e7ca399e211643c988d92fca4b2fae730c96cfd4257d66c282d5a01779b688d3

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 05:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1fc56247bc7fd34d87c8514a006eb71_JaffaCakes118.html
Size

18KB
MD5

b1fc56247bc7fd34d87c8514a006eb71
SHA1

d84f0bcd96b626dee9f45f80e2865b690a2f1f1d
SHA256

e7ca399e211643c988d92fca4b2fae730c96cfd4257d66c282d5a01779b688d3
SHA512

2e2e15e9fee5b5502f5d1122f6561a3bae607bd0b7149b240e5d278ed6c15396c30008068e0eb7b1f5525de4006f485a32e15512c8af7086c6fbac92030573f2
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIW40zUnjBhg682qDB8:SIMd0I5nvHfsvg5xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424678797"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1AA65CE1-2BA4-11EF-AB41-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2980	2276	iexplore.exe	28
PID 2276 wrote to memory of 2980	2276	iexplore.exe	28
PID 2276 wrote to memory of 2980	2276	iexplore.exe	28
PID 2276 wrote to memory of 2980	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b1fc56247bc7fd34d87c8514a006eb71_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d76d77d1deffd827f99aeba297881bdc

SHA1
53f227f555b19740230377e3d1d32a64b3b736db

SHA256
34a88dc4821d69cba963f1a08d3f8903501436580cb6a79184e4f0a54559e3f8

SHA512
9ee4099805e4431a189fa79d4bec37a0e74e304101bbfc2013f0d5508989c2f053de47ef57a7751dccccbfd24d4d03b6b14b833209928484d473fd8fa3f29dd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eba056eb6da4f76a836a569b1f1b8417

SHA1
3391893209408931eeb263ae88d59c88f4b4c01c

SHA256
4a2a0c24216e989379ae0546fc9b12350d29580c1b7b459176f70eac5c3b5ebd

SHA512
72dcc14bd9e3bc8a98c751fc9e06b4cdd9a62b249f955f9915ef1c576523e8e3640895d3c1997130fe1eeabe1430ef019f704c79dcf6c82790c4bc0a292da510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aba6f0f9eb3ffb7849f1d49b119cdd36

SHA1
34ef703ff6c5022547e1943cadae28969d5b7d3e

SHA256
f66b5ea3f464920d4cbb4c1d90c89889661a33627f4b3e05d0737c0f59f1b63c

SHA512
1ae7e4f228052b995e969f221934f61bb26c7d455feb190918f8e91524f8caa6ee2c394a130b6990b6e6da383b6909f3e1fe1659e23943596e9dbf8ae665752d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b7e0bf530efa7600f9073ebd68219f2

SHA1
65d763b01fc610ed3697801f7080f42edeaa2872

SHA256
f2edad1f0c405a0c75dd7760d392cd71df40859a5d2a240b5a04c5266df2e687

SHA512
9fbaaba8e5640052a5e6be162aaba9aae007ca5fc24655f0a61da0d3384f713e8a8098afe1f60519bd68c19b0f4408643fc170a949b4fe4eb8b21b6bec9eec28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a78a7073fe38490c8ef810d6d6cebdb1

SHA1
723ad77d662181722b2712d12d89960bc1b4f505

SHA256
4eae6eae449938a94094606ca0a35eebe49e0576df90ba789c47eafcd1359692

SHA512
1b1d7ce1d3eeece764ffba8701cf6292223d2f63478d528ceaca0a685270ac61c20ba53a19dcfd01d927f538071fd030a3d05e53a2776114c8982d8187cf72e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
703ca42e6c3eb6106344b004576a140e

SHA1
1dd395abbf5b3f567e727766a837f49c78df87f9

SHA256
6bd1ad1bdd7f08bb348a593b73b618255792329fd096a049748130783f2af37f

SHA512
8c5cfea6e8d84621407ca60aa02f4629d69f1fef8ba762717ec06f098ec330cf322e2ea4fca7fe76aed38d1f398104ac6a8e482dd344fb4befa9d972bbc68bc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5369eb8f6d44fb645ce5af9a31e00070

SHA1
03ebe7ea3ab4db5f8da334fe201f009b15d2f74e

SHA256
291b575b3e72a3de98eb11a89834116a5dddad6e1a7575ea34ad5729dd058e3e

SHA512
20dfce42ea3801f518c27e10be4755b965ae2befe27e93df5501440f4e624842706493d1162340b90aa78433ff3b0018fb623cd27c58e75f8077e02dd7ff718f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab318bd15969b7b8708d68f7faeef25c

SHA1
ff7d63f318300a1362b8f9b0d7f397274a242f6f

SHA256
a9484cf12599bada573d5c2111b862788b1db279d41f4e44c3bd02cbfdfb01cf

SHA512
84332726d9bb4cf0e29caca05b951ceaf4df309fba005fb89b60274ddb9e844bba94f7d1921b0cd14057a605c77ff1d5c980068ae0e43b76d14aa5f026d21057

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0b35bf568713fea45e61b4e20229f1f

SHA1
5a872aab11dd27de0c95d66d5ae297a765bad557

SHA256
b9a8919ff5d1c09d600f1c7193005a0e5043c8a535e04a16a22f7d7f921a89d2

SHA512
21390f818e9498021a24a4a94f9ccaaf34974bcc2983e20806b039fd87dbb7fbac6616c9b75273c1b9366361b8ea6cd67b7359ee787a07ef5e62e2e7985b5ce9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCEE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDCF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit