d66c729c2dfb7cc6d2853a3b45e1050f009f97ceddff338b065a22078528aedf

Analysis

max time kernel
149s
max time network
138s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 23:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b5d69dcf4af07da85e4f65900a0489ff_JaffaCakes118.html
Size

18KB
MD5

b5d69dcf4af07da85e4f65900a0489ff
SHA1

ff0b1af9d6486fac48f4f840f2b4921ea6a20fff
SHA256

d66c729c2dfb7cc6d2853a3b45e1050f009f97ceddff338b065a22078528aedf
SHA512

c5b907d1dd94732371d12347f789ab3ed70ee4cc6653659ae0c638e256c6dfc7cbb31631a4c08a4415a9c9dc855a460fc62be4c8b0382a15ecf5388435e5dd3b
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI840zUnjBhga82qDB8:SIMd0I5nvHRsvgZxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424743802"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{749C0FA1-2C3B-11EF-9A0D-7EE57A38E3C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2236	2212	iexplore.exe	28
PID 2212 wrote to memory of 2236	2212	iexplore.exe	28
PID 2212 wrote to memory of 2236	2212	iexplore.exe	28
PID 2212 wrote to memory of 2236	2212	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b5d69dcf4af07da85e4f65900a0489ff_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4484838fbd7d05d6e564e53c5380567c

SHA1
3ff7f893b912ea2c0e4a60514d5d26c148390e51

SHA256
b3f208f2c0fad2b62135caa7319696dd6def3ebe0d4782766b6770bd26da0b8a

SHA512
d46a34dda36627ffc619c9dda30b7663b11bf07e30bc608c325598f0d1add7e15d4f382c54216397800a1e1d49a51057630a10aea8095e39ed067fec837d1769

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
156928acdfa24474b0634d1d48ed1a44

SHA1
d5374ae3d58190afb112cd0424772da8686328dc

SHA256
0482d234f43e34e3cb31fbfd6dc84c520db32c5292c0c3dc9f7762cd83a59581

SHA512
2e970aa776185ec2481f70e7fefb1f40e2005e606feb9f93538d1152e1a55fbdf7bd6ad71240cc1f23fbc21956401efaab8e29c4b4ed74ee417f2bf40e18340a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df4afdb7f031e0f9f211f926fb0e52e8

SHA1
058433d9cd39e97d43a2e90716e4cdf021c367f1

SHA256
d167cf091cfcfaff64bb5e0bdc8ded3c40f07b855e1f6c32b7ad6c41b9e14289

SHA512
69a44d4d475eee4c06e71fddbd2a3e5b3b7b50d6134827de2b1899eb77d2c12cd71ab05ba217a3ccf513fc42fa9b5a71d2f2790fb0404f1b6f8d02608f300d89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c64f83d31031f704aacecf95ac30742f

SHA1
78a1f6d01c45c9799e12246358d6d4548f086b1b

SHA256
49bab6da9fadce183fd0fc6e13e6e3ed2af99c50c5a9883c8588057a01d35295

SHA512
d1a9be04cf980e297433a0c50924aedc50199ac9101d6e539901a809a5a3c9c5451ae15e2eb0c3ade0841e8d17334b48f1d9e8cd1b58912eec1ea80687bdc24f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f2f437b74eb4da9b24bcd8eabac01f2

SHA1
961c91485a9458f0c3432bb3c3513ac3879b6034

SHA256
75a2844a6ed467b1e20e0d6bbb833e5b40b2afdca84e134cfc52f8e27b1e44f3

SHA512
251bfd35de32032bb77f170f674f1c411512244f67f60df76642e96fac6e75e494e81fa9c043e611e2d5139fe3080ae30e1124d40225abaf3e77c12c1fbd7034

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc9a3849c511b3f1043782f8b6ef9353

SHA1
9f591c1519f937a2a209734d4549348b7b84220b

SHA256
656050dbad0b56ae4d33af0f7fc648caf63e570152c1e30b29af7e5e5d930ad8

SHA512
d948746a8350d6b77a7d5c825ec70ea16666446c509faa067c9d86d1c76390e7c13bcdcabbed02972a7a16b8d5794ff4295ac190fd06b93f7a62718d1cec6a77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16290d5cb73bc8974b4ca59b8a41b002

SHA1
15d17b4d6488f717c533adf0b51e87f628b44477

SHA256
044b9089eda983ae0f6c88cbce8ae26b7ef81e6b3cb55a3ab3ae3a047b40644e

SHA512
a3b368da5d3891028e468646f1ecf147739eeba2fcbe228e46dac2e22f9efafeeeed53f0d68e370f30ba51b7e1b0db722f55b7dbd292d72ae4d7911af75762e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b57f7ef9745fcd8e1ba800d9aaa23901

SHA1
e61efbbfa59e903ed88ebcb3a0309a9abecc0b83

SHA256
63f182b2c591d6f02f9238d5ede4de2d593bc94ab7efe3a3be47c66c754d9a39

SHA512
790d560bdbf0023d6289b8dd704d95332fa450b91547a7559a3004874a06a30e273c60820a4f417a9c6055d24587157c62aab2432e769ee58d552730c8d95396

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4076c273154b949836cf8165d139dfae

SHA1
297ee35bf86dc225cf3fdea7a65d443d77e14f68

SHA256
c53d62d8065fc4e240f34b29534f1ad8159c9b83cda49be4d14f56ba966e9ce5

SHA512
8add325003fdb3f4b37712f94d99d96236c284d72e4c530a9d68ef1868b508ef2cef2701e048420122963a45502453c020f534005fa08262626fb7a3bf79dc84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1048.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar10FB.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit