a09d2f37ecd2be87bc934b5f3226afac3130ee9eb4b25b56f749bed4ab6ded3d

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b24006e57cf1dbb34506d132ca6b69ed_JaffaCakes118.html
Size

27KB
MD5

b24006e57cf1dbb34506d132ca6b69ed
SHA1

9b13ca08f8c48b2d1d8c9478c6864b2ccdcf7817
SHA256

a09d2f37ecd2be87bc934b5f3226afac3130ee9eb4b25b56f749bed4ab6ded3d
SHA512

51f1ebee2b64e6545079ce44debe8c83792d0e046214ce07f3817b967a8d07cdf50bb51f4392e49018049d379981c54ca9e909ce3d026abb81b9560440e06452
SSDEEP

192:uwbsb5ndinQjxn5Q/MnQievNnSnQOkEntsunQTbnFnQ9eXbm6lXZrQl7MBPqnYnl:0Q/kStlZySFmW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424683069"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0CF3F851-2BAE-11EF-BCC0-5E4DB530A215} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2952	iexplore.exe
2952	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2604	2952	iexplore.exe	28
PID 2952 wrote to memory of 2604	2952	iexplore.exe	28
PID 2952 wrote to memory of 2604	2952	iexplore.exe	28
PID 2952 wrote to memory of 2604	2952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b24006e57cf1dbb34506d132ca6b69ed_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aacadc8646847d5a297fdf67e6d08c97

SHA1
7c39c25afdf5b82f2ab155f10d974f6ff6340d7f

SHA256
c81bf0ffb02bc42da06e05e96eaead860bd04926adbbd389c2c1467fdca20c30

SHA512
a17cc4b6a4b94f69b30b76d526570b16a10ef565affd4b8785b672da858e5db7ef1f839dba95944db2a954685fb6c3df42e45383d97c0b9547f18376e71e9696

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60f0099d2af586899c482e6272f56168

SHA1
b199be368901eb5dcf132a9c3728f497c548700b

SHA256
0faa1ca8c56eed92301b85df8e5d41dff7f91eb95f1e68a9db17a9d24500fcdf

SHA512
6b7e0a2cd8a2b9533f22b8897176de4c3c7375bc2291e95ab8eab5b283b671ea864187fa2ccac4c95ca3db292a0df082e5f8b758be6087ac134457950fd7856d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3041e1d3deedda70df703db96678978

SHA1
3a13aa2a6daa22f294686b4d37a711722715daed

SHA256
ae662826d3212fbd0e61fa6de63ef10b93580c3039048732784994072e2e915b

SHA512
22906c539474644deec784403da5736603e16710a6b409f1e47d787b822eea0807a83a2298f9fe7d67590e936f6056f84e52302cf7ec671b1eee8ec2575cc00c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98c9d2282fcc27047a5c2408e226de3d

SHA1
cea94c2b3d0181930c8d49ae763b97541b8eb2ed

SHA256
a8792b05699876e6be47792003daa4af62e7cae6f6cd34aa0b852d3d2686b5df

SHA512
cad41312ac837227e1903d45e68580eb5ee9d68550dfbf327d996152302129e33fc8cc12f6ae6e0884cecfc11980189644cd7dc071fd8cafcefc13d85a3f11ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be5dccb30d93f59a03ad38a4011605be

SHA1
01a74c2d9e911c7aa991358abda291e61f33b350

SHA256
ac447902d0a8075330db4567c8d5fe31d16c7ace6023e852af23702e23e794d5

SHA512
1ce972812eede70175fb1ee621c93f8a82504a1faa2d4beb935103dc9ce957374462e6592a3b3e409ba9959d4151803e4280341fcf1becea0fc9334b04864383

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6403d2a0d8f9aa8129da379a04cf42b8

SHA1
ad79e99576082c65690fd976584dc045af72a56a

SHA256
3add72b1a8a9d0762e052986f47982c4b0992b4b89a86386f3ab351d7fb0f4f6

SHA512
c186fe14dc20b4a9f374d5bb2e8e02ab2edb6fb5a4edc894312996b48bc505886af50fab2c452a5cdd39a1d037f1e91aa48f132f64d82b4f8f6b111f0feef045

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
885c55a1c9a63a49425d574b6782d00a

SHA1
39476bedb666e394ed9126a2b0abdbc9a1778168

SHA256
0e35e77e0461c0995d11219e98cb28e3ca385d2338fb848996deccdfdbea0a23

SHA512
aafbd66798f2fd47643deb1ce7e978cab81128be945c695335197ecc1ee774916c71f366bd573d8f4b83d38a81d90af892883ede81e31f29aeaa33e113a92271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6586bff9024920e96a341b2afdfb4bc8

SHA1
11bcd5d5c0a543e7302c43a3b2373e31f24d3abd

SHA256
01bfdb87f341fc030842c7865b45706bb421be0c34f6a7e109fcb8a83bad6015

SHA512
1323b2c79a39bf1e7658e0a72983b6f98776322f53e88e2ec7875ec82515990fc4fab5368fb80b2288b3a40929258a25a756878daf64eff2cfc17cd16bf1c757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb161745ad9907fbf2312d15a8d6e5b8

SHA1
e8f2e98120362eb282cc454c479d1b8213e089c5

SHA256
125d17387f6aa38458e6bea311c1d7adfe8b3950c3471b9464d42acae0a88000

SHA512
881a3e20879229cdd1a10105e913f54c7cc24d15f6712546557107d6f715766eeda12881dbc2170a4a6ec8704b23ae75cab9847a57ccda48c6f48df274383086

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1FB1.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2075.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit