78feaf2c9f3d29288584679bcb1464a452f105bfe94c3f13fb7ab4a0b

SHA512
72961129aa7a44f0375bdbd1045526c1fffe3139b7981d371cfa2986e8e372ed49ef68ed8cd69868e4f964641bb72d313cadae6145e6acbccbf80a2d520fba89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b100b291082d87fc53f715494d3fd64

SHA1
50366abe7e939d42ac02bede50761553b522f2a9

SHA256
feb2a7b0a0e574cb066371f0eeb8a259fc9c071d7b13099fe7332a31276c073d

SHA512
fb73f8f4e968a5060bfb1cf588d172440cecbeec6b2dec92628abc30650220a9676fa5f9ffddfb415e2ca65a9ea942bbef193f7124a3ab9fbe6e32f846712f13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63dfbb70a5d4d1676994f23eaee00701

SHA1
ca541ab7f2a5bb534646cd6c0c27c333eb030449

SHA256
41eb22e88360835254dc3dd2af294c85196247272ea3f85f09057240bede3743

SHA512
13b9db3e8e93066d46a4fec05df488c11e092d6ce8b500194e2c4e14dbced5cafa1614063c3deaf7706591223ad1324abefb70bf0e1730acf3c14e043e633d04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1603c281476749861590db98edc429e2

SHA1
bb677bd992a1f1caa6cca242522dca5833dc59e4

SHA256
ad7bf310fe2f7deec1f867e4c41bdf808980c8fb48a4a201dd166e957f847b53

SHA512
0ac265a52d7c29f41da4e58301e254a19f1605a3445c4f36b050be07dcb260c926e7ac05a47a584f6ba2700ef82351fa89deb1f66a2588d1c49afd33f0d03598

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab54C6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5565.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit