08f37c2f7103a854f241476a097b542d65aec86cc41f53516643bfadaf0a2cbb

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1e44597ec2637dcf22abfeaa699e4b4_JaffaCakes118.html
Size

31KB
MD5

b1e44597ec2637dcf22abfeaa699e4b4
SHA1

6c809a8bd7e47a0872965084398801ba9283326a
SHA256

08f37c2f7103a854f241476a097b542d65aec86cc41f53516643bfadaf0a2cbb
SHA512

428a193ee078dd790d8e71da5c64f317ab227f247adb60c9976c3df466f9b10cf23c32d3bcb59a87394c74d20db229237a28bab814c9c239726b1f8996850999
SSDEEP

384:ACk3GDG7GaGNG9qG8GttQ/+CWSHSQ/jUU:ACk3GDG7GaGNGQG8GtW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424676995"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E889DBF1-2B9F-11EF-B6C6-7E1039193522} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2524	2148	iexplore.exe	28
PID 2148 wrote to memory of 2524	2148	iexplore.exe	28
PID 2148 wrote to memory of 2524	2148	iexplore.exe	28
PID 2148 wrote to memory of 2524	2148	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b1e44597ec2637dcf22abfeaa699e4b4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52949d2d44b75729f852b0c450d5f4ed

SHA1
4119f98c53aa5e551e0623119a6117ccb9751377

SHA256
8b0fab35a18ea179b7575a847997879f10683ce3e04a49b316db1103c4a8c648

SHA512
ca3f865e9ad180b9b6e6b1fd960437e75fe673db5399318fed19aa496ed7cac5658beef946e26060b477a67a5ae369e27d0a6c378739a5a1bf2a49d9adc77e9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
966627216cbc973f92d7b5aba0ead53f

SHA1
86c5b0320cf8e4256ac2229185a10b4c57fa0959

SHA256
5c3c39cecca4263e2f35cf2977115d6f6e3c568db321dce805a04e42343aa7e7

SHA512
571dc8929504df2493f33072b04944b0128c2e6e7b38832ee15e0363b64db12c1d27852ffea7dcf10a70ddb2fb9c2c94d701e04a2525f6de5f219d5ae6132dcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5af80aa5286cea2c59a532ed250e6b19

SHA1
579ef1af0a328da1386a24f746b7ea25f51079a7

SHA256
6449cbe050047c35d533d7dd618b73df3fb4031db06285d38bfed660ede7dff9

SHA512
916b47fdde922798d827d18e897d0e1c7faccf2c64ef593303d0bc352001415138bbf4b7c981946f1ea5bc264eb5f7f7be38aade9a47f84c39ede088fda8f835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c4f50e2febd8e9d6434dc4a5dfcec24

SHA1
b12ae7d82503a6d847e68a38a8b5d39a11ea85a8

SHA256
637b2090ada466b72e2e6a39af22dc2403ca00d5a555580a6fe5639f41cd8fde

SHA512
0be20974e3f6c07451db3f1c53cfb97da4430017c0b7cdbeea91f128bbe0bab5f69066f5dde86a296b4462844c51dd297994e530fc316f8fa3c33e28cca16bc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b0e68e382070f5b18d0c3dfc299a2f0

SHA1
ceee0084b0aed04a40a028fef506d5bb77c44f2b

SHA256
df0b2cb9f50e24d987c834100196f5b35394132ebc49c5e2f5a680f8ffac7804

SHA512
1d88bab840a7f8b4ae26090f11458b1781b6f98c5ae85a854b9e28ae118428b2311179c174b47b695c35ab8c5d2360a97a02097de988a0c79619af1625b3126d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c9540b9aba19f9dc97088c2389b14b9

SHA1
d59eea4fd3f1619bd1966d8cc44f50c0c470dfb7

SHA256
95e7a1ee13913d8232998e62e071f427e7b7aeb1166e4fb1fd74c20295184d5f

SHA512
8389623ce8f3871ef70e60520654a05d74dfbf8dfdc224ebab4f0983f3bdbe193631569adf8d381a1a4c7ab510d999d03ffd7b43310e2cdc0103ba27d940dd9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fa534c7ece5ef0f8c6a11e1e03b310e

SHA1
babfe396c8b82a6a5e2f03022f5cefce9b169532

SHA256
bc5bca790c7288d43f66af06c0f4efa20968f7f5c7b6c1ee3de31506e3c9724e

SHA512
7d618e7a84d44aae205b7b5c837b26a4865375f7cd18842274cbc88241fc7a273e7ef1c29ea2d290e480ddf1b17cbcc81560a1b29300fd51cc120b48f7b859e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69e75628a150b59011ca67adbf47f792

SHA1
6ac3bec3d1ef9d8ae1abb54ad19e402f626db5d4

SHA256
1ebab2c6657d1277ddbdfeb5a337c915843a86a212429849c7b0b6ab4c8b6366

SHA512
2c76763d2e3a5e3b037294b3305c5d39615e13ad247d24d1699ad44d7956d2ea4670f6cf2728d4c7f8df0291d5c96a963fbd8be5cc0dcf61199d41fd396b4690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45d893b792d4562e69da2cd58f721416

SHA1
2516dc2e9f04469728b5de32b8a4673361870717

SHA256
e984c8ac04f3a752738f90f67f2d23cf51d0acf9704ebe54cd3bfad0ac89ffd4

SHA512
dd4c04b12da86019f624c1360e2001c296dbcc5b06def08aee2c2578e010114c62d562f6e3d60e6e7b3fc87193b1f3f0ac7becf0c39084070ccc8ce41e32c943

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC90.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD2F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit