47a2d947506a9345e018f5c7b2f871b4c16dbcbdb5d11fb07aea67bf190f8d42

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5b9143dd71db913728fff275fa416aa_JaffaCakes118.html
Size

32KB
MD5

b5b9143dd71db913728fff275fa416aa
SHA1

b50628041921c9e21b78023a325b180cccea04a1
SHA256

47a2d947506a9345e018f5c7b2f871b4c16dbcbdb5d11fb07aea67bf190f8d42
SHA512

83809c64e78bda6494c852edd5618d93d98d920bc7349e0629a5f2ee57d889187aeb577def93db3af32d650337b6f3a253d49d5e7d1ed6ca588d381dc5406045
SSDEEP

192:uWTuXb5neJnQjxn5Q/xnQiekNn5nQOkEntvLnQTbnxnQIMCrAPSgphIWdgTrX8bs:GQ/KR3g3I2qrcrsRAXiNkK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424742069"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6BACF071-2C37-11EF-86AF-C63262D56B5F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2204	2372	iexplore.exe	28
PID 2372 wrote to memory of 2204	2372	iexplore.exe	28
PID 2372 wrote to memory of 2204	2372	iexplore.exe	28
PID 2372 wrote to memory of 2204	2372	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b5b9143dd71db913728fff275fa416aa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
635035ab09519d6c5af8c510867a5b32

SHA1
4559b3eaeb79eea9a18aa5ea2f4a50853a6969ed

SHA256
d3dad3e3afb8fd0dec276f6b09bfdb5fa888f74979d180adf507c10f62534716

SHA512
596ddb3b1a95a2eef46f547ed2aefbbc91700a9b5901950a5e2c120fd973313ebbc8880f1d59fd8e2f76073d659abc317b4becbc4aef4ccdd6ea7ba602d1fe9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
faf0c992f7005c863b708283cdcd0e2e

SHA1
d4d624e3e6965c8ec058779dbfab4fa82c4d09c8

SHA256
3461150a352e772674f9ac6aa5db5a67adfe5dd24871dbf72823f5dc2d9b6fed

SHA512
5bf74ededb4f328608da8a0cf6907f2f944ed531691983640205b4dd163f2ffd1f90b61ceee566c6edd63868ab6ad4851b7990ef49209ba964010a89db03082b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc39ea8bc6f95e50a71da6d9a7438cab

SHA1
d38ffa603baeace5c08177f250d866c2cd1b02d2

SHA256
eb404ee4599131229202d279fd1b85ae406a3a8cc9756fdb32bfbdadfffbad9a

SHA512
f03218c09e777180de9f62bb3b44e1ef1cd8d32400040bd14b8208a951cfa0cbea93dd863f62034668e7e5b86fda117e6d084fcc186a8dd5bed26ba126c98aaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eba30e6a673a3034fa7610149a4740c0

SHA1
7e21c758668fef65ff85c26226d85e128aa73b10

SHA256
5720c2f7910d0bea4843a6ee04760c77f6c27569441a7940b4bb334e53740c5c

SHA512
0d77f656bcb73cd98fd13a117bc441d25a47591a6d747b9c5bb9d63fd4f0d3512dd6430dacbd2336a00539295235974014b81e857e1313fa41dab2f8d506663f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90619fc1b58cfe30bbe029cdce77a6ad

SHA1
de1b083503b367604ca484fe47394590a64ef743

SHA256
4786f058fbd8b40fd6bc5cae698cf0ef327b882efcb958e2b85c700a8b6a87af

SHA512
fdcee87739d5c8cab8bf09a369904b546c10a2412724cb0c1638e5400c850cc595c6c9cbd2a8d60fe5dae3d4fe7ba95158362c4f398fd936bb1236b1b6aa2e47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6f13896d8e462d2ab666cb3c4ebf71f

SHA1
dd2babc66e85b82acace60fb5371dc7e09f5fd94

SHA256
367be254fea7b77904e686e069d2056338f90bbdcbbc48390d384033b919ad08

SHA512
e634d629072b4eaedee79580d153db8df465f6636712bc055dac4108adaf2ae365a23c72195557ed3a867c8bc5b8425373310867820bce8e229e8761d44f3034

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca209b4e6a069515bcbd5963edb4614a

SHA1
f60d7743a5915ef6a0a93bfb5e8be32698ffdaf8

SHA256
ad729261c4d585c127ddc20d3049033f38edef17c17697fec66f4904bda22335

SHA512
587d115d598fe8979b9b736c381e650980b7b5bc1ff2da742888ee016fe02e916587bf90032831c178740bf2b082a5041d4ff877938a7acf6479233094b757e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7c378fff0c5174f7bb0ba5fa0445db3

SHA1
5dd046d38b8bd855935a8bf9040d908b7ae8e777

SHA256
f1761aa3ad0d4f31a495c851fb11a214d21a66cf21857229f8263c56087a46b7

SHA512
72127d07bda5c68308e9f9573bc18b1e1023f9c59df66af4a599bb525d478cc83d02bea1a313707f6e8535173ad6922e1ac8197b39f3afd5ad8f687f7a45db66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e361b21f57717b3e37e7608cd43ab619

SHA1
b99abf6348e7a89c8b84b6f833b15f6f0ab257a6

SHA256
2980053bc544f7647890cfd6543401c6eb33dc07b0f93981b1a1f753bffc54f1

SHA512
ef3ddefe2d7cf6c21568ffa47c0b37c6e3eb2c3202ba64ade6107e855880e59c54b4c98a1038693185b44416de8019693e8ac307162c36da7c9e022d19b612d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab956.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA08.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit