d66029837c6b4208aa754b3f161e8897a68ac65d60ae21ee1416e6c07aed51f8

Analysis

max time kernel
149s
max time network
139s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b12d86425df71e6a781064c13ba9aa1b_JaffaCakes118.html
Size

18KB
MD5

b12d86425df71e6a781064c13ba9aa1b
SHA1

7837f5e02d8b86627610a9b0b9ed971535cc17c6
SHA256

d66029837c6b4208aa754b3f161e8897a68ac65d60ae21ee1416e6c07aed51f8
SHA512

82ae51dcd23b0de56b8a01cf46bfa88eb3113a42523003105e4c7d4b160b22efca9fc97d9a08dc414d72de486a4a9311da6a6d67296b887fdf30ff39124b1ea4
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIp4RzUnjBhfB82qDB8:SIMd0I5nvHpsvfKxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424664353"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{795FE021-2B82-11EF-91CF-DA79F2D4D836} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1832	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1832	iexplore.exe
1832	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 2888	1832	iexplore.exe	28
PID 1832 wrote to memory of 2888	1832	iexplore.exe	28
PID 1832 wrote to memory of 2888	1832	iexplore.exe	28
PID 1832 wrote to memory of 2888	1832	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b12d86425df71e6a781064c13ba9aa1b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1832 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
735770e15d53532ff2c176755740f320

SHA1
c5ea452715de719aa6c843542f71fe34c16d0f27

SHA256
982283b31492c8ccf211e1b641d0ab84ec1415e8db265dad8a74f68463e8a85c

SHA512
b5e3e0dacb9e4069e64cc3a2477239efa22c8c0f555a0c469294b48d30a7ea40a32967baf97cefca9e57a7febeee4e39d5130f3c25173de226d75a03498608dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d04167c68dee09d141f4a8e2e948eb45

SHA1
8e130f6a254cd538131cc5ceecea548396050f77

SHA256
3c75b47f2d8cb44d3336c5e51484f249ba4b7e4b475fe38746e859f7fbf7a636

SHA512
ba8077a6c9941c2d73ab9ffe3428fb7b5d0fc9a6793cbe98f6dce37907efac58eb0d47e65e2f03c8d92d23ff1785c44a5bed7334d4ed9190cecf177e975220a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc47bd3bac4b53cfbe970468c75dd1d7

SHA1
fdc23930fe62170fc17415e5d6b5259f7cba0baf

SHA256
2ca231c36a3d233cdbd752514c8a1dd63547474525a49148d8e72e2d7e29e69d

SHA512
d2d1e3559b9f601b2c7d2fc5b84aab1ebc62eb44bc9235f3039e95939a8accf427ee95c6d73af81a0ed75369304e5000a1bc83a01c46f0ae7c5ba9c44803b8aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37f9ddb5410d8c3e9fd1bb4545f1203d

SHA1
3d7d115863d1d9e2a7b43d54ee96743206607270

SHA256
7668384012d0f5f9b8ff52d590d8d0f44b8581f9c1cd5b6aee5077628bdc2b89

SHA512
c89e03f6717136147f261fcb595f5b972a868b0685df6f61af95adb40b64936c7b75afa8de398ebe766ea597c6f9292fb3614a41aeef827cff5b808a69e0f164

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc3d4e136fb31a09312d87cdd5b31748

SHA1
9e5f713b79ac8512745c2ecd0ebb253ee0788fb1

SHA256
c21dba4e567d6c170dc251c4572fa7b8de14898a7efaf02d3490df5760af4385

SHA512
d5dbd661a59d9a8a68168a0b9244025237e0d3377cbc100fdd466179d4480eeb8615b267c283df34fa1b17493832e7fcf171e548785898303214dff9c8eab4e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25327cce2e46f12db4837c7ae36e3436

SHA1
9a6044714b4018974d5f66cd74e3b015ab5029c5

SHA256
991a5153ce07a3e33406317bdceba8f934381f02ad4c03415a9324c8c35a8635

SHA512
d4375107e0404bf2db4df3858380cdbe6797ea6d25d7d1390ebba39b40655c0253d2d7b09c54d41d3125405479ad075119d3c40a205164201e0f3ebb168bc089

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15bff6a1b4924f2265ed639767019e73

SHA1
14ed672940d1bca841022fc92549b59ea8201787

SHA256
7e25d93947838b5d4d20aa56122e9ebb57c50744efbc7a1a1eb00380a731255f

SHA512
4423f67b04d07cc5d5c31182a53a79f1b197df7a00b064c1bda1635a0dda1cc46fdbc9e4eef770d635871a3226721ebd0928b66e7a1abdf941b89c361d449740

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41a3049530c862c40867eb4473b50ace

SHA1
76c93a282d5573f6ab9bbaa322931edeb264768e

SHA256
93935012ea7ff711b605ba0fedcb49db4624310b0db96bb89d477012163edee7

SHA512
9d53f2932ea630975e592615d6504eb38f860380b357f5870aaa93517ea0c5481ecf69482602f428134863815d359cdcc9ef093ef609a49dc9b736a83d85ea08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45c6870e97bf5c48c5eea10d18047b18

SHA1
5a13ebe735a4cfa1e67983710d883e378027a035

SHA256
d814b191198bbaa2e1da1af938ccf5b0a0b79655673c957c2b1a175487e8be88

SHA512
b66a9c1372e54791bb9febc23b98ab5c5b57bd72ea828c41ff28d26b9cdf6cf3f1c22ed081465db3bf90b58c9aa17f85a9a93a408593312148719d6b7022b086

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab145D.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1510.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit