0c6008e63d86b9b8e47f8f26c5709d74d392a6ae9868b43d0b425078601c07a9

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1ed9cd7e3306ca5b1c0b9dbc79de684_JaffaCakes118.html
Size

31KB
MD5

b1ed9cd7e3306ca5b1c0b9dbc79de684
SHA1

0e02a3692c4a8cf8c0c5955362abbd9f5f75b033
SHA256

0c6008e63d86b9b8e47f8f26c5709d74d392a6ae9868b43d0b425078601c07a9
SHA512

7c1d16b418a32713a57648203daedb286cef9e0c0c7cc37c71968334fa09cdf32d584cbabc21e340d887361c63d2cdf86db5691912e8eb65000b7912f212c513
SSDEEP

384:ACk3GDG7GaGNG9qG8GtBQ/SWSZSQ/jaVsD:ACk3GDG7GaGNGQG8Gt6sD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424677668"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79B8B5A1-2BA1-11EF-A490-4A2B752F9250} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1748	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1748	iexplore.exe
1748	iexplore.exe
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1720	1748	iexplore.exe	28
PID 1748 wrote to memory of 1720	1748	iexplore.exe	28
PID 1748 wrote to memory of 1720	1748	iexplore.exe	28
PID 1748 wrote to memory of 1720	1748	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b1ed9cd7e3306ca5b1c0b9dbc79de684_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc7166827008955ae570beddacd88861

SHA1
dd90c8cc91545b359739f9afee601bb0c98d3188

SHA256
0c204b91ef0c7cd38de5c3654187778b18158d3d0a1a8a53ecb151c692ea05de

SHA512
ed6a225c36b90d2b8e73f0d7546830d8d1bc2546a1ec559c776c76d024321aac382d853b793704410502b5e4297a4630d6c7786072cd677852b4d49ae7c3ccd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c38fa6242339202e6f2567671482f22e

SHA1
bb48b681827c2cc076ff3d823fbaee9d47120580

SHA256
13bba44f500ed36ebd549491786e6e6a44825a07ea528f00c2d4d2c23ba6da3d

SHA512
fa8e207bdb48be811a19b0e8ca90fac491b61409ad90919b9d3dd4248e1fcf1cc4adf6b2b15b118b6235446bce07364cb77e7a56e2ff8d356d3523e6a292fe30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba144bd918a3deb272895af55db600fb

SHA1
12fdc53ddd44e67972c7e7662e67028031d6f13d

SHA256
21ce394e3eb37c53d56e9b623af218d3c89d8c87d248408042df9045dfcb7597

SHA512
a0506321c308d365b3b70062fc0bc1b1f3cd4ff5cfc9354b9a9dc7bdf9358eb523673100b03edbd8cc421b0920b109a99d9ac4d13289bbcf947d0f696848491d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fedd4779c6e5b473d9f0caf31db0ceb

SHA1
e0fcd3eb8e472c9ec384793621073b37f1c31ee7

SHA256
ed8096efe42e10be2d401cfc890a7a4b1ba8f56f813ff95d22f164a8a9c26b62

SHA512
9abb52146b7f6c28bf964d0468a498aa74c7eaad402b92ba67f6f6ca3e5cc6536eecbf83a7ca10c23d4f3bd083435683ae77ed6984bcf56e9394e4af595b1161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af91118e9499a9ee969eb972b1acbe94

SHA1
506bface55ab5f4f8c8ca2ecae8457cbee1c7977

SHA256
9d0c1180d1dbe4be350d92fabb4ed16e0913f4aa71d621f7e05ebab0a7d05b03

SHA512
1782b417511d61b16cc029059223a94b949a80a32eb13bbde1883d8d10fb021c722fc3b9dd77634bc77ebce4f74ad3f5068ebf1d5068e4c144b00bcf0b182f95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
957e994c4c3a59cac66e7f09118ce4f2

SHA1
2b0579ecb4f4604fb7aa58745ee97f20fa98b777

SHA256
d68f1a959403ec8cbe584118ed59b8e0afa6c9cac77694fd0b3d040103234340

SHA512
595ac57a88a6aa2c2f5b704c2b150f5ef37f2ea0f5728618c448887d152f7115bf0efde53fa6111bf9876e62b8f0c6693c8b6aadd5cfdedf132d61162fec602c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13da8f9236304c6a2f6da8c163d121d1

SHA1
d96141731ee79a7df03fd5debfebb8728cd3db28

SHA256
abb9238fee32b4c357c80a555a2d901d1a875e510e33c8aa07a8f0e7dfaca2d4

SHA512
848bc89ea1215d701748a589ce3a876e401990c0f3a69cd837b64178f345643e306738e93952581f715c2b5f1aad1580119227f7d41d0d66a2eb2c329e5563b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0933d0e3fd74b405c6b9ab76db97d9a2

SHA1
5647aefb50079999562cba7f684933b254c10000

SHA256
6f5a0f02feb86f2c5bfaf56b8aa2b5623f127add26e9c21c81286dbfbbe96ff4

SHA512
eb2b8b4a5b9cea88005e83c339c648c968162a9982057b31a0aeaf4c0e33cfb1982948fede293a0e63774076e09d80dcda0987b4b740f24245d572213ec65fc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcb85917f9e0ba34c2f9efb8002438aa

SHA1
a7e6a7136c8fb1c423cf8ac0fcc8a809c33ba290

SHA256
144abfe434a5f07ee93f94b270bcfafdd743dac2975915072757cd1b9ba65b3d

SHA512
9bf93acfe029e2fd0c07132e2db371f4f677b3ad6894f8eff8d8678135924c4fc9c666badf61ca899b046bf4ea976682fcfe7bce4c6e89c82904fe68a78eccf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC62.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD01.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit