b5ec1638f4a73c169724b3d90d4400dd067f0d28ab19e608c27df82adad05abe

Analysis

max time kernel
131s
max time network
145s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abc37689350593af32188b7a20af6f34_JaffaCakes118.html
Size

34KB
MD5

abc37689350593af32188b7a20af6f34
SHA1

1cf01e1e4f136fbdb1109bbe39a67dc0f4f6aa19
SHA256

b5ec1638f4a73c169724b3d90d4400dd067f0d28ab19e608c27df82adad05abe
SHA512

b1c3fea49a2237442c4019e5b4bf38d9a88ae7f569900bbdf8fccf8535c5b8acb159040bb119af37dceb7d3a3a6ecde8454b5938de7f6bea3861dc2bd960fe01
SSDEEP

192:uwL0b5ncynQjxn5Q/jnQieSNntnQOkEntdJnQTbn1nQOgrcwqYGcwqYKcwqYQc6z:NQ/cPSc5c6ypOENjf7IT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424565963"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63B1A001-2A9D-11EF-B98D-FE0070C7CB2B} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1672	iexplore.exe
1672	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2996	1672	iexplore.exe	28
PID 1672 wrote to memory of 2996	1672	iexplore.exe	28
PID 1672 wrote to memory of 2996	1672	iexplore.exe	28
PID 1672 wrote to memory of 2996	1672	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\abc37689350593af32188b7a20af6f34_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bac83c0663827d3a7c001ff236fb25c3

SHA1
ff61dfaa1952c9f5b214161d90120861235c5776

SHA256
585bf7c49f8513232ad6f0e6058cdd6580d0b29f8f3bde758fc8b2782c8d2c4b

SHA512
c34f21d4f403831d2907399dcc5fe26133ff808ff9062a6a41b51043386155aeb6cf157e772668fdd3b931cfdbca9f0e7dde9809af272fb4ec896d6fe42a88dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56509f9deae62ad00db3d132e2aeaa62

SHA1
23e793cf81ef017c6f21aaa73f736c6d002ad044

SHA256
2bc336902c5688a3071def58204690468457acae9c91f7d66b65588a8550c824

SHA512
d131da4d8c051953f931a2338f7d4dd224a84052a74ede813f50813e8787ae2ace85354d08f48a42721edd2397f8c636e7ba126c9f212d02702c5309b3f812ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb4d1756e8ac7bf2eab4bf6a372ba5ee

SHA1
00fa498af29cbf4f15f4988738d87eb7caec1e54

SHA256
ad7a18b48f67dbceb28be573f4dd47ea693b5dc2ccb24eeede1ceaa0234afcbc

SHA512
32ba2d8bced4722b8b36e02eb819ff7b109411613446bf6f662f464700443d8a905c483d6c34650e7d2dbc1e1eddad893749f701010527002d85f0f26ceb8049

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
857dc6f02f47757abe576927541afc24

SHA1
b40fa97e41b8afc1d22ca8dd145d8298a8f55654

SHA256
7a322c19311888ead11e3473a13c5776a34cbadc76789b97cea0d4f8efbbd236

SHA512
903c090b611540eb91adc16f56bb3e135a80c641a65b30ab5e0cdfc96c445b2cd8e17457e4f166576df581045bd30dbdf7738f70cf90a263f76057794d963f0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4de321f2c6d3befa304199e2064366d7

SHA1
0530d0c1ca1fabfc5f7a2b84f1146cf00c1b88cc

SHA256
8ae9b4529cc712bed53ff7c9414825bb761fd2fe3cf04189c0bb2f839a561b53

SHA512
24eea860af636b3d151bc9f960e8d7191751a6ec94840b34218585ffa820d325c7e8c67652ffd49c74729c9e0358849c5118c0885c67559212e1ab1f6f3a49bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbabb5c7b2f4fa7a8ec33428c32ddbe7

SHA1
726055ef813a14f7bd3830c14b8dd9861a94ebc8

SHA256
368d2672fbee878cd3777c90ecbb01b50ac9357be16d8171ca36260d0e9dacb1

SHA512
4c624e81ce96a4838fabe2c75c6b83998f88ee679de9a8628af62845231e0b9de58278108290e2273bb126a39bfaacad65466164514a0b5c9be294a568feb30e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4500dca364994ca527d77aea4753cd98

SHA1
b8d7ba0578d6cbc119b1afa77642a0315f260c92

SHA256
0f2dd02242ba4af7c5993e824a684f572b8b70303bf1cee65c90ffc415115d20

SHA512
f94caddce5d96d1cf33b4ed2955183b1c47cf677ef5a7f8c6ffbdd9141c93d0b975c5ec1cde914ded7df7c1d923ed72e9600550c055b1079d95c3db96ce64e47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b64e8685a97f2bb6f859438b87a06ca2

SHA1
8f0d77047868c25ba9834606b45e6efbb625eef6

SHA256
55360637fd68d01a6223321a0517f7b503dfbc25f4ed4338ab3c293baee65ddd

SHA512
c42de8cfe429507abccd6c3cf8818d8be438b7e9300a1f18719491db6a93bab6011a9834e829973f2c6a75cd2de5e8aff05f88b66349b36de594bd3e9b284c03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea9f6dba541b85726393f06e9a2dde9f

SHA1
074d364b2212064fb820e7f5dd6532450ad728c3

SHA256
396a1999529b793bb2dc8935b7459b79850bdc98e875282c8373c55505d021e7

SHA512
e3251cfbd36b5dacf1f9c3662d3644a1e08f263857593df251d778223e1a9adcbfa6cf392f89b75a3ec6ad0a2a47018be99d35157ceb5d041ff23d2c6cb2a37d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab569A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5749.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit