54c71e4c3bb40ae25346761728a822bba6f18dd4d8142b53e67214bea250f279

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2b8b085882fca5135102bad520fab87_JaffaCakes118.html
Size

26KB
MD5

b2b8b085882fca5135102bad520fab87
SHA1

2376dc58799a3525cd3cf41cec29c01d18015f63
SHA256

54c71e4c3bb40ae25346761728a822bba6f18dd4d8142b53e67214bea250f279
SHA512

df9ceb0ff209ac73ced1dbd2aba721ffe1cc4ecbfec0eb9cba9a237a824344b3aa36da05fb68764683c5d21a77f5fe818f14d5ac2e63f2dce92c3c5e393af6b5
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAILOaKMc4YE08SIP6p1zUnjBhwZI782qDB8:SIMd0I5nvHNsvsVxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424690950"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{666F4C61-2BC0-11EF-91CF-DA79F2D4D836} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1440	iexplore.exe
1440	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2716	1440	iexplore.exe	28
PID 1440 wrote to memory of 2716	1440	iexplore.exe	28
PID 1440 wrote to memory of 2716	1440	iexplore.exe	28
PID 1440 wrote to memory of 2716	1440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b2b8b085882fca5135102bad520fab87_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62bfc8cd7d5613eb5d28cdbe4c9f51d0

SHA1
43a4b5b5288cc451a9fa6f24c2bf090d0489b78e

SHA256
0d538288cd2eb8470515a01b831a9baa2c2b9b620b446331f2e440b8871b9643

SHA512
09119995a293ffcfbe42238093a314c2cf6d3ddd666e739152ca2d6b16ff7c137b24045d5e57e2207b05fabc4b3a41de8c62089a0a1e3108509fcda09d42d4da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
537b0cc6bbd473a755f32031ccaa1ad1

SHA1
b7081deb48d32520507139eaf82e040b1db912d1

SHA256
b27a009c201cc794c4e2173fcf44f963f119dd3c49dd2a9be03b8999867b6b4e

SHA512
4b874df03feabf23ee0be4c7487eb74c894ed948b5b2ab8076dc9db43b69066bdaa4e033f11df75e58ecfefeabbd680f10c63f88a1195729945ed57372a15c71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0596f59c273ccdbe9ab2f0b1488ab0a

SHA1
ff0ad564fca74ba251f343398e34d82728fb2b68

SHA256
de2d8556849f4634d7a3b91d7d89c4edd9a5d903bf03ae5aa227913232d07567

SHA512
c689d1c7044ec15ff9e165f6232520e6c822f1b419476485131e68a102d16d86617900a855d2d8e4a697ff5c641f9584db3565270fbf35c50fafec6ce368c9b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe0c7205a932137973a25393374ffeb5

SHA1
1ce83b31500cc82f52f8d6a9530e7e0770c965c4

SHA256
8455c218baf4c9a5a516e5371f617ab78edd0abe427f64da0fca21c84a1bd35a

SHA512
7ccfb30f39a1855d1aae11f3a7fad0ff6f8cb93bad79b7a3bfbf40be034108c485a5b21a99cf40d4f71171fa58e1f703dc2b3493c4bff74ae4a28dfafb958667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eab7c63bf2b48914bc41b0ecad34008c

SHA1
b234341693c89c944edd9d2bbfcc313b966f79e0

SHA256
db70a69fb24cc94179d4df5a27a5146827c08f7f883b29e5d35ba1be52be84e6

SHA512
7ab6af6e9e4ee79bd87b2b069de3209d0d05cf7f4580526c2118b037d2edf64094de7bfd84195a7ed028475a750d396973ce3a3d93d76e53c945efe4a75ed528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a6f75168552655ebb4f535a2562052f

SHA1
0d7df715cb0d0f1cb7cbc28ed5d0b829ad73542a

SHA256
bf0413c298fe6e774de3a85e142aac7845f6016878849848ececaba4b2afac4f

SHA512
81e0a4c642a6d9afddf1778fb563a43a1ea2efa6c0a6991b19dd5d89b9b518d3de03ee435067d7166d9f5ba272eba1359ab96b28f6855246a245542847cbfd00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91f50855bd70aafbdd2d65fd0c3988cb

SHA1
118717ce1c58c5229de93e02651f0f22d449f444

SHA256
200b41e315b7e26a750f9ccc09567ec78c9b9a0e4728ff3ce4bfbe384bd6610d

SHA512
3328faafc0caf1281ecac60ad610194a90bdfc0abe59354f2c52d4eb50c61e556f43070413886bae70004cb35869b0528cd379651be19bd4ff32c9a7ff93d562

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc5a404a3cd5df0fc4ba578a589dee5d

SHA1
5500b3bab24632947aab3343c513b73d92b720d9

SHA256
92fe4c89c9cdfa096a91a81f374363c686dee31c5b348595dafb8d37a4f78ac2

SHA512
9ba78471fe79628ebfa1a500b8cf0f22851f289367b0857880f4123d72e7f01a156f06a59a76b749f4990a85dd7ca2ea581cd3ab06bd64c820fdfc9a1c693e1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1d85273b0b5bbd81130e0c9ad5a892d

SHA1
1a3f70cf17d47eec0c17b5fc5be26dd96d3f334e

SHA256
6a7f808888f2a1580798e9a37fcb94fd2cc6022906515a4eccd66fba3a28129a

SHA512
3c86a35bfb747c7985abc37ee3fdfdec060f765a84bb08caa92862faddc8d915c1445198710559790603f83069012b2b5729adfa11149a709f5b22bf7fb4339a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab14AB.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar154E.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit