8301073bc14dbd04c60af4e8f931c27b7b966fe9673515574a1b2d502d623664

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1ea8066f80eae2d2964c72540db669c_JaffaCakes118.html
Size

33KB
MD5

b1ea8066f80eae2d2964c72540db669c
SHA1

1143f44395040ad42cafd73be533cd8ee5a9f753
SHA256

8301073bc14dbd04c60af4e8f931c27b7b966fe9673515574a1b2d502d623664
SHA512

0d87780d394c3acdfdf2c5c62967415317e9b6f90d390cfb7eadf6fe453e016a739f233419a7575e40921d114459c4a473fb18d5031e52977b30dcd3304186f6
SSDEEP

192:uWDob5nX8BjnQjxn5Q/vnQie+Nn1nQOkEntx9nQTbnlnQEXC0APJ+vkWa8O4SWRy:eQ/ylemtzVnuM1XROH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424677458"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC8F6B51-2BA0-11EF-8E7F-CE8752B95906} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1124	iexplore.exe
1124	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 2716	1124	iexplore.exe	28
PID 1124 wrote to memory of 2716	1124	iexplore.exe	28
PID 1124 wrote to memory of 2716	1124	iexplore.exe	28
PID 1124 wrote to memory of 2716	1124	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b1ea8066f80eae2d2964c72540db669c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1124 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa90102d60951d847ec8f8191024adf2

SHA1
163ca15711fcf4095adf287125ac75afea1fd2d4

SHA256
a455e7e7954d0d0080e4c30d1ce4019ec849199d0b617114c7fba57648ba2756

SHA512
62761b23f0cce618aded4ff56d8aaa5e9aad0e910d12a1e21bd26fae4677ebb64add82b927cf79a3ae509057780ac55c35ffbfeb3a7868edd20e38029b0da385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e943dbc817f0855fce94df575701b425

SHA1
1e38aca085624182ff4788082bd19f1f199e6669

SHA256
978625c6e65f50993ab2c09d21a5ad030d27ad6a60b0252595d38538d6c734dc

SHA512
f93d0a48ee2a75bcdc2ad5b2f50d36191f3e93253c719440559cf801537d94acdadd19c014b52b4c8e20147ee31a2c2100a83990e8685f40c44b8432ba7d6d1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38114b3576a97ec0eb86ca957fe49436

SHA1
b5c24aa3d0c9a64ee15875842a7c4d6f1d0e1d0a

SHA256
ffcf9dc0dd3dbf8335494cb7f83aac953b3f13b345c4a81c6354e225acb6ab45

SHA512
72c792ae8dbc22acb0be798d1f4a86933f742e613ef3305a4529b9efec86377a6fcf6ab0e67e90531135f17c6e7f4885247d438a07dc98d58ca21e01c97eaa3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d59e7233f1dda0832e0188d6ffee003

SHA1
1398715b6afe35ae3aa81f07f3d3d11b172c5ea1

SHA256
4b392799aad3379f2beadbe9196d30e88be138ebcf90b4a91a308be04b1c188e

SHA512
fd7a04ee9b2a1545de09840ac753ffd698cbb15660420be711e8e984703f72d27fb8b528a6f775fbb5b6793f8713996973ef62ac046dcc18155257612d3f3bd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f93567352bd91ed56729dd376038344

SHA1
63029ab012cbb5a075d289859e529e32cbf740af

SHA256
6d13656512754d3899de3626716463d5df231cdd42b39fef1c9aa253a09eddd0

SHA512
a055f72a9e62ac8c922891526e0d15c6515b33c9c697a66bf7278926e127075ee5346b180166e0ffcecf25af53c882f441934e2e82d0158214eb106a46b9a59b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6fa2df4abb016288e997db8f68230b0

SHA1
c8439bd88ee98dd483610c05a0095297fb3bded1

SHA256
e14362014d472adc9f248e00efeb9d99a8feedf2ea70dafe4131fcdab6dac203

SHA512
55afaa478a8e9e0114ea810f3ce5e26fe634b62fdff75088cee9c1b1a08cf179756f254aae156ce873445a12d0a9dfe720f282f7fc157fad5b4ed79cecfb028f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d59304616220c2da95e3087fe8e36d28

SHA1
e82b4b299a3062136aee250c55c33199e48f396c

SHA256
c9a384a81fde88059b64a9cb41c5faf7de4ca1b3cb84f96dd9a1e7d7f393e872

SHA512
0b778afc2f5c429bea21faabef266b06d36497608c32dfa2b49de98c8e1cdd0c8057da25e5dd5e9a70a181dba664acfbd4fe295e97f330efa7321a46b3ade931

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b565e881ae2125f26110b2b9b77679be

SHA1
7904b6b2bdde9460ae7161e5a36b49baa7069ede

SHA256
cfbb5ca64d118d4d7d620a9ad4d358c34b6f7a680610ee85e13e025ae9a8e85d

SHA512
96f8d11f3ab3ee17e7c5005984ec14cb824a4ead7efa99c5757a66a5c3863e15afd039553ae01ab1c591d808686c542522a1ffa704422b2369d9e4a23b29e25c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f6717bb6d0668b735050fab6a68c7ba

SHA1
00df449854ec410e2f989925c37cf094566485c7

SHA256
93cc87e7b1a490ae52ba5292d01e683216e72739798a84eeff1f302b95476072

SHA512
38647edcd8c3ea00bf9fcb0ff64f28579c8e85d46ba44e0ba98a424db47c977d607b762d6c172de986a8e684bfdd4bd38e5fba7c132e3863df4e9d9f06b221f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab12F6.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar13A9.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit