563efd8afc19da71c5d145279235b74a6b26e0c7c434e3f28a082c3e80761ae6

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 21:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b04d244514b9531b85a8702873192549_JaffaCakes118.html
Size

23KB
MD5

b04d244514b9531b85a8702873192549
SHA1

75a49ba8b936348f1bf30427bfa64961c9bbc359
SHA256

563efd8afc19da71c5d145279235b74a6b26e0c7c434e3f28a082c3e80761ae6
SHA512

34930033954596d78b1fac1703b4b0192f7eea2f8db73d80aa2d89344f1e09f16b1bfbb8f89dae80e3e7b8bfea753a044e893d5d62cf8d08d8dafab2ffac7105
SSDEEP

192:uWz8b5nEOnQjxn5Q/nnQieuNnYnQOkEntFhnQTbnxnQMCnQt8wMBOqnYnQ7tniY+:dQ/6o8A

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424650585"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6AF68181-2B62-11EF-8554-DE288D05BF47} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1684	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1684	iexplore.exe
1684	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2804	1684	iexplore.exe	28
PID 1684 wrote to memory of 2804	1684	iexplore.exe	28
PID 1684 wrote to memory of 2804	1684	iexplore.exe	28
PID 1684 wrote to memory of 2804	1684	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b04d244514b9531b85a8702873192549_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d82658a6e3490bc62b34a36dc53b666

SHA1
c661ef538e963807164738c5d898803d5a3a9517

SHA256
7c76bd71ef8f77d2680fe6a9485d434095caed56e062b8258a38cfd5a70a598e

SHA512
0da3262e9a768b65033e6fa5efa50d39f881b03d76ac0e0bcd68764528494a6412b451bd1b0ac96017cb39369163d93017996c4dd4f299a5fef6ad5ff602283a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b6d01610ae1fb660fc4f9f4c3a37f1b

SHA1
68db150d1b1c1de48aa735d21bd56eb6de70557c

SHA256
80434358a6f13437607a7acd0365bef8e9fecf5bb5340fd9bb61b066e9d470ad

SHA512
f420efedaa132048adb14142185c724d20a65c64025b560c61856ad96a2532bc3272934d5e559b39eecaa5ec91fbdaf690b425c89c4112dde2a8e1ab91072852

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01c993e6f6176997cb38dcbb49758fc4

SHA1
7a7c3daf24e2e01d793610db45d19f77daf390d7

SHA256
e2ead0a301072c90f91e1eb4e70490289436e45e9a98a6c20bbf8e84fa13f66f

SHA512
d4cb982e1d4dfcc26068787ea61ac143e817efd32fd15c2f66c212cf9abeb281a83dfe9771b695113e5e6a4279dd57b80ebe31e3e6c409bd60a2287660d70ecf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60498f18b4d2a92470523c4a51566c62

SHA1
f2a703dd48f21052d4e29a722a768c73bee240d7

SHA256
52df837a6e3e0c6a35ed7e51cc0def18938324a9094952d14eec6dfd120dae96

SHA512
11db7fc1e47c4ec4d400f8bfbf4068c16f70e3610859dac2738acd6085e8e55008a1939f28892b3b9d26ff1054c6a00d316e4dc7b0becc55c9258b03ee6efecb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c16557e628c97f83f58b631c7894aed

SHA1
2c84aca3b0c3b03921b3054c4fa558bf681edfc7

SHA256
958be25dc58061e9945d34f7df08f4109c4d91ded1d9dfcdf860344c9f0727d0

SHA512
9768ee15eae52f8ee7c7f9019a8d6708966a8262c752099f23293f9fc9d0e38eb5d1172ce55076bd62c09290f4eb27aab1371237badd90f6b354696009305515

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
462e64f6a8611d3aa97408bc88503cae

SHA1
9e391e2bc839bfd07547d6de15c09b1f1f4cf437

SHA256
d5c7eb53c788f6f81de3f9ce3f127fe15e023af8204f8e442cffb25c904c4046

SHA512
39edfcded035ed5eb44e57e7a040895ab406918a5bb05843ab8180e206350389c549655de6d9d22678ecad9b8ab129dd280d0c51d200cc4862208d0a540b0bfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
708bc19907f86c85af856eecbd07034b

SHA1
eb30b094fa99ad5c515bdd2cecbc9d9f1ae5a908

SHA256
fb4e84d45905cdb312da5593b21064fd60dc28b2446aa4f4b485dff5b1f63e22

SHA512
541a301f4a14bbd03a5142a80bc33608ac801154ed2164d1895ad701e792f370277767c91dfb4ae574c55c473f680db3f42677576ad9dc6741fa15cead482cec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54bf1d1a9c45700ada8f27dfccb4472f

SHA1
c4b2e1a0872e030c855190d38d2382236463ab69

SHA256
2aa5e96fef306fca8cbe51416f62a7ab322d1a25e543a90726279da1bbaee4d3

SHA512
645a571b2b35653002f0770af2938c901aaf6b3687526b79e061bef76c8ab71b62b704af0aea87ac19d0cd6f81c08a21af43aa66e1bbefc458e14a5f45a30c1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c96af561a1b830256dd0d7a06d8ce17

SHA1
269e94e5960b259a8615be51d5a975dd28cca216

SHA256
85bb05ea65cb5d973862f44bb53350ad9bc13305e42b54652ec8aa04c133fd86

SHA512
35491c1eb02d37b25d5eb9e7eb4c045691e1f127af390480b1660afe50b1fa16b58c926e63e745547c6b5200ee038a41477b94a3e6714b13c27e286db4c9002d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab982.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA75.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit