5016823f0b6d53150ce8213216883459eadb19f52e0552367d767a8e65665b4d

Analysis

max time kernel
149s
max time network
132s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0d96e548bf430cef88a73cd0a751939_JaffaCakes118.html
Size

28KB
MD5

b0d96e548bf430cef88a73cd0a751939
SHA1

7407a351da956baa1517b38f5ee21736e60e1d1d
SHA256

5016823f0b6d53150ce8213216883459eadb19f52e0552367d767a8e65665b4d
SHA512

fa9d2bae2f4baee3e738a673f3a5049e4c7cc410e410f247049bf8ef31456c04f9995d1fef56da1c387bd425bcb43206e0dc2a3c84d2449328e524703cd4b316
SSDEEP

384:F+8KMaR7g+XlVC+WatqjbgLXrRntY5p7/Lj:FmRtXlwMbRnOp7/Lj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{84F94F51-2B75-11EF-A72C-767D26DA5D32} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424658792"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0682f5e82bfda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000003b7c5adfb2814efdc619b9bd7ae4464056be47cebec81e0f6f0947785f389b93000000000e8000000002000020000000cbb39a5ed0829fc05575dee28fca85921fd4664d4859bac0ba024b68dc06d9c7900000003a98354596c65e70c73c9156fa34c70d2afbe9f183a88d044eb66c70e953555e7ce075b205039afbd98ba374931ee2c1b1117881af3f6ca0641ebceac5b6578cb26eed0c6932b95b67d794edb1cb23ca7aecbdf0e9e5344c3c9299c93483ffeddcf713c6539baa64fe4fc0d476138bf64d83abfd0c1f8e78982791fecb55bb2347d7434b9995e20468680aa92afac22e40000000b163431f9468eca33b2b0505640e9db6a3a4484f93e8f78860ac9e3f15d53d316706533b8dd99336bb3eb8b61243bef025bbee9199d5ad0f0aabb23dbd7d008c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000052e82b76ab00e1a015bd389bb8df353826045f32be79ae35a1972df465f019eb000000000e8000000002000020000000c2b7844ac4c443570cdf0270d4c8c39809308f819e6cab0b6132b15f25c7051f20000000d4fff0fbbe93332588dcb9b2cbc19f823af991fe27525f97df770c2ad94d352540000000fa453860e01d47c4946cf511abccfcbcf2ea0ceb0bb8ea50046f3fbf2c278c3e156c0fbdb73ea50520c4e5d638b6042a226883a1a0d857a2be2a5579f58919f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1844	iexplore.exe
1844	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 3004	1844	iexplore.exe	28
PID 1844 wrote to memory of 3004	1844	iexplore.exe	28
PID 1844 wrote to memory of 3004	1844	iexplore.exe	28
PID 1844 wrote to memory of 3004	1844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b0d96e548bf430cef88a73cd0a751939_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4472ce9521fe508f8a4bcdbb1064217

SHA1
ac4252003e29b9f0706934b0e56c9c43913f1e6a

SHA256
50fecd4bc206a54ab16cc46e3e1dd16e610ab73de6a80a755bf13f8098e9441d

SHA512
32884dfa2dd936610f413226b8158fffe885d57be8690b8713bf8cc36a5cb0d1d7904adac3501f41a0a4f40576cb5cd4b282509d13ad7f16a4e1b6b7f3d32444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebe1e6f897b0a661c99a12fc37a91fd3

SHA1
6035a10fb5fc6fc6dfab1b3140c557e7d08e5354

SHA256
066a5ca48ecd8f22d36b6cff0b17b475cf8f2f404292009a0944d3967ee1ed8c

SHA512
22529d305159e3d254e3c4d07e50a392893df303c0377872e3ab81a257818daeb9d0288230ecfc0f22182eb9fa0f8fe1dc993b0dcac8072887b9c3f47005c576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c19d418fa58900ca49907461b994a76

SHA1
2729e02aed3877df219cf8d84cabd588eb64c3ce

SHA256
f0e8e1b9dea308f320dee8a85ae2c93ac9b26f259258aec70cb212ee3ac37696

SHA512
f653c2165178657a317acd81c68bbf46e24847bc1699e216adb16f355efdfd718de3c2166baecef79c4add6a91affb2dfe13d2f56eecfa9eaa5c1f76c3f55e64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecf78d30ab8eea6f3f7d14eeba4e9658

SHA1
bbbf6ff9a83f578ac75eed6f3299afce090db654

SHA256
e15547f5346ee4984e6403c29353cbffbe725d81ba075385fbfff3630dd3c8e5

SHA512
2870c9ffef275ab0793faab178d3f910dba233c443d4612c2643a43ee029a87addb30c6dac27a0dbbaf62e64c4da1afb98d215941c770d29b005ed9e411ae00d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
924fb10aa38e45d919ff671408f108eb

SHA1
0c47a29432c235111fbcf8e7fd86e761d9b64eda

SHA256
9a82bec02988bf66e3e417348a69e20f869ceda41dbfb4d7f3e1c3e906699f87

SHA512
941df50db75c0fd58763e374dfd137ef7007602958ae6db9a3089bbfdd7f8122c10b08c3005211d0bcdab12136c99ee3594300bd5b334610f7abb4c606ce139b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f0c3c92783e0361bbdf4f4191d62a61

SHA1
65dad3b767e8793be6972962adcb132e70339f37

SHA256
8b2a92c24268ddc8bd1767aaba542d38890e8872c09a57db02a799ac54aad757

SHA512
1dbd4cf73f77583ece0812e2b138883213e53fe6d04ac4486cb8a59c11eda1bcbfbeb9271dba1acdbbf7726fc0a022b76c3d41251dbbb5893912fecf77c3beeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24cfe48827cc52e84462e9a1a2d1dbe5

SHA1
830b5e3ce3b77d47db8020b7d41770e5753d3350

SHA256
18942749a31feff4fc5fed0e08eb0c381dfea9a6be9ea02850cac58cf2ff4f34

SHA512
b5785d11ca80d95e3b1ebeb5b25e1360820f23fa07a521f627e100f3eabe44fc62b248cfcf3972943f52dbff5cf60315269ef64f6cb4f8aa6eefed71a95faad0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
958bc636f2f59e238f6d2905931daab2

SHA1
96554d6d32bf6e8684ca7e3dd7cfd311c2ec155e

SHA256
56d5b0e0ad8f13acb9c5b4e16669f33bc7102a41ae9d4bcb7de2ae691b8e8c12

SHA512
2ba2013a74f8923f2d3fd53692445e7079ebb5d9df23eddd124d0e2be94483df0fc4460af3aa41502a53882bb863561702d03013154e38eca2e8c587ba8092ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab54B6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar54B9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit