ca0479309d49681cbd37867bc892411b6b592e3568bf8d9352357309bb258644

Analysis

max time kernel
132s
max time network
145s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b06f51dd731f4b632d8392299d4c23fa_JaffaCakes118.html
Size

147KB
MD5

b06f51dd731f4b632d8392299d4c23fa
SHA1

9bca850b67f7e2e1e2d0c0e1d5bbbfa45e3817a5
SHA256

ca0479309d49681cbd37867bc892411b6b592e3568bf8d9352357309bb258644
SHA512

0597631b8ac59e2470c92ece8af6c1779ba8ff5710b4995ce3a077d8d6a25c3e191d10d5e6f15087fd36b62b3ce8eb5f97e4e49e33c25dafe8a56fc6a9853e4e
SSDEEP

1536:ST8OUD5dsyE4oUa/x76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09wd:SYZQx7dyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424652518"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA7269C1-2B66-11EF-9E46-6ACBDECABE1A} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
840	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
840	iexplore.exe
840	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 3016	840	iexplore.exe	28
PID 840 wrote to memory of 3016	840	iexplore.exe	28
PID 840 wrote to memory of 3016	840	iexplore.exe	28
PID 840 wrote to memory of 3016	840	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b06f51dd731f4b632d8392299d4c23fa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
519a351cf8eb3c5621566aee9e2b3a8a

SHA1
0133b11bb280fd1000269fd28ff273ed147c99ff

SHA256
65c147c691e7319a7fb3e7b064883763f5bc14d1af815761c056d58919c9565a

SHA512
51a1ac26d2e7e88a3f71c1592afbd8216bf6b93909feacea2b7ac605fb0b749b8e14b1ca010a5fe62ba01605aac280f51edccb423083c4500f64d4201a728184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
033ddb5fe20c9152966bcade30aa3ee6

SHA1
37266e9f1ff63659ff987683503c27d16272185f

SHA256
0b60245cc9e4358e75ae3e79c7576c6a5110023e2f2446e30166dd263b1f13af

SHA512
0261b8120c39e827956828f678476e2403261888f27ee852cfc9316c814ee689d32a578c2c7038770adb0abd94b872a406f94a8e6cf6b703098bf685d52c8c47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c36c7e3039f36add5f9d7bb3f4bce332

SHA1
21b5bc5741075ef7cb06c2b6a35969b6ab49ceba

SHA256
7d2f800c8d40bfffbbcd4dde869f6d257e2d373200d8068685501506177dcc3d

SHA512
64c804d732804afae0e9de09d5806c9da97bc1b9b7519069cecf336d2defc83baacb2a33b3cdb73a774bd453a1c0160a728a4446cb723805d89ec5b3334525fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afdee02d08d677934c1a61788a43a6a7

SHA1
d1ac17310ae1d7db88aa7e73094e52b0af509200

SHA256
29cfd7ac2b58bdd69427d1e959c8daffc34cad900aacfffe1c2cdb9e83c74406

SHA512
a1d56f1a805941afed606efee8489f4935a1f0d7810697d168397909cc6e8e83b46caf63beb18f3f155153ca3480d376790c56161f11fc193adb184fad9bd020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
364c8c85d8c23df83133db94a787de51

SHA1
3e5aec59049b3e2b640a1c17be9da4800ce3233f

SHA256
ea94e00f92e51dd7ca5de6d785198d66c83ab6f7e39941487df8a6de03d54564

SHA512
e24db2e1d42085b428151fe32f09769a86805b3577cda0c91a1f611799ca1d4af6d29126866af877960a6e9b5cee419d5db9332907a2b908a95e29e8aa5f6af3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4f59192e7ee38e3fb567dd8443e17e5

SHA1
fe3f42ce751d344104a4613054ea481a0efefefd

SHA256
9e45b49f511cd07930c6e06e00feebef9134646979b191adf71f01e0c19069bf

SHA512
9148690fb72aa798331f613aca911e2b6cda4d5b3e1d73dae70dea16e29dbe007e0c7ae29523eace350cee6c9a2f7cd041221706db446bde76a3f5faeeb76641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70aaf19f846f4dc5b18359513e6fa014

SHA1
fa0d340580931fdb51fba29c60336e2dd48cc118

SHA256
d716e42c2c357997d12acb3f8247aa6283982472ed472993559347a54ee49c7b

SHA512
306c582d184b84c6efc28b364d9a1306968d409e4e6cf43663b0971e61db0c731b1c352278edaa633cce0b6ed00e4d0a7d1e41724c74601e54e8f304f577c698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69c6db68e46127f32778caba3fd88af3

SHA1
d7a4ec0e7282f78bed7ef5801877816b10f577d8

SHA256
6590aa8eedac9694f431eecb91f7af45d1c02391263448ba30e773dab276c443

SHA512
2baa2653783ff6c467a04aeb6ab3e0ceb72a892bb2097eec7883a2792a5b1b158c96b091612968aed0e2b3af2a652f5a5aae9198ac5a9ef561ffc307938627f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
876fcdd1587e5cb61954417ef2501961

SHA1
0468596b5541172277691a317c0d779f21048c27

SHA256
fcad9f199ab95ce0f7311879205898784dec3af09e394592c0aa8a868112bbb5

SHA512
9107ef5fb7303e6dbd1f2c4292fcb426de6823aa3765f0e73730cc2570a00a7e4d8e23b6bacb5fd4d0b4c74f2cc0a5da84086c9aa8a44a9a404bc3b0d730aa4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5E87.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F64.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit