0251eacdbc09c3e4c8b8d6eca7ea22b705cb4b7e715b5c1f8a89428f5588b39b

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b06311a66c2d07b320d8dd7128609b52_JaffaCakes118.html
Size

34KB
MD5

b06311a66c2d07b320d8dd7128609b52
SHA1

5e6c9eda085e6eedb13aa3665b45abd82feff19b
SHA256

0251eacdbc09c3e4c8b8d6eca7ea22b705cb4b7e715b5c1f8a89428f5588b39b
SHA512

41c6178542fec4fbdd03c324dabba194052d37415952905af8d43cb91d5d192775fe47372bfdeb737618194668c538403713931396a838f6d35c1cb6231ef30d
SSDEEP

768:17EpFwSXe6eDewe7eIeygjI1hCJC3CNChCICrC/CvCPJExBq0Z24HLx8lFAFn:1wpFwSuDqtClpjIHEWmyP84yiJ4q0Z24

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{272BE4B1-2B65-11EF-9A64-5214A1CF35EA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424651762"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2408	iexplore.exe
2408	iexplore.exe
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1708	2408	iexplore.exe	28
PID 2408 wrote to memory of 1708	2408	iexplore.exe	28
PID 2408 wrote to memory of 1708	2408	iexplore.exe	28
PID 2408 wrote to memory of 1708	2408	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b06311a66c2d07b320d8dd7128609b52_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c0cc3124d7b394f83fe67213854e023

SHA1
523c7e1c84d9ef867eb038023ccab77f6396c4bc

SHA256
92e6dddc38be05b4e6ead66993ff03b57603fe94b8a2d30a5a9783f4fd30c7e1

SHA512
80f6dbc9e221f154af1d753ef0db205fe006055344708f0d4107e9b8c7a95c0888a448efa59f168998e8371e51beca39d43d5b808268657e575dc6f6df3c36db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41f25fdd5fa1b9e3d88c40218b57a888

SHA1
2bbc65d76e1c3caa102133c036658094956d4b72

SHA256
711e18159ea2d118123488bf12ab6c0e9d814a9deddae7f7844b2ecaa762b3d5

SHA512
2eaf23a5344a43048ca33bc96621fdddb98260537d602184a7b51d1771598210da941a1277a6169445aef1f81c7a476f59961d35e37b17f5164bcb79c0d1c34b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc77cb92bf381c61049fabd25327c318

SHA1
48d0515d12eecc639949f9f84b87f95b750a3c80

SHA256
1ebda3cc2ee7e5043d37ea047b031daec096247de152183cae3679051317fe66

SHA512
68e91b39bb8c5f82073353d2b907b67241e16ff4d83df1afe5754da1870b262d254d5763c14ea802dbf307d995b15eca5041eeaa29a28c797d49afa5afc8fc29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc823ac6851a11e144ec8f9fc1568bd0

SHA1
f96f120ad16610e3e196ebd5434b12e98659e0d4

SHA256
aafe850b199a956f8630d76a11fe66401aa273fe6a92843df5d5dbb0e256f744

SHA512
2d84d672ea4ce24f0c0800a738032d7abf11a9c46d18df76587155b79279a1d3b1c5234352719bfcb1405f0b666feac862bd4f07478b4bbb769e4ba63cb30c0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81a1a10c2a835db4981998aaa09132b9

SHA1
04fa3c84931178bb919f35286e247555f4def613

SHA256
65b5fabee58580ef3a5626b6306990298557a041ee9760e65cb703835bc1179c

SHA512
7fdfd8a8af91ca5b6bc032ea5ecd5562c91e3330767fec06303a7dc8b4a341c74b0d3e12a6030a4a3b46cc31987de4320c7d67ac29153c402772451190b10c80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f31cacd6acfc5a64b0c1673b7d306cd

SHA1
67d6604930f9232a9c5eee68edfa3e0e11d3dd20

SHA256
557ad0f6fcc5e03374ae3a19b8ad7de0b8df4617ec1dcd4c8410c1e4155deb91

SHA512
98cf19efa88772d3a6268b79a67cd12dc44d4696eb48f0a7a516c531945ab3021b858ecc321e4e20a3cd71ffc0292ffb986b7855c0b082a1fc30119af1e052e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ead4f98ebf2001f38b01fbef4749b3cf

SHA1
ec803fdb5ca5c46ade57dc8c4534b7e893436830

SHA256
a05bade35980d78d07d49504eb10df91703f47273058a55a445b5e3aed5540d4

SHA512
0794d320ddd6171c52cd60726e257d8bc9f88542a463eee874898ba2676b564390783336c9727f4a2c7e4240396dd408cf7195c3ee204fcb75e8c07bd6555f07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
649a44e80f5c1abdff5885a10c4e278e

SHA1
2b5c4c4ac90674caf62a4b57278d983b9442ef08

SHA256
cab1f64e38ef1be0c8da6030f3dc957139cc8105005a1503388793de3d7b0e83

SHA512
fcd9a7bafd016659537b18b0e337ae477dfb92ffac8ad59e5b86af8d17ec590ec152e6f29b9bd088b1fca8ff6d924629ee7723cd0e9a0e10c57a713abc8edc5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47413e24a287aabd15542558e6a8ad9b

SHA1
c7b20713e463761e51173e104c5ac98925e9ce69

SHA256
1198b0cb57178fc19f115e3fcaf381cbbf4ffdbd637d0152b9a652558c2c1d36

SHA512
b4c9f8d3ac1bb32e6765aa3311af01bf8ddacb315368f6e4b9e27577eafb50c683cbd494f46bee84a6165cc1aa5fe527ee7f8b76d2fc6677d911ba27a21860a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8431f7728ff665a506df350f87e5fc15

SHA1
bec9a647ed7ba283032d7905a6da9f2ba3fb879e

SHA256
ce1d9bed606a26a13989b6b92108bd70bc21e008b5e16dc98bf0d9d5b60c2ff7

SHA512
9262f7d07e057d59a772558252af7b127269efe52a234388952aeee5e9f0f6543b8a757b9d911a1b95f2fd98a0c75726700885e0f7907d6e778b51109dd1cf2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5478.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5477.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit