d76e3a96adc10f51cbfe717ead6df78dfe72bc4c0d51403fdb7312621d902e87

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2a2a0a380b2b2ae1213a8299764e6b1_JaffaCakes118.html
Size

27KB
MD5

b2a2a0a380b2b2ae1213a8299764e6b1
SHA1

10bf5f997628747e000c4323e896fb015f5b926f
SHA256

d76e3a96adc10f51cbfe717ead6df78dfe72bc4c0d51403fdb7312621d902e87
SHA512

115e9f61a2b6ba5c24435f174b0649dfa2ee8f566bb69f95a0692906915dcac11458b4375e16cc683eabfd096c6653c0a9c8684588bb71f57b3b01cf0355608f
SSDEEP

768:ToWF1cVTuJUOUoTOjX45FezMwpFzgcBfG8ihRqszVzVw+AJwlyDdrFJSUxVnVclq:ToWF1cVTuJUOUoTOjX45FezMwpFzgcBb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424689470"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F39895A1-2BBC-11EF-9684-CE8752B95906} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1120	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1120	iexplore.exe
1120	iexplore.exe
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2328	1120	iexplore.exe	28
PID 1120 wrote to memory of 2328	1120	iexplore.exe	28
PID 1120 wrote to memory of 2328	1120	iexplore.exe	28
PID 1120 wrote to memory of 2328	1120	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b2a2a0a380b2b2ae1213a8299764e6b1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1120 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41edf819758a70c5c453ba82b8ba07dc

SHA1
3bb5e170a59084f882c96ad9667fb1c1fa6c6e7e

SHA256
98fd77d4ada2ed58d31c1ce02b27c9cf094172e1cad94d282661a2c67365c2ec

SHA512
341598661515169fd44ccefb21acce73902c72026a60649de54d641389371f7fd0ab71658d829d38efb50aa9377d2f3a46c233f50cd4a3cd1d67de995ad61a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7122590eebf242f3cfc85a7a5628c403

SHA1
04278c6d2a0ea5ede2e7943644a01d1b266743b5

SHA256
21b158a05ac4cfbe87f60706b539af2c4978caee486c991baaa3a543636a3f51

SHA512
c70e22982903f08ad0141dd1f74065d786f89d5b360369d5f3744110f208dc8884fbba59a0734b2207ba5acfc5911b75d6709770ea78e1e98b690b6ef2426757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7afbb91a763ab955dc6b7538f82799e3

SHA1
77a45a5f9bcb2dffea229e61340a3e205a438b8e

SHA256
4253a0f5736de068681c83aa31aa6179adb061a0609ecc1040ca4e3462dd6229

SHA512
305436d142942c6eea8a03fcf98717a87fb01a09915224b06f22d9d5b4b48692c890f7bbe9511cb81d20bd2718de30ba901396976dfaf6db7bf408b3b98b2fb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f3c05c92708c1c38f166eb3a8e7e394

SHA1
28d9e6e6ec2ded0bb43380be81f4d259d30d5578

SHA256
f7a0eba7014a8b8cfed1fc4efb849ad401ca6f482c915b606daa5344b08970ec

SHA512
31703c40838023c64887dfcbae3896dc0b9a4ec90d258600e4d058ad36a30537f12311db73b003127a647d5ed73fb7b0bc3f52a4f2d9de4c1133b3bb938d75b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79c8d52ef35c754749358ba7c2424ea9

SHA1
04590ec830db31da13769a45d9cfb402c6658a2b

SHA256
01d8e409a0ca191311919b51ae361dc6677cba9b532a95f72e3dac8291b6938b

SHA512
352881d087aeeb47ddf6170bada40bb48a340c34db1a0bd97bcc912752658107f3a1dcb5aabf5f98f8b8a02dd77dd3ff8bf671f003387c4f9989c516604cad23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1155108f82584631acb082a83da98873

SHA1
940efd27c7dc9864f888e79851c8a890f3485965

SHA256
cbdafb67d7bdd7db877bae037c810cd047dcd037851d320e2e1b8f1992690ae7

SHA512
1eb30365e7fc1394dcb8e69abce97ab093fc3ad835e26a697e77f346ef632030978088b3ae8fb448e3edda9a09ecca76ed3e0b5d22f3aa69c7cc0327aaa7033d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1803d7f22c56d71c3bbad54d55c5f75

SHA1
1fc21e37acb793b01e9fd80459528870c502b513

SHA256
4ce54b9fd055c4803b3c33ec26ca48c57ea65e346c5fae5ffb291f1fb7c75a95

SHA512
2365b14ae1cfdb70f114f885c01940b5a8c087d7feed84620b24e5b3087d8f7a0bd4dcaf623a8dd2da82791a33dc31188daa433da408ce30b37c08eb8a69d6e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84d804fa2f169735d4bba0fe3dc4e0b8

SHA1
96ab398c4ffb4bd80ac73f594a5bd8cf2c02e1a4

SHA256
85cbadb4cb6c95fd0cffc1e43a4b3676e7873ac71c1b7deaed28010a4c0ac175

SHA512
7e076b80e69e25d95d1876783af0240e6a416697db87ae6ce1e6906ee17afe717b7ca16461f2c9aa8ba25e195c4aad18ec24f6c96758c9394ea76d51df7835f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61db20d9e9f4ea1154cdd3fbfae08951

SHA1
5220f2183d496f6ef88310c6c6abcc3082294052

SHA256
40b92e2f2e513fbcb9e9d0c4b2d5c56dff768bb0d41d3fcddc473e7378b4b3cd

SHA512
b16bf5b2cabae6d94f1236bc5f52c741539b056a96ed93ff1bb0949188679f630c9671668deaa85d4facfcdc05fb906b180341111a02d57ea7ef11da2b6a9276

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68ed76940ecdf9edb6b6eec89e13e895

SHA1
002cce68ee93f143656cbac0835a6ca98bfcb568

SHA256
ca0ef0c2d1349a322036f278a1d147928505dda445f43d15211afe87b0143960

SHA512
421298570d73fbe96458f30d299966f2094e6df51d66645db4e746cb02d6e975cbc4ddfa6f031fdeaf54474df56b8c1a46927e691378b8c22b04dad2e5aabd4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1040910fcfdd464b64c6403d2bcb88d8

SHA1
e80b2ac292232fbccc2a45feffaf9605b5a71495

SHA256
901bb10f94eea832b58b597bd163c351c77b0f39471486b7ee5e75ea8a40d81c

SHA512
b2dc98a18141acd0d02f7832f6e1e201c7042305b4ba9a5235314d9c084ef47b6be18be3edd070c35cbc36ed17b1b46d97a799ea0e978481af46fdb91d3988bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab939A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9449.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit