2e4112015a5e19360abedcfb33e4ca210b408ddd1645dfd6e0b7bd77f7ffc701

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5b2ecf16e71eb45dfc63bb162993a3b_JaffaCakes118.html
Size

27KB
MD5

b5b2ecf16e71eb45dfc63bb162993a3b
SHA1

067fbab3d542306bea9a14f740653e77c30b93b2
SHA256

2e4112015a5e19360abedcfb33e4ca210b408ddd1645dfd6e0b7bd77f7ffc701
SHA512

a93ac84be15097c74195f8e9309f5d7edde44ee5fbd9ae55738d2d3ffff5b1879183ed24102413cdfa4269f34659101f1cfc4dab669613ff42630b8679ccf89f
SSDEEP

192:uw3Mb5nmOnQjxn5Q/9nQieANnGnQOkEntvfnQTbnBnQ9eq8m60JwuQl7MBgqnYnz:LQ/qvkKwJSKln

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7AC67001-2C36-11EF-917B-C299D158824A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424741666"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2748	2932	iexplore.exe	28
PID 2932 wrote to memory of 2748	2932	iexplore.exe	28
PID 2932 wrote to memory of 2748	2932	iexplore.exe	28
PID 2932 wrote to memory of 2748	2932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b5b2ecf16e71eb45dfc63bb162993a3b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c21109087268870ca091e151edd86122

SHA1
220999b6dd4647979c16e08596aada7c3d77a487

SHA256
39fb6cabd5c8c769b0965a68a6f2802fc1ba36084ba6ff779f00cea54de8bbfd

SHA512
44f421d038e5d998f7eb9f9c7d28c9d5bfb0e7d5638038be5d4ce8533db04de00b5456aec22f2a0204e83331464dca6183a0048c86b17e278d5bf40cb518ce56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd0611e6c9b3e0d8404f71dbcd64f36a

SHA1
159c727e01be5e2051d9218da78c9b5a7d0a837d

SHA256
156bbebc4f6f0d70e39f9c9682ee558afff8dbf92eadf218db882925a248cb24

SHA512
26f322e0fd06e47d92ec8dfb9e23f360313b6e88d43492a68b61904bd0c2d11d31e079faeb73ae5c49db770be8abb9b5bb96fdd6b10675f80a27846b29550cfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
781352a6061547db570b001069ae17ef

SHA1
19f35136bc5bd912498779c73d2fae2cd77eea93

SHA256
a5fe14957d01a5a7a4bad99e763b1dbe818d86f86083c1899401f136d9c8f8ec

SHA512
bedc4760c29db7183092f8b527f926635615712c6537059bcd0cc3eb17b3a2d319840d67ea52bf3776f88634b0a5527b754e6e5ef7916227a993aec28b99eceb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0fa79e67deecd071b0a01ffcef4dc1d

SHA1
449704eeb36a0311a9ea3535f94c10d0c81168a8

SHA256
4fd213296c219c304a846f1e1995cd3f91be24f91e98c947b71ad97789a3f9ec

SHA512
38d8d81d41725dcf70e1cd2a3d5bd72b4e01138049fd9aad5ea1bae71a600144b763f27439b13b61243ca0c30dbda894c8a9dacfedc6ee51c4800a439f1ca095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa2891a01cf9691727cec3688669eb6e

SHA1
569bc37cc6a9b97de160ac3596b967d0364c6eae

SHA256
77f75be42312ea2a37aab5d6c1fb8131d210217b32248f60d9bba8b10950bc66

SHA512
535f2b02c62ed8922acecb7477b421d7b3a1ebdb17e0ac43bf55eb9e5ebecad5505767104c70679aeb1e48c08364938355c7ebf901e2304284c39cb3f15f50c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f016ecfd1eb544262f9f8790c432db25

SHA1
f88a42d00b5e50471245305560e40a058b70174a

SHA256
72324f51c17097a90919b455b15fbad2f72fb364639b66d731bba0caea0a0411

SHA512
58901e3daad3665953b0cc5f70846d68b231f59a310f1262bb876ae10ce543abae94c5c2a7569899728981b338ac5291cef202230f5fe045876a33ee06dfc5e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9af9a6e39a2c68b7c920f52f25b9a767

SHA1
ee9593ee172b963b07d19f5cca678e80661b4ea3

SHA256
95e161bc23216e63071a4550eed1a525ea4454c4cf292dfbcb1c865988590b29

SHA512
58e938d1691f302ab78537d94593cfa7de0d12654175fbb935cd95bf5709f5c93dbd1a4b96e7198d963e2f90aaa1a3846583c1bdff8afee1882eea601f746f44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f82038fb420139b8f37bad5936d440ff

SHA1
e6b1264e5eee8b7548945f57c22de91bcae11d95

SHA256
37c3408fb4b3882691afec137e94514933f223a2397cfb90a58bf8a1bce35da2

SHA512
b36d1d5130cd32bfac3741c340e02682b9e779b50acad9dde777424f1a2aad619ab2a3151e50bda67c9f4e0605e97212e5477657b184a83c5abe3a06aac1a786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38271145d3d13a5e12f106d651516d08

SHA1
c175405ea58fd55fc846854f8edeceffd26446ff

SHA256
44c8afb5873227956ead419f85fd78cd588be29b2c72c3a3322f09bfc65c9ea8

SHA512
c168b4048b1776e0a5fbc98d8e8b81a7ad641c55021e8b6150b5e65fd3d52b504fb914be3ae41dbd1d16442b9436a1a25e29225c113f23d03be23c2f94ee4288

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9C5F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9D1F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit