2d0dd67f4a490b7c1254e80d5ca3d31657d9128dcb32134f8e34238bca6f943e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0134704115798822f247e13578e1d1a_JaffaCakes118.html
Size

27KB
MD5

b0134704115798822f247e13578e1d1a
SHA1

e10654ba4937b6fa6d96023416c0ea23eca4ab89
SHA256

2d0dd67f4a490b7c1254e80d5ca3d31657d9128dcb32134f8e34238bca6f943e
SHA512

bb677104b16546bb4d8f1df38b487bce851b2338993d0571dc86cf861c535c1a32f3fb11b1d35323cfa4f129d7c57e957b03a5e535f305911f86c388d1b50880
SSDEEP

192:uq2XTkb5nZOrwnQjxn5Q/pnQieENnoPInQOkEnt//nQTbnxnQ2CJVevo7NtHFo+U:nuQ/GZygc8WO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E8267C31-2B5A-11EF-AB41-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424647359"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2980	2276	iexplore.exe	28
PID 2276 wrote to memory of 2980	2276	iexplore.exe	28
PID 2276 wrote to memory of 2980	2276	iexplore.exe	28
PID 2276 wrote to memory of 2980	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b0134704115798822f247e13578e1d1a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48a3ba24e9f3469c3ebd57ef5b67e4bd

SHA1
ea1ed8e7704526e3f3cac2ac6547031dce4616ed

SHA256
91ccd024caf58a4d22fcfe4f8e2e4681b3df48b5f69d65d1e83a7bdcbca6d837

SHA512
03f08502bf87827b729d75f614edb5c627170331eda3427e633ffe0bf0e5e1fc0fc3113a519a002a9cd777a20dacc2aa6fa9b42909ae231d38ec0bc66acaf05f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
319a1ee602bdb7bd4d110013ecec725c

SHA1
0831955af2632060fa0a5b501ca0641bbb9ce677

SHA256
2d583a79e07be68ee6fb6cbab78aa6d34fe40c4e41fd314ae748c30473811eaf

SHA512
9da13e89d022a1d4baa96f19391cfe583e3bd72dfec2eb9c052450cd83662fb1ae48615af58ed46f8011e94eca40c2ae026c10cfb168601ab9e2efe653ad2d08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d51f740aa3506f4a79feb0effd29f1df

SHA1
8c20b2339e9eabf0c26d9fefcd6dc260a16f9c81

SHA256
74beb736fbeb62b3b4137cdffa8f30390168c8ad6499fe70b52d1815e0b9fee2

SHA512
736a34086124120b378dac6d0e7af59d7792c615eb0ed96ab56389601666bd31968eb7b8010ea7ed6c212fcc78363136ad10bca1deefaa60a5ac2721d498d582

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
174a3778237c293f38a503440f92123a

SHA1
ba7a1595ec748980c0d2759f8df3dbe5753a8580

SHA256
3353a7aa5870f3320ac04956c515b5fa53c8cc6d0c1308d2dd80d502ebc73c80

SHA512
6c50c8478abbea8a82ef55f4b8415bfbca61e53f31bb51f78dcf2ef9e37bf0ca6cfec84991a60dfd5c80ae4cfd93687fd23db46bd10a9535cfc2c3e2f2c14bce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5760edfb4b7b413ba3dbef871b4103b

SHA1
2b58730473ecd9776ec58b8977d1458701260933

SHA256
0e9e3a2ac5a01dffabab5a985c18195aaab0838361aa549cd9268e3fd5849e30

SHA512
7c58882b04554e9481611516c00e653a1afa7eef679f84fb83e4e828ac9a15cfb897d4e5402cc8e1a2a05b43a9fa5ee289a891f65e941765a272151b0ecc66d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a16bf93bec85c96e7b44051a6057bff

SHA1
bb6a815f013a91780c3e076b075b9730740b4f0a

SHA256
260c096c0b3c1903acf7737f7d85b757f5018140278eb3fbafffe39afd094f98

SHA512
d33b1fee97f8a92d9e4d03ac6379effdba60c0f85d40d694a632396a21bba1281092bb02604766d555968395122cf9e214d01261d724b4da91bfac4514249d6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b52de490be64f4cbeb0ab1eb5bae2044

SHA1
f84f4c30f28139b0e8b8dc6c2c8d29747df03e42

SHA256
605517de08d7e1f12ef443ea48ac0a4e03e4d64b878fd200f4cfbfac70e7e304

SHA512
9c40c75d3779bb2e0ccbc2b861b5a4d79d44c394c583df032285536a25e47e0ae1189353d715c1fc3d63c3fd9639b84ce824cebf4b93245d90c8579ce08c3f5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5cc2566de6db814f0c2fcffe812be61

SHA1
ef560cbdc5f5ec815c555d64f1961ed2c6069bf8

SHA256
653860f399c0443eabfeb123f4033d5edf93279fed7d7eca9908c96e2d126ac2

SHA512
fbf5633b87418cb24493dfb229306f769d92e0094fdf9920e911194e086ca92c315cc9c8aed89120b19918d6e200dad5b9a1a9150d18920fce64271062f116f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cedccbf9e6b501b35b98c0ce1350dc96

SHA1
801f2cf831b81949724fa6997e9c45411b14d113

SHA256
363f793bdcc869c83c0292a6803348bd3922b2d6a5de9cb8428be4cf1757b2d9

SHA512
2af2a5095a74eea74e158209743cbd179bffb75443e7aa66ee03ff4d8b74dd7a8b33c842be4f96ba7dedf94a9d92c404418e363e3ac32f0fb7826152fba11571

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCB7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit