58801ad55057bd02f7263352156e7f62ace87321ea53fad3001753ab2b2a2b08

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b019aab9b34d419167c2bf915d927ec3_JaffaCakes118.html
Size

27KB
MD5

b019aab9b34d419167c2bf915d927ec3
SHA1

308c81a21bd2653e379020caf6f87b3b73e009f5
SHA256

58801ad55057bd02f7263352156e7f62ace87321ea53fad3001753ab2b2a2b08
SHA512

ec0c90271fdb32e1e3be8607626d5a6d0c8bb2fefc45a33bd407a1ed63ebbe43ef7321aaa230b7bfde1310128786787c6cbe09629c0eee0d26a4122cf2f12ae4
SSDEEP

192:uwHYb5nUenQjxn5Q/LnQieaNn6nQOkEntxxnQTbnhnQ9eUem6uViYQl7MB6qnYnj:tQ/yhWcirSkPR3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424647681"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A77C7AD1-2B5B-11EF-A5CD-D671A15513D2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2220	2208	iexplore.exe	28
PID 2208 wrote to memory of 2220	2208	iexplore.exe	28
PID 2208 wrote to memory of 2220	2208	iexplore.exe	28
PID 2208 wrote to memory of 2220	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b019aab9b34d419167c2bf915d927ec3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a027fe1699c1bc7ae65e1ac3e64f2c7b

SHA1
07bae5f5e043a5d3bf10d07e7fabad72dc982a62

SHA256
544f72a042010f25cfc5fb82039252b3eb820283a987e0f39d38f46b89112bb4

SHA512
c262e20837d12727e5a91a6b737e148822b2e9bf3795792b7103f57b0eb4d7dc2bef666b1482a7c5d9e8c26c65ec7e3a7e1eb52274e4b30f964155c5f6463e2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23ab10b5377829c6af9929ddc38accbb

SHA1
b68f3d539bc44433c586825061ca1cb6d0febac9

SHA256
7b0fce2d9de295b08b2c2ec18552ad3186688a42668f15fde2734684a9e0a751

SHA512
8f1fce1bdb5b8a775dee2e83dcee5e5da828801136b8bd2c93be555b26b3ddef454b522cdf87de1c196a5a69e4d2dac5e005e60d5536d02f50bbb3a428d84bf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d05c2a55b2b75ff8c5b42b444b2910b2

SHA1
df981e51e968df94ed176aa07d4f37d139da7447

SHA256
6cec2b7c84c41c4ec2f3256eba614267e7c2d49917ca9fcb375ded8f4c717d89

SHA512
b99152b99081af4c86cd4e92ba55922d44f83ea68b1d45849742bd17cb67f982706cd5e30c9165354b5f31a6103d6a2f56d99a874759abd79568512385cfb5de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63475d0e87f462c716e393c666b6b14b

SHA1
479ca8f7900d5890cce9f1a5b37d5aa57936b662

SHA256
996884d4e3610f76614553b492e93dc2f8127f03b1cf7ac2559443c630e38270

SHA512
67cab28a02e992d3d3a3f74f664fc2644fd1600e889eec8434e6993c1dc724841f29d4bce14eae84aeaed89484df679fdf3aec1204ba4a5162d2ab46c8c951b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11e6d0ddc5ca2f168696b276f6371e26

SHA1
ada13786b8721b528c8f6fce39610a5a50f50faa

SHA256
0227d505cad2d1a63e3e7a812306a2269f65646addb5105538d6dd17932479cb

SHA512
e7c9e646b31466cdbab1bcbd2161008d69f5e10c79be09649a9ce91e2c8caf153f31c8919daf20b13a165f432d5ee8be4031481a234e073fce8af1d944e93502

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd7cf0d25ae1efbdeaa55e147fd55e97

SHA1
63e87d13e93053dfb54b6ea21fed8d886f871318

SHA256
731011545606dd3536769ef2fc01d53b3d2a377ed2bd8d6f251c2bead3468ba3

SHA512
23e142bd471bb32890eaccf698cb0312b803ddaea6fdb9f413295f7e0a8e5d8e76b2a1ef30b9f5bd87d8ae743d7ecce4f085064b77a19914dad112df8cc0f611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ad5f8627decf800848da3de6ae73a8f

SHA1
43baa5b9270584aefc1fcba0a6cb68f19c909e66

SHA256
4136eb184680c929b2010592674f88b0941a5f4f1960f56016767e30a72bf446

SHA512
b40504b060507a4b0c5a00ad9c42d4833c7e56c57d0ef868928d5c939862bef6a592076e236bda1cbaabc3445dda0477fba567733fe711882e175467b8496acd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88c886379f0498d76dec733be20a3357

SHA1
7f451900fa2991df1c4fb2449c01fe80c07eb681

SHA256
41749c3b9804b727330c591f83df1f3ee1b05837207a0b53452d42bbc92588e9

SHA512
f18d5ae9999f9979ffd3a88b46b3e27926ec141517ccea1fb9e218a14d5b34cd5b624cc65e25138deb05bcb5b6a31dc0d40fc0fd1550b7cb8bbfd2b87b987d1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab26F1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2792.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit