6fefa7076b5889019073b4ce81e7c2b2cb5cae547c1dcc172ec3c5e09e06ae77

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5d7f88503daa8fa2929352c3a2e2cb4_JaffaCakes118.html
Size

30KB
MD5

b5d7f88503daa8fa2929352c3a2e2cb4
SHA1

2a2b04b7f18050531870c45bc772dfd5d3b2580b
SHA256

6fefa7076b5889019073b4ce81e7c2b2cb5cae547c1dcc172ec3c5e09e06ae77
SHA512

17cdff0d8099042e119e36ef23055edcd46adca9cb7cb7f2ece2227241f010c7bd9f591095f63cdb46227e79f25f5de938603f3383aaa7b268a2fc4e10dfece3
SSDEEP

192:uWLWb5ng6nQjxn5Q/8nQieXNnCnQOkEnt0WnQTbnlnQ8MCntAOSAPh2Ku0N806KJ:1Q/99tAAN7u9HhYzHOLg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424743881"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3B557B1-2C3B-11EF-9586-DE271FC37611} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2652	iexplore.exe
2652	iexplore.exe
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2924	2652	iexplore.exe	28
PID 2652 wrote to memory of 2924	2652	iexplore.exe	28
PID 2652 wrote to memory of 2924	2652	iexplore.exe	28
PID 2652 wrote to memory of 2924	2652	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b5d7f88503daa8fa2929352c3a2e2cb4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16da25a0a5f92416bee8273c9231af9a

SHA1
a4862aea006853b1d061d998fda2f3be197726b9

SHA256
ac860dda00649a7958771ac70262bd5ff8efebc77ffd89605b1354476bf4d618

SHA512
de04d56e1dce049b062b7bfdf9f820f0157e36e3df55c0a27303d3ecf74fd9d3e1ac305511de5ba51da27eefea5eb5f60e38db5d622a25c8bfb54dbcdb93a831

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5011afc0756783102e7cccf87af4c9c

SHA1
c5326562d2df9a82c4c6ce7b31cc288fe065296a

SHA256
1126e136b16007a9920dd911bd84227520009e4b7188da6bd81181318fd81628

SHA512
c59137c82ca21be192f9466499497f0d9a641e21a2286425954ae02191aab6ce623bf10172a6d2700dbcb5d7f8543ccc17a77fa14073a2d63c70dc2193f6eede

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b10fd900ebe3ca9732eaa8bba5a90f9

SHA1
e9c65a227d90999cc794847334df4f2b96de28f6

SHA256
d629a00cef2180d3f4259dc36bb73175e637da9551c8a4ed8a94897a8fdf0787

SHA512
ebdc17452fa5f551ebdeb1008ae641979d4282b5b9c6e47cdac0ed599882b2e2bf1d55ab609154683725fa43037038cdbdd35d680d34b567e75ee40fe40d62d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbabd7bf7968569c678a5446a7fe1497

SHA1
3b9fa566b0d235daecf60f0ce0eada46ee4cb0fd

SHA256
0831851ec7c619b9256d012d73913932a997b10f55f97398f5f898f9dae9386d

SHA512
e321f84e431be853e32d44661009a381222993c76a8872d45dbe6958f12f201749189ed7eda6842387fd4f27dd6a2194d227696d94a9c2c432071b9c47c29b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6ec26f174e504634f58a3ef0def61ea

SHA1
36a777b5972484f7d551602a1ed1ac3ea6b92524

SHA256
193cf85eb0fa521419c35795b3c8c19a053548e39e3d301cf6831aea2bdca16d

SHA512
d14b17b6524c0753ed8cc9547db953a08c17242bd01aa69cb918e3fbee2f250c74341d0a39d0d6c89cbb65ec25b0109825c0cbb61de3f8c60e361de82ad01306

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bd451422201b754bc31427086b6cffa

SHA1
288b59acff08cb6b6c98e3dee04706268f3eac45

SHA256
0a344670bcb4c29d65479adaa5acf68d25bbaa7b54e1358cf613706beede1f46

SHA512
4285dd1970f9af7a7e4ac580d4f7bf7fd7210d60106a527dec2caa323f4056a63b741c62cb7b6f23f8602e575c9a6ec5d1e9aabb6b3fcd5164f64144684e2cf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9bd7307b308f378f7c78963669eb962

SHA1
8bae9560c63179774baab891180e7aaad01f3e0d

SHA256
df0fbb920991cba0d84bc9859a3802234d17d898e3c13de4eba7ac15f477d65d

SHA512
2e0b0fbb2d8b10d2b31e74b0937dd838fdf3e7d5ec706f8ef4c013abfbf96de119104950287e016a45f8e8394640e7e75280a4083d22972987915c7864903f7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85212584267704d5426514fa89a3eea6

SHA1
19f71d58cde9684a11d286e9dd5a57bf67b7c16a

SHA256
786d5ae53e58cd1ede5aebcd8729e64b64c05b2e95e7d4e8b258d99b381d4b29

SHA512
b23bba65afca487d8e2318cf3c3a116a4c05f6d54d685d43e68f79e0bd06d321a8c8b8c4f63b36fc70d8d95444f3867f793037ecd57f808fd2291cc08d93894e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cd636b4cd6b33ead4cbe21cb075ff4a

SHA1
4de06eae6eb1a4f0ca76c6bfa6c3d14ec8b84b76

SHA256
02c15979b93b9bd5dce6c0f994c38cf416a4f382b291b4527f79f2951d495535

SHA512
353ec6701ffcfd8a25cde6ba1580a5bc15197cbb67edb9b6db00627832abcab51dc12ad5281240e1a1c13d579cab651271dd4d0dc22fd819dea6b41e97e15faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5CB.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar67F.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit