a70d980b55113598a3584c1036c853914d689214ddc9de5a68858894f6f97375

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b053c2935c7151287f7264b576894cd2_JaffaCakes118.html
Size

20KB
MD5

b053c2935c7151287f7264b576894cd2
SHA1

b4038631b6c8dabcb3ecebbfde5801784ffd53ba
SHA256

a70d980b55113598a3584c1036c853914d689214ddc9de5a68858894f6f97375
SHA512

2437ae84912d63900ef67ae2821610bbfca09338ab791f4c90f5ea983fc4d621229c59e5568b6dbe44d274b12a2df46ad20d8ac203fd052fa700ac9b7a1f6e3b
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI/4dzUnjBh/x82qDB8:SIMd0I5nO9H9sv/6xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424651014"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6AAF70F1-2B63-11EF-BF93-66356D7B1278} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1636	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1636	iexplore.exe
1636	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2500	1636	iexplore.exe	28
PID 1636 wrote to memory of 2500	1636	iexplore.exe	28
PID 1636 wrote to memory of 2500	1636	iexplore.exe	28
PID 1636 wrote to memory of 2500	1636	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b053c2935c7151287f7264b576894cd2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b8ea629f18823c23d6e382dd912e1b8

SHA1
a5354b96a208e9c62d5a72b56cec9e4e9ffc9e85

SHA256
a29ec201a4752951398af0c6355c957101795b43f29b2043c862b567b09f89f1

SHA512
398e655d57fc289297de4a0b2ffad2efa4dbc4b4af2210135e2942de2ac632c645c8cfb9fa67a7a50c8e19b5e0a967b5515b113213eeaa85e705dbd61324e5be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ff984f2e1c9984d4a8901c5cfcb3bb1

SHA1
5b9463b81412a875d238e08019ab89c9b7e5509e

SHA256
3f8edfe4033da86652389a79d855058fdc174a01aa25bc95fa4bdcaa0d26978b

SHA512
37ab0130978b4acb1320854819b84ac0f502946630932f693ed1d12a1caef7ba33011a6e8cb99d102b4bd15d5db8d939ec10385ca5adf67c9920ab9c8f09b37a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fcc18dad592bf246086f1c9562fd109

SHA1
627735eaa8a84b989fa673ca76fdb165cd58fcf6

SHA256
9dc6cccbc89ded9caed6ad2111375f647ff9519a9c80c746a4dd5b481b04b376

SHA512
db5656b9c1c8bb711828604899c0f8815eb44a6ce777d103def507cac7e43c79179eba260e068f580c425187aa912063c9b7c065243ada6513a48000bf95f64c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c45f0eaa67dd478e53008e29a12df616

SHA1
c1f4f892fc8d544aa51a7132b6ecb018ebc4c7f2

SHA256
be0738d4b0a2b6665606b1bde6843a3e8924eb3b73dff896bb5f867d1b3f4470

SHA512
5f65f90441f425fded478055c9ca66e1057501d0836d2596da4b8881654c40fe76b95da58da5a46650f24ca156ee51c80e400f11e4326e0dc1845f84a95c618c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58ccb70eb88ee649eeadad324aa3a8c9

SHA1
fdf22c3c9830e9f3ebc492e4fc9fc6ad1918097d

SHA256
f877f286c046ca4598c7d132d8baa711c79481cbb004c653a02f98e4459cdb34

SHA512
9ab7fa893bf81e8615f89ce0327a7d608180d7c763db0e4d5ec0625c11ac6711d40ab134c56034470f499740798b3e02186885c7b72d321df298e178bb411a55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f77485d558292206c14517b6e26069e

SHA1
dffd698b015ffbce77d94f214797900e681a36b9

SHA256
2c5adf76f4ef10056fc63c755c85bcfdfb1971b7ce2e610f4980a6b38674f609

SHA512
e4af22e03222d0cca44f99718ea816b93382010fe8b20b585ac415c7aed204749ce998feeb62d210c3ecf0eb79c0ccec871f383d9ddece7f2815d93919c26ae8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cefeec12a7b9c33a3e02e1700576e1c

SHA1
75bcecede705736c0c89994b42680f181fa5f523

SHA256
4a87d2c5e496befd357c0d564a1cb29269ddf9d32f6a8fb89cd0ad94c111b5c7

SHA512
b5f4538715dbde328d18df08f0f2bebff75ff9f58bcfb211417b5be7fb1698aa6977544a75ed4f4efe35afb9afea58ad79f835d86d1e413bd9aa8c259ee0c2c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca5950d9941d3a70ab1817e1f73be24b

SHA1
665cfe082d3b9752ac325d633332ed8ccdecf37b

SHA256
87dc1f56836a27d5a22a0065d317d7149e501ebc69ae0bc113aa99d78ef74d19

SHA512
7e172e9f657282f3ac5de507485137902841653fa9cb69cf78072fe45b7d27194b3fc640c7932a283e8005690801f7544a9473373c5abe6cc0bc2b24a7b10acd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b1cff6113fa1721c7ab6775a3450000

SHA1
ca26a828c656d0c671ab0d65959be2306048a5b3

SHA256
ac2b47d3f92ba167e198a4ef451d9cbcaadce96b3540c33654609c3754703b63

SHA512
17fe614ce8f17a922d4540070feb914f5675f36382f9df12ff12291e9363f1d35bd8639d9bb698dae558b77bf5e1f93c6af5c5e44e23c11c176ada3c63800a65

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF20.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1001.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit