42f4e4f83925d330e24be24a01dfe3dd65a9b4fa08a200c616e77eab4172091b

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b123c7bd815fca2654514db97d7bc18b_JaffaCakes118.html
Size

23KB
MD5

b123c7bd815fca2654514db97d7bc18b
SHA1

8dd6bd4485568ea0e99c57d2ac2a2c9b994eb5c3
SHA256

42f4e4f83925d330e24be24a01dfe3dd65a9b4fa08a200c616e77eab4172091b
SHA512

54cd8a9d8e493c11b578b383cdc38bea54ff57a94d7befc6a55fef48157f5cca6f936de4757f19a491240a9b826f075da2cf36831fef80edcfe83f239c0ae761
SSDEEP

192:uwzjb5nh2TknQjxn5Q/lRNnQieoNnYnQOkEntzTbnQTbnBnQKdjqvMBIqnYnQ7tV:+Q/lO8FQy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424663734"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{089DC6A1-2B81-11EF-AAA1-627D7EE66EFE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2384	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2384	iexplore.exe
2384	iexplore.exe
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2296	2384	iexplore.exe	28
PID 2384 wrote to memory of 2296	2384	iexplore.exe	28
PID 2384 wrote to memory of 2296	2384	iexplore.exe	28
PID 2384 wrote to memory of 2296	2384	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b123c7bd815fca2654514db97d7bc18b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b2b1ac4dd16a5cd8002c968d285c36c

SHA1
7487de89695b07e533a3ede40978e33aaa47182d

SHA256
008c98b49af62b231eeca5e306752e8d8417f0162b3669b0d6d4e57398f8f9c8

SHA512
251e335d45898242a2aa47fb8d0832b870628bec45c1676062209619f84d198409f06dfa75b575d0b2360aeb2350f6eaa0b55e8dea1d677a7432cc036b9f6741

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11e680422aed0f37cacd18adb865bd20

SHA1
51f8687b142b5d3ca2a5a6370fff8016417283d9

SHA256
6717e4db7188bdfe0bb1d988757f7280e53c94204d46e758d7515149fe009dfc

SHA512
66a78bf25eae4f0807fd72e876812570d99786d4db6eaabf3856ce9df6564924816fa80be62ed51f11136759d8c23e4ce9e57116ee097544d8979103f9268b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e0e59791da30bbc4fc3a4032460ee16

SHA1
042cc4d1d333fafa611f67b8887b307eb88eda6e

SHA256
30fb2f73538097553c06daf489d6bf364faeab07704bcfd55ac323a561cbbab1

SHA512
6152dc05b723a42ab9eb62d63cbb50b04b7bebcd0a90f77bab8df9066b48cc0e7347db33fca3412e10d5c02e44b4c735a9138ec14f31c3282659d5a6c845b375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57452f0bbe3a6803b2811215e5fbad29

SHA1
1180d1c985439d44f8c9a197d3095f81a30600ef

SHA256
844aea034b6bcaa8940a48df44720f260cf9d19bfe05fa7b9dbc0c9ddd778dc3

SHA512
64e4f70e18ccae90f345aac1c39cc9db018f23c23008e9984fb8d3eaaf64b79f7777ff711253f7de9a82fd1a45d67241886adb66fb4238805411b19c3328c1f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
044d28e32666a55070983c1657cd6fba

SHA1
095f91e768debc3d520743c6bce3976f5741e866

SHA256
40ebcbf5d1b2608b251e79abb27eb6f8ec6a14c84b1972e89e5c5e948370b08d

SHA512
e0c8393182c12c5788cef36524f42b7961b3d8bb1a9ed8dbaa8d54e916e75e4337c59a41597651c1aab826240996636fad0cc7778a37a108667f6edd4805d112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8fe2ffc8cebe7c5f7af7b59adeeccaa

SHA1
ec2adb041ab1632487ebc5efef15ed55afbf1890

SHA256
0470b0b4854c977b2b0ec1da57c57054259838481e0f4348f8615bed9866aeaa

SHA512
cad323b6b198bbfd52bbefe92b4b19d4e34465f17b9ebe266145ea5f7f2e1b3a93e1e6f6d8fc4ee8848acb3c88ffc5bd19c862386642c046cf02f23884653451

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
679285918e4d7100b4547e7930480496

SHA1
9feefa0490fd42157cf2574761c140037df40134

SHA256
8e7c96f8211fb96c689b21677ac4af0f3d0165e65f6abc94511d951e38329d7f

SHA512
69a57e3896a4514fd248205ac763cd49d26e1f1597175bc5e9f141bbbbc818a4b3028967b86e93bb9c86f16ada76da2cdcfde03e722ca0106084a4cc0cbba52b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2caeb4933d729ee3e67ab7e39d3fc757

SHA1
ccdc54dd4946185e17ecb56e51114eebb72a0588

SHA256
c78f9fa10c509267d1035188f2f878b18ab5f33f1c7202d5665189b3f9f7728d

SHA512
0cc24d5f02c48704b8fe9da2e20e1aaa4ef290d20ea28f24daaa1f8ba3c3f8588303fe2560c87dd6dabcb0e39f406785878cdf72c989d41c60a058112efab48e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
356b3473188024e3e4ef4687e39abacb

SHA1
8b88a5201c8416dea6947642486b1898969e997c

SHA256
23d6100c1d364011d32635ca8ba132799868ce0395f4b8a41166c66aac5c0c6a

SHA512
a5c2748b4d472566ab32012bca36130a4e4a593b308c7c7aea1a6efcf619b240c2ad7a926c3b16d323018d75138c4e77cdb39f1b987cf069e9b4de3057a4d732

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF00.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFA3.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit