eff9f34b5fd644a2281c7a901b24c4e6b3887fcd0ba7b64e950e9828f5247d2e

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 08:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b296d4f2cd541e73423831c06abce209_JaffaCakes118.html
Size

23KB
MD5

b296d4f2cd541e73423831c06abce209
SHA1

454b564d1c7d25a4f041497decad00a392ec502a
SHA256

eff9f34b5fd644a2281c7a901b24c4e6b3887fcd0ba7b64e950e9828f5247d2e
SHA512

b703eb617644a1af59feb6cea07318dd74a4510f7f7896e0a4699a15f5998f37a476e884119bf21f1ab66dd660c20ffd46f1e80b2c483e0fb363ec7e1967c37f
SSDEEP

192:uW3Mb5nTenQjxn5Q/anQiehNninQOkEntOEnQTbnJnQnCnQttwMBBqnYnQ7tnRG+:6Q/6zNI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424688764"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4EBEBB01-2BBB-11EF-9684-CE8752B95906} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2276	2240	iexplore.exe	28
PID 2240 wrote to memory of 2276	2240	iexplore.exe	28
PID 2240 wrote to memory of 2276	2240	iexplore.exe	28
PID 2240 wrote to memory of 2276	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b296d4f2cd541e73423831c06abce209_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e6e33a55be96a066059bfac75e15c8b

SHA1
02b2e463472e4a8ab13b01bb7aaf5ac3c7b4f8d1

SHA256
82259e196a808d2c32e774317c87fcddbba5390da9e90dfa33747087b30aa5f6

SHA512
b0676a4aec0eca12b4cb0b18ad0ba063b327af74d6c3d13eb0054d824ce184f11e93e8e7a55c2e356df87495e3c5fe8c5364126fd73e9fb0adf5c2c53d2e70fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0a298c4e438ed2b4ec1e1a3e8a269aa

SHA1
b50b8e628acb903ec3b1163470d5066324f7eb61

SHA256
aa88e8347c4f597c9d7bb1419ac43f651b8fcc398fa8b966e1f078f127063ab7

SHA512
a99d457531265bddb31ad734f8ed45ec071104681a22215998e211928e247a08664a54512d9558d8eb6ec223e2111a692f373352cff079e64383fd5da96c8b7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b509261a0d425045925de0c842310ab

SHA1
9923e8891fcf16ba2a72debed0f8101a9ff96974

SHA256
ca7fc0450af161e8f1b216ec27bb5cd4851d07b8412350bc06c47c81b1c9623c

SHA512
46cfcaa658feb3dbc30b4df5f14292821db1fb18f7123fb5aeee5df56faf2be96479144e34e7b6b162ffd2171e9a64c4825427505ace4a735f8d77d51326b756

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e914d0afc01fe38a7fdb96fcbcdfc8bf

SHA1
2c857a722ca63ac19a9fceb5ee96aeafa7126f7b

SHA256
d8beb304e0016545092875b8f710ff95d97fde1c70b77b703c56d269066aacb0

SHA512
3f34853320a7ab3aede63d8350e69516650ae3e9140c9be295d49854bb52ff1d70005dba1a2f51bfbb98c9d0d13e7ccd096fdd5ced2ffa920fa48fe934c6d00d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4768a569f17ee502ec2b430ca3842f5

SHA1
f71ae29d45492c9c4a685a23f29b13d6e6384c58

SHA256
9a209860028b947e482fb4c5b21131c7d7d89a8728639037235da1ef948b3876

SHA512
0938fc11101e701cb2e4cdecf7eee1dc936212fd50f7413085965ad76e2e335e96b76a52806e7ae359fdd3bbbe8398fe4b14ab6d4a7909e03be1c8a83174fa5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
264deee7d42e751008254afba6d26038

SHA1
d06fdd72ef10cdbac605e34cbd845d68645526fd

SHA256
5ffe467f25555217829d93a9fcc4de4a319bf5a474fd5d870e11cba511d4fcb6

SHA512
008eb790ca6edc40bd15ec8203e953ebff1e6fb62b3979015748398e97a47f36a9de86824a884a50e138366121cb1da99bd47ea70818c1d24f594cc9082b9ba4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5748c7041c15947bfb89063241d4a0dd

SHA1
1cfe445593f0bd53d0228619193520aef4148d77

SHA256
dc96fd43ebb666089df14724cdeee7e73421415139797e28994cec43f23b0776

SHA512
3d5edb59219ef5538c2ed272057d4bdcc50b4cfc48897332602c5482fbb58ec3b2b497770c5d1e42685e3796493e745652344ac59a3f71829d375f294a3b4f8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
597381db1b72ac1e80dc70aa71c877c0

SHA1
121a4e28ab2d1f6b761c9d9110a69440c6d6a706

SHA256
b8dbb2d92b360b08ab955cc281e6954a272f322fb386867ad25d25a2b45f7820

SHA512
35c87c1174746e0357bf990baa20548d41cc0a88d9f319a3c6d8cf283c233a463e354d2399288730b943ff41f24118bde9c87da740c7fda154205f4416e4db44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b366f49ddfc0b4479f63c17f8188768e

SHA1
cd556c79b857cf44587f9b67f4fd0ebb06f2ed54

SHA256
0b57642bbdea242456e25812ad045787f7514364d75183478f4f9ade871f4a25

SHA512
3d22165bda133ab493c03bd311b8d67af4010981a37879771df2e381648bbf7c1b78814ee0938e565468569fe30aabeaf0ea6da89d124a24ec5607c33bed3087

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C5A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8D28.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit