0819a60095867a24653f9f08325841f18f1b018f8a4a0bd0a5d489a32a034f01

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0b06af7723223415483d5972a8d9390_JaffaCakes118.html
Size

23KB
MD5

b0b06af7723223415483d5972a8d9390
SHA1

375f53ff0b8ba2f039d999a1eab6a9b61d856574
SHA256

0819a60095867a24653f9f08325841f18f1b018f8a4a0bd0a5d489a32a034f01
SHA512

22769046abd707f72989bfc7c61434b166d95b76fcbabd00ab12c49adbd8a90052f2c12d458022bde75b593443c887946339ca0478bd814ba20ca1e4e2dbb9c3
SSDEEP

192:uWXYb5nIunQjxn5Q//nQie2NnunQOkEntttnQTbnhnQECnQtEwMBWqnYnQ7tnqY0:1Q/IYX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C552B9C1-2B6F-11EF-9A0D-7EE57A38E3C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424656320"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2628	2212	iexplore.exe	28
PID 2212 wrote to memory of 2628	2212	iexplore.exe	28
PID 2212 wrote to memory of 2628	2212	iexplore.exe	28
PID 2212 wrote to memory of 2628	2212	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b0b06af7723223415483d5972a8d9390_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a2630d29d68ec3091d92c4b07017efb

SHA1
14f08fcaa3172ee106020d81221a4768060627bd

SHA256
b7e7c3f7dc6bf1b9acefc806bf0a6f2cc4bd533b0b2f9716a8bf6b2894c1a91d

SHA512
0ae0c23abcce926465ea49de36ac8a376af910dd3a8e2df4bacfa8bad6a095d6dc28174a24d037ddfcfa0479fd131d26067319effc1fa9d48e7302cc4b63ce46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cf7553377eae5871a63fe0c7be4ebdc

SHA1
d8cb3c3881a0358092f9c990481b5195bfb68657

SHA256
f71f38da57962df3afa75477c46f3b7a8f2dc8de17f0e0d9abe9f9010e388e3f

SHA512
9a7ea32a38661d5947eba53c34c07e0ea9255f870b7daa0b332fe0987e97ed5ceb149041c2da48776cd6662bdd7767271d893dcef68dbc8c24016552a909738f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c08a1eef5fd947cf8a4e6f9640f0686a

SHA1
91d759b74282f6abd6c2c7d5ed3ae357eeb480e3

SHA256
158e71cd58204200e34515e67ea69feb60f5060736afb3b3b80793204acdf592

SHA512
034648c9b1902c88c6b32a92e2eb6c405eb366a0304e1a675db5ba2aa0b99c2230d8b92d0ba8f404820da661aab82a3e6fb5130181f775f88e71f3065352ec66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddfcbdfabd6c49f3b9ebf2c57742a44b

SHA1
f397991d0f6252fc0b3efa4ac22ac3f4f34ed83c

SHA256
c32cb42ef33e7bf5b0a81b28140e74651802d67925d85e2fad6e2f0d1ec59b33

SHA512
5fc136ecb47a2c0feb27b835f312c771f24b060142e647156839a99f4f987c075158eefce897c188c39fb4715858400a0926c61e77905a680c4cc841a20ec907

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aea00674817974ab1d05e94c7ae62b07

SHA1
fc5040f8dc42a2283ddf6a0885b3a29406db7f44

SHA256
73771f34e865ece4ccefad802eae88d52ed7202f42191205536c6648b865aa24

SHA512
1cb4c22497add4e7652636563176021030705fba47ecfe79134f96131c2dbddb62ddb73a020f80697532f1f54828d89e7f76fde13f6fa9155bf2408a3032ea7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a15e25118ff173d45d466834f6f68723

SHA1
67c1e860ab9b7ea6f2a5356128c9c85723d56815

SHA256
cfe8c8505a787e9fa717201be6eb923a75ee26c71066c569a8c604f110dc0dc8

SHA512
6d5d4a814721f2961b02b5e0c72f927ab9c85852cd30b74835d6043ad4bd19320868fe2196a63db320c90a2fe9f70cae828665508818f6f66a529fd15552bf04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59a372854cfe28b7f76010bd05da671c

SHA1
820cb580c40bb0f69a060575cb7d8d919fc58e41

SHA256
f6582a53ef007ab3b2a67d23db797caf1bd1a405327a43cd3ab5f8e03d01d9b6

SHA512
191d0a63b27db784dc4b0f0204a064061211a4f486afcef15e4d3e9fc15de40c4c3cc03ec5406690456446afc9e34fba19c356d7a749160d95658ede32467604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
457c300cbe655405c573998c6335deae

SHA1
64740856e60d80246380fa6d20e73f854ea73a58

SHA256
73da3e67f46c363eb72cadedaedc1c774fca267026572870c9e4054abbb778f8

SHA512
08fc1e49c3f75a1cdc5fa0c9c22b951a57437162c06ec018374fc11256145cd235901d4ea4b2c0f352076f7cb160e10ea016f0579e83c040d02074171fdd844b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a38d58fd171a6337a17e2ca47b73678

SHA1
f3a6ab4603b92dbab706455a9ff3846a2c3982f6

SHA256
0cbcd97c75ff8b7a884e4af92237358d3b4c2796830d705610e08c36b8d7d937

SHA512
b543dc8b6703b4c9e89ac31861d74ea5fde25d04f29b116f681fdca7057907c29abae974da7840239e3d068de0553c48cd9755f28d4199278e668c5cd08de63e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1086.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1149.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit