27a1affa92c3d0db90d3336b05101a6a739482eebd5337870815994bb10ea10e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 06:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b222ccd64fde137202e905c312c90eeb_JaffaCakes118.html
Size

27KB
MD5

b222ccd64fde137202e905c312c90eeb
SHA1

2f9bb09c8b1e5b6121887ab32e778dcd16fe9ff8
SHA256

27a1affa92c3d0db90d3336b05101a6a739482eebd5337870815994bb10ea10e
SHA512

53690daf48a88c50f0947a3d0b9944f5a208e540b50eea67ace7858f3974cca1a6c22fb2ce22c17fc636b4f31b6b4533739fda564cfb764a8266a1060106112e
SSDEEP

192:uwzgb5nc6nQjxn5Q/7nQieqNnYnQOkEntFBnQTbn9nQ9eY+m6ul+sQl7MBKqnYnx:hQ/AV2g+nSIj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424681307"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F2B91D21-2BA9-11EF-A0E1-D2ACEE0A983D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
352	iexplore.exe
352	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 352 wrote to memory of 3036	352	iexplore.exe	28
PID 352 wrote to memory of 3036	352	iexplore.exe	28
PID 352 wrote to memory of 3036	352	iexplore.exe	28
PID 352 wrote to memory of 3036	352	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b222ccd64fde137202e905c312c90eeb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:352 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94aa2c91e4db3b371241acbda1173648

SHA1
c97cdf876062da38c33c1ae3c088f69b9d124c37

SHA256
82b455dbea4dea54b44e28f7fa908f9dc07963333dd1050f51e491e89a22785e

SHA512
6f237cf70feae03e21cb93bb9e9742e67ed2e331181341c40738cc768680ffdbb1616a310e7533fef83f9e0b3e9539b876152c56a837c6c23bd8b77b5560ee41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2d44351b92eaf23f41354b83dad2593

SHA1
d8c2cfc12af0b2e32ae48a588418700625cc3af6

SHA256
fa3d1eaaa1aa54d45ab1a6af9a215c19b1278b73dfba4037f6d96cfe266d135a

SHA512
b727d8184ef10b6ddcec9124b8e44c85118030b1c36313815094fee543e84d7d99556be9b26d4c75775434f39fff30d3475fa2d20112728971a679c9af7b5600

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ef80bee05c6baa4e854ed221eb336e1

SHA1
32518fdcebf2604da806bbc95a05032382a2b9af

SHA256
c1a0332eba6517b063802cb9c0c52520fbf8496d258300f3fbfa8fc0263454d0

SHA512
d57f245124a69cddb0223ba0b64bbe380ca7ff0d61650b41dfe96ce42bf9ed9bc043f41da3d2b4f7dd677f53908f725244ba2056a3df355fef4a16e30ea74826

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a56d0d42597cc4ad4da3aeca31dbb23

SHA1
5d814978ad973b8dbd133e1aca3e7c9813808dcb

SHA256
e2034ebd64d560541f3fd703398f1213ff7118263ceddfbb88e686afe4b0cec3

SHA512
87f77d5f98378c4e24f80a06fef00cc87695617a7175e0e9ec2b035434273e6b179d2fbdf8d664c1e566e86ed14fd517657c236ea89ba36cd8739d2161018977

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
303cbc05a29c3fd760626fc63431c420

SHA1
d56d6dea0f09e95b41b66ded06362691cf023445

SHA256
7662d070c57644dc53f13527fdfeb8e5b76817846df936bac459666c7ba63bd8

SHA512
208d4b690154911cbea35ac1b8050f3d7921a1f430496f4cd1d84dd20eb2e3f09ad38e604f730e4e96220113a3bb4bc60daccc7b7ebcc04282f2523e46abafa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
118bd979cb7a3a229a2881f6c2a5df1a

SHA1
6b4ce7dcc7a608f3fe82ad21941d8e305e669583

SHA256
50977b4c52287bdbdc3283f27f6e2cdd3ad310d79bb342619f30232ed9dcc8c6

SHA512
e2bad0948b5b0bcaa48bb0c814c08e232a9f00a5d840577535b0ef90cca9e8b197956f842a2e3cb947ff954b2f2a3271e1307a429f0ee204e352af219232e5cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32a6db5e19c525b91b66649a3b8b1fea

SHA1
9b93c95b32023a5c5f03203c92f73bd80013cc73

SHA256
e0f5c39491e049d7cb93ef111b8ff1daea237d79ebb140c983e2a08fb8681754

SHA512
ec40a33cf1827e7d9c5ad6351bc066d66911132747f2a4f77d4490b590a9b43f30c010351b3e4e940c46b87b5e70c09bc522c0494c0c40697fca463ac8482f3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d262495afe6f34480c10084d6aebb41a

SHA1
d5e3d12d614dc064c86516ec8397345166e9b17d

SHA256
d58535045ad609544c19a733be8f1cb24eea652b291d68970e18a94e6ed3a9ec

SHA512
84c76ad32b1c6131d9cd26ffe4c38cda871a2ae42e6e9ed199190ee25c8f1051eebd8ad4845e41836394211466661757867cae1c3a3c6d9cce1804151a23296e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67a69d046ac456b7575be7e05fd7b9b7

SHA1
6e93c7de4c7c237d0a38f3784c5fc2fff1e74a3f

SHA256
cac2aa2194e63704cb0f20117e3bc097d01ec4d6c1034cd7c08adff84a815c1e

SHA512
04cbbcdcfb49ffd9cb2f934c65c6a4f966f00bd2af2f1bc0bff67e8b6476d1813a1246d1e2f5ddcbec072bb4fd0c801031380dca948f699a9eb5b6e22534e5cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBB4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC55.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit