9c7570b21fd08edf6269e5403272898ddad10df29ded7a7c5079dbe61c95f7fd

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b114699af0f8d215443fdf023d32a177_JaffaCakes118.html
Size

23KB
MD5

b114699af0f8d215443fdf023d32a177
SHA1

76b26187596ae3d447a781fec6b3a77b24b666aa
SHA256

9c7570b21fd08edf6269e5403272898ddad10df29ded7a7c5079dbe61c95f7fd
SHA512

ab177e23fae7dc7e14ae819726582e136c686972ec18eb197c8cf5e2d48a86f07c39b2b8c7a235b991299b79734dc3b6935eff2416d1a42474301d2116959ba6
SSDEEP

192:uwnCb5nwLGOnQjxn5Q/WnQieFNn3nQOkEntmMnQTbnZnQKdjRvMBlqnYnQ7tnefP:SQ/ASf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424662758"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2B2FB31-2B7E-11EF-A0E1-D2ACEE0A983D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3056	iexplore.exe
3056	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2616	3056	iexplore.exe	28
PID 3056 wrote to memory of 2616	3056	iexplore.exe	28
PID 3056 wrote to memory of 2616	3056	iexplore.exe	28
PID 3056 wrote to memory of 2616	3056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b114699af0f8d215443fdf023d32a177_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20644ae5c437a753470e0f9162a2d9f2

SHA1
548ad366d2d1154b55cacd127e1fff95d5ef1c8c

SHA256
32e77f3318d3dc93b38bbcb7889775557e1e97afdabc9c93f127dccf19d2aa6e

SHA512
81c8fdf848b672ec621f4e8bb83c437620c7ce271a8de21ad4c4791a67e10cd10bfaf9b17a726967f88327c151bbfcd5eedd26befbeacd0f7a37b57283eee57c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21963643b9f4ba6508f8a29aae53d8a8

SHA1
35ed507ba693316a1484a4a35a41aeef702e84e7

SHA256
2403c0168f3ec266049a991cbddfd1751ce957ce02c1a50fc2161eb8787d5888

SHA512
44e4fd776197fc406a24863542c5efa268fbc09907d9042b05d09b5a08d53a4adccf621bd16aa25fe88ab1031bb757c540a3e1b9580e7b5ffc2eeadc4884c58a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac25d23ef865bb94fe9d40032a0458fe

SHA1
edd72c78ddc45e0f0a932b356368a92fd81c088b

SHA256
1e0a01dbfd31cb167d76f13ffd99d298313fdbca5e57f57a406a87ac9e424d5a

SHA512
03640c9cb56deffd9c790fbc1ab02707418c1cadc6794835e85e68c79b87d617bd21ff41a994d09b715a69ad356600a51c0703c20dcde7b561b2840efe1e132f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d81575e6af3444adcd806792775272e

SHA1
cd21142856751b30f8fc30a5ca6e40650dbc33ef

SHA256
e2bd4c774ac47c28926fb8505d8f41d0431d78b17919b6db5aaed55e507943cf

SHA512
07be1600663f68fd46e260cc17918bda592b1a04586ab624fb821a5e95d3ad84695864f48e3d5bf56c3928e6748d03b727df5ca02e385c1e4d1c550ae055d7e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bde33a243f0fec878175077e508cf8b

SHA1
271028a8dd6025cd4b592237be32ce615378a258

SHA256
664c163f297f6f58434d89db61054f5a9efbf74a3c6c8691ca6112f44901ac92

SHA512
811abd3ad0831d13e39add8a41283500fd31d04cf6a812174fd10612355244371964112c9256f36d7960e70350a1da4314f39a51519e01ab62bdbf2cabf3f02d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56334eb1a3cd63886beb80d746df145e

SHA1
1493737388cd7986cbe0c40c49a00b36813bd4d0

SHA256
210a41c45fb691ae35057b7ce095447d585ecbd117eaa6ca740d1b27acae149d

SHA512
4db3789be3a7c1afa7bfee98434bcfb0330dcfbe5d9806cb8bcebbce3bfe7d7fd29df37039b16c337e333418775d0f7231ea1ae893089aca28a3684fe22eeeff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f80384a0fff29313bc7e6c4a355781a3

SHA1
e888753a571f3751d648ffe3638ed1c7ebcd0ad6

SHA256
406556938c6daf1ee52696bb0c822d5270777a0514bc6ae32fbc2120b7fca760

SHA512
6872beb7274d0e42dff4fa059cea45162efe2f16efea4ea9f141812d0b1f08fb77f67e8711fcee64c5c9d09c4bf2eb47efd443cdf9cb5dbba0220f0f4f9d5109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69ba7b825f5ca9f6c1d021b16c3d3feb

SHA1
dc3b01522c6c27bdaa3ddcdb5a7de832448fd0fa

SHA256
e16cbee7bd67995706871dabffc0007b4275106d93ee3ece7cea2dd66384a9fb

SHA512
9e503846ea77f8730850e3ed7a2c90480ac24ee51154eab8b9a024eaee815a0695dba6d93ffe304f873a6d04c23b73f4f64ca095f16769680548ebcabc9f4f32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44c38cf48315c47576b453efa94fd839

SHA1
51400249514da42e5dd17bb0b75af95ab6fa79e8

SHA256
a0dbadd797eaf58d139fc39e9384ada6c2d689af3e73b89e0357d6905cb571ee

SHA512
b3bf0ee491a20e47897c0ad84024dfdbb3f27fdc7dec0d21b66055c50958dbb10bde2d740dc74f8d18016ab92ba3979fc0fab76c232038bb20bd3acd2b83d07c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC9F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD4F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit