8d7d738966d46a6c38b99f70eb9e563015fab62417bb5a189ae4abb1c9edcc16

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b20265a5cc3df0bb833174edd1845148_JaffaCakes118.html
Size

23KB
MD5

b20265a5cc3df0bb833174edd1845148
SHA1

92267c7f802d1a163720b63fb9f43f71759acb7c
SHA256

8d7d738966d46a6c38b99f70eb9e563015fab62417bb5a189ae4abb1c9edcc16
SHA512

6fa1b9ea843c7ca20c9b1ca42e3ced462178cfc7f9367cab02c3b37db3dcadafc83526f9dbcfd6aaa21834b3c2ece805ce3c2f79cc77739eacb9369afbedf28c
SSDEEP

192:uw7tb5nnsxwnQjxn5Q/HnQieWNnXnQOkEnthtnQTbnlnQKdjcvMB2qnYnQ7tnZAD:yQ/G7I

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8724CF1-2BA4-11EF-B1CF-5A791E92BC44} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424679169"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2264	2156	iexplore.exe	28
PID 2156 wrote to memory of 2264	2156	iexplore.exe	28
PID 2156 wrote to memory of 2264	2156	iexplore.exe	28
PID 2156 wrote to memory of 2264	2156	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b20265a5cc3df0bb833174edd1845148_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28de420587087a5c21ec9931d5c04a57

SHA1
0987ebfdbbcbc3171a2ba27952ad9cf3333134d7

SHA256
092975540662f2be726ff2efe04721193da79a998c699c1f6e8a65705fab30b4

SHA512
3154e82073bd28b4b60481379623f83b866b87ca2bc2c88aa2b97936188f68ec062a16985957e74c6f026a1046e6138d39baba8368b054b4ac50ec08d1be0626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
226f771826e05cbaa08993979f14854d

SHA1
9a053b1834293b47b80a6b5d52a42ab0b7e4b283

SHA256
604b328cc8d0600305c66c79bca68d151137b9ad933fb3bfa05f7d5ed3e5cb79

SHA512
6b6063b088148149b36a1887c37a1ce8edd93b656375b2c9eb1841dcc938435c5a7fbeeab92981fbebcdadd5c035f4949ee2c4d9b1adb2c26f90f9d1c017ebe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87215cd883510d3d5cab5682dcc9641a

SHA1
c348791f36da70872ecc9b053b4f9d5844781b0e

SHA256
b71601735bbe04c35a42c46a0025b10888dbd3fe3cb0dbcdecf803b5e7e2c57c

SHA512
ab42462c5200d85b5847808f4708c15d0271ef7dfa476cd2b09ee787037246c457c99b08bde7c97e1b9d4faf7215bc225d28b53e160d6054e0ea4d460cd5dd47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
021eb9e385d2aecace6293989fe8906a

SHA1
311f4984e5035f8d8195643cf241c20be4129b6c

SHA256
0bd34b76a43dc740da808de11db1f88af54ab54172b0732774333ca6ad579d71

SHA512
6bb9def95486f5dffd162d3f06d6c07c21ca099374a0db77f516f8cf456c78b78ad2df5c85b1eda7df49326d08976cc032dfbdda858adfa07b9131cb212024bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9119fedc7cc35037f6b169f67e91df5

SHA1
6885ff69c2e5c7bc175fc6a0bce41bbeccc2b0de

SHA256
6b3b391a6411fc2d3d0499960581e7fef8011dc4102d21fdec142bcf13af47e8

SHA512
2b2e4be2d8f8e2a56ae31b3e51eda5ceacff6333246e75f373a42562f327744640f19e510bc24e804feabd46bfca452a0cfed1f7d2064d15d049a15a16e76418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd0583b16c0b87edb81933f5744fd568

SHA1
10b87974380c1b3623c4e171e398b1f1429ee348

SHA256
cb29443175ebb8b5e4fa1f28fb100bde7e97306bc879bb9a5a0f721ed067dc99

SHA512
8710f7a122b7db5ddfd851999b80721048f4f003f7e259bb6cf32e0779463ec1302ca4cfcaf89acc41283bb21d4d1bccea4e0cdb13cd6f974b506415419a766b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a62bb531b229c2b77d4f9c333e71f49c

SHA1
2f5e3a0b46a97eee603bf1fd0e9ca446e9673c59

SHA256
961d8ba5715e8953505dd3b85239243df0adddbf4b632104ea6530bb2ca2e322

SHA512
96e678b4676be255892d6cd8b708bf910b2ef497a16170912d2131ab62d9f42a5ec1c9330e96cddb8513dc066775940a78947a4ab8496d1d07d704c5585ce81d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cb6ad167f2eea69c005140b09277034

SHA1
737c8cbd21a949c9c72b18f8682bb099979ff738

SHA256
8df4f8ed792799e9276461bb3f7a2911f98ca36d08f5d1520d5456e0a5c96bb3

SHA512
ea5b804b746d11109f014ae806ae6f4e3f384fe2ede1b47673445d60714c7f7c9a56636dae287347aa39685a2d3442553955d2bdc0abeb03095432e3933762bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89f88d196c1bb6554285725ceb158bc2

SHA1
a5b11465c9e1cb12a6efc792470b061831e146dd

SHA256
124a0e9b17f598f604e3a17ad0fea89033de5990385632a8d60f66dafb77a702

SHA512
ff4e6d17de91dabb884e1ea5b68a044b44a1672182b5479f53ff074b00878c3574d9b7f56d062a498e490f1bf341ee34e2a148bbd754d0c42e91b11879fd1f11

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F07.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2037.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit