db086d2084c4d6642b47855b66b9af10646dbd8c66df111dae8a3507cb978566

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0749935a3726cab4f9935ef69fde126_JaffaCakes118.html
Size

33KB
MD5

b0749935a3726cab4f9935ef69fde126
SHA1

0f7389d5bbc66b1d298b39ffd011281d9efc6d19
SHA256

db086d2084c4d6642b47855b66b9af10646dbd8c66df111dae8a3507cb978566
SHA512

7ee14b34f1e340f75af7cdc63d604a6202ad21c636486f77485f6707bd0ccda7af322800c4396135a5b2e6749fa5db5c5244aa9e8169fa5a98ae8ce763166e1e
SSDEEP

192:uWb9lEGFmJjAMqb5nYKwNZhF5fnBtep/RynQjxn5Q/O+nQieihNn23q3BnQOkEn0:9Q/k6/J4sQpY4tHp/dz6LNyOE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424652861"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B78CE201-2B67-11EF-81FC-FAD28091DCF5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2092	iexplore.exe
2092	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2180	2092	iexplore.exe	28
PID 2092 wrote to memory of 2180	2092	iexplore.exe	28
PID 2092 wrote to memory of 2180	2092	iexplore.exe	28
PID 2092 wrote to memory of 2180	2092	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b0749935a3726cab4f9935ef69fde126_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
642b3d3a11053d8da3cb344e0a60db32

SHA1
13a8714944620ee0c89d82d53dca04ded73c83c8

SHA256
6db1d4d8da38b33646d27143a6622fac7adac9e7ac183d4662badfdddc0242d3

SHA512
66173dad4323a39778cc9272693a574ed92a31aa3d785468039f385bee52ab32148538ac1a92fde5e88062a177464f515f6dc2541b788e156097099c61d2ff0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f289b2425ce8a8636cf183be6a7a7323

SHA1
59125fa47715bbe0b1fa7f8014b9acf4d8174d9c

SHA256
bbb49ac0a77372b6c70375d54293b4d9bf954f347687b640a88e536b205dd030

SHA512
06a5069c8252d05ec1027972a12a2ec4d5474c8462b4d13c6c9bf3725b02a7aca4c0320465e4b1d299190a6eef98013b4b52b100160a969049f5c1757005817b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cd5409b7fc703535d8fca5e0b678812

SHA1
a69b2fbffa331bf089132f840188ac8708294011

SHA256
ecdcb0710b93fd5be64336b299510c1ea00c1422852edb2c52bfdbea3e086603

SHA512
c33e7e58534c4c2fdab017ada8bb229d4c95edb2d6ea54aa52bd851b02c18ce8e6c572c61b6e9a113a3969f1b4719716a16e00c66dce69b3a044d536f625369c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62a9adeddd6f4d7968f9c2ed0817415b

SHA1
d8ea0726f7cb25ba8f4c436388db20dc87c0f5b4

SHA256
0fbda98b7d74d5fc2e8682edb6b155707f0a695a4af06576c85160511d9da07c

SHA512
cd6edfa75f85a2ae287772a29fd6b9ad1323422ccb2a37a034566976a31212b25ac7cfd895e24db01f30b0eb07eb066a525c1917a376a13bc4a8f575e438d82b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40dda46b2baec390c0dcad098017eac6

SHA1
86efb3b95df0624ade6da45f90f505c26c0fd96d

SHA256
917692f6cd41ac3ca5801c7745baa6d481bcafde7ff5b421c74acf11465c9ef8

SHA512
236db00375b7480ebb34b7c2cc3d5d6ed1b38f5bd7c13a3702b8dea8233e7176d2c88f4f4721360a596c7b198382f3e35675a7dbd70f19c7d92ac3d021f9128c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8937d39b3665ba5790c693ecffe15941

SHA1
c86af5448003ef03c5d53e44c23fbe1c4202df35

SHA256
dc4a4f208447676bfb34fd58f70c3bd27b72ccf639cb2b556336a88f9bc114b1

SHA512
740621ef28f6721c4e0841c0ebd5dede6280caae0d9edbff8e5c3276067a8a561d52a7ac05ff778c85a46d929c98bf54b022f52dd85a3849f4912e1634199552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2af2fc293acd4a1a3d99a2c67a7f6c27

SHA1
794d56fbc10a06fab272b568dc9b0246845ad040

SHA256
5a5d7cb7c3ac571ad94bd6cd4a91b00d9684a3202edd29403e95ad2b345e2a68

SHA512
03d18b90f3dd02202b970b5bb3d957c78b6d7ce0603ed4a98d143961678e8ce689fa42a3df8dcf751d0719a0672be74ccbd8eff353463609577270c1ea46d3f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
faa0952bf7ce9470372afa3142422861

SHA1
70cedd0f6e6279f1dc9684e092f31b8c7b769aa4

SHA256
baea7c5784e18813fea413bc466d0ee813cbee8ba8985d90fb50febb752fbb76

SHA512
44b7bd258d9f943d49fbf7a08a50dbfe5a21f9be5ed3335d146d1036d99cad52c456109c975806b8887b774fef8ad6b540e73166d8bb5f5af8b41bb4d0abbb34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df9f9776dc9dc50f73f1c01ba1317699

SHA1
d87b58a0d8932c287fa28c11a241fabbfb458e94

SHA256
201975e6ca65b8957af08134d71c2562d739d43768386dc360e5e7a46a1191e4

SHA512
2cbe355b883c4e5bfce4594521deaf94dda5a2d9783b2a87b38eeae3243f9218817c19743e08f8e8f8ca59d02ad53c819a6007c025f489883eabfea1c4b190df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a602941e9e03afec3ffc3db06d5685a

SHA1
d3d760a228b2268f1ae9e034b7c5fba77c1537be

SHA256
561dc20bf7225ef19123b2d6309dd2cc5225ec7b697cfebdf6590fc6ff4534cb

SHA512
d8be97c84a862641c9f09e4cd76f59aebc66568af100f9743b40801f78fff45a61b2f09f7a5b4cbba91b654cc2a72f2f7772011a1688ea40d0407fd631f57ef9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
469aa46453fdfc226f678a90374116ec

SHA1
d1127edbec8cd8f30516dd59cfed0c2944bb51c6

SHA256
6b9d70a4c36f33c861db5392184dbeb14e52e872556b505a81169bca832e0abf

SHA512
29b10cbeab3949a3985d068a658bf137b9a930836db55f40d94f677b09db420ed5d230172068a115c6d76faabd94d44d156a569ca1970f297b5190cc5d9281c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1029.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1139.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit