d10261664f7f35f3025420975a73b33ae0bd674d3370d90b666f5441f5f29aba

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b10b3c43853f85015ed3293f645c52a6_JaffaCakes118.html
Size

18KB
MD5

b10b3c43853f85015ed3293f645c52a6
SHA1

633960299f9f51ad21fabd22025b426e03c79556
SHA256

d10261664f7f35f3025420975a73b33ae0bd674d3370d90b666f5441f5f29aba
SHA512

55749581f9271690bb46518c831417f9c47d62370a7ff35b41deb6529a0e2d9f3d98679efb416175629eb591ba2f2081befdd98b26e0157c1256481171adafdd
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIF4ZzUnjBhLd82qDB8:SIMd0I5nvHFsvLGxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424662094"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36BDCED1-2B7D-11EF-B98D-FE0070C7CB2B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2996	2208	iexplore.exe	28
PID 2208 wrote to memory of 2996	2208	iexplore.exe	28
PID 2208 wrote to memory of 2996	2208	iexplore.exe	28
PID 2208 wrote to memory of 2996	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b10b3c43853f85015ed3293f645c52a6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67638261a02fdf7f23e4c428a17d41b8

SHA1
7feb6bfaf6cf2511595fa65013b6b2904ad7cca9

SHA256
ab0bee2ac9103ad9ac3209b80d76c2c40229b5af683ca2635cbf06b911f9ea86

SHA512
34f3819e17ec5c509a1547f5632d162b3e4d5d0d61cc39927fa04ef98a6f82ecebf5f83c7434e2ab41026e9c2e50c364cea5184ae855f0f77a86c461c7ca82bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3b4781db48de572c399fcdbfc349f69

SHA1
31953a9b0832a4e71e2d52708638012f793eeeec

SHA256
6090dad92c3f177072445b39209dd3d0bcf3348eeb42f34d6a32144b67f76b93

SHA512
55dc13b3431e8229429f4700132aeb2cd45a9d22ee98ed6bbcc71f0d2208450d1b5dbaae1db35439eba2a8ed8cffdd129855da5d89cff0cd799a97d39277ae44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38f614609b107e8d680759801ba5139b

SHA1
04d26570b80257e4ff7d53ab70b7a085658a8525

SHA256
4841a67827705f83dc3fc03f36b89508d7eaa978937180a23db331c982d75202

SHA512
970ec37b8ca56550bf20daf532a0434c30ce6e57823fbbaa1d0d4ff141758c7f68ad28a2d38a0e6a03416350e7ffb95323a3ac0ad16fa98fe49dd1e81ab2c99c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c322e69bfd2527d2cee1e7a11a520961

SHA1
c0d8d212093a674f089de147bf8788a1f8e12c55

SHA256
60f85e0fbef226df1789a32aff88ba31e4af930251ff98fae1230f15a72be274

SHA512
6e2bd738a96fea8e13314f8de8fc1c0a651752c79fb134b800148648ffda794e33b2b748c65153b057b4c1a8ede0e3358a0bc39948b9198b8255567cf38f5910

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bdae3f0b6cda04a9155f18db5333692

SHA1
5d4a925b4acbe01a70a5ee2a2d6c9882073f84f2

SHA256
ebeec6fdc2a526a1382c933f83bbf27bb7165185da82b13313d67deff15e3147

SHA512
d02af6ca94824eb9a75f639565349173405c8b5069efb2da5186ab7b817a2c4628a45811b297129358495354d5aa2504b6cd5ed88bc8a6d199230bf2b023eb6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99829905f715cb98a32973849fe3ff60

SHA1
719baebd43c49978aefeae084cc822779602ee40

SHA256
24a5459718bacfe71f511104e56bc0bc0f2f6de765a480ede63f5c24f4f91204

SHA512
ffa1580068b6804e00b9a55610a3e6607eade126676bebd60770bb080708778d7abc4ea34edd29e46ae2420ec29e3360cf292f4c4674419e0e01751cbcee6c3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b5c893455cfcfcf6b5d5c6786710f91

SHA1
78b817ddaeed266930e687c900f0881a386f20c3

SHA256
1b7b8faa4f94cd022e5c364e3ef5322727afb2b709e04e90dfc4d9b7e11d45ac

SHA512
dd1fab78d3bda90e661558f1443c494b9ba4d7005cfcbf6c40056cbf257b5eb7d0db1ee028735a1d70f1ad031cc364f66673949ead8118e0cb01903dd5f33c8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac25b1b2a31439f926c7c512d1f3c944

SHA1
59f3038a20461ebf7e2ab6e8533a7523042a318b

SHA256
12d4bb9dc6c731c09ce68c08f45a6ae153ba2965f895a97a62fbd6b264b2cf95

SHA512
9838d8a69130d10f0cbcf50c716e6c955aad6315ef65df7f3362c0bec67393f9af38911550ed9d2e3d21bc51b2e9248a6e219a2ca5077af98b6a2c2c384b9999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df9e309e0396889bac9db8e4bfd92e23

SHA1
f3ee7bf81eb3bc26108d9f2c2f26de1c41c4b081

SHA256
7e56c98af73b0c51a17f34df765d321455dc4c893f12473a4ccff48ff3d7a3a8

SHA512
155d41b48755e047002e3152f5192fb16f4ab29db4028abdf6565b3ee1b2ee6377548211473f1b1b423f464781d8fc41af51d8fffa81dcb25932ec0ff73deec3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5590.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5630.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit