1b929183b62df9cc3321aeefabae1bffe83b4f0c0f4af33964332f594cbbba4a

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2d64c26c7c339f474c2511359d2fbb2_JaffaCakes118.html
Size

27KB
MD5

b2d64c26c7c339f474c2511359d2fbb2
SHA1

548015299ef002331bf7d0101a9bd543af5872cd
SHA256

1b929183b62df9cc3321aeefabae1bffe83b4f0c0f4af33964332f594cbbba4a
SHA512

037341ed63b1d18afbce68f3184c509416834546e3a27c84294310bdf45edf3bb791ed8843ccf31a0143faad01506b0145d8b97f664df57a7082d9c86298b48c
SSDEEP

192:uwjgb5nOunQjxn5Q/ZnQieMNn2Q5nQOkEntbPnQTbnpnQ9eikm6lVQiQl7MBsqnS:3Q/UQlL8TQ1SmN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BBA3B051-2BC4-11EF-A965-CAFA5A0A62FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424692811"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2880	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2880	iexplore.exe
2880	iexplore.exe
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2096	2880	iexplore.exe	28
PID 2880 wrote to memory of 2096	2880	iexplore.exe	28
PID 2880 wrote to memory of 2096	2880	iexplore.exe	28
PID 2880 wrote to memory of 2096	2880	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b2d64c26c7c339f474c2511359d2fbb2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2880 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
416ad2e33e14196a09abdc5cecd35c87

SHA1
67d9eccb8f546957d3b337137d39f3e687bd2d55

SHA256
5de1c8d2528e2e90691f5399e602ab1bc4bdb1990576208e78fcd29878ecb650

SHA512
647a7faf134c9678cf2fde9fadeef0fcd9fb1e61cc0b56be366244c387938cefe8a6362772605f640957a2e4f812c998a2134e1b07d7d9d36673bb5282388084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b6e0e8a18b03085ec4f4c516d69bae5

SHA1
37c2e580d897c51ab3d7d55334515fd271c6a58a

SHA256
3f6ca5ba765348b7db59c5a77f69be4e6a409344fac0ed7c0c7afa88593ce6cb

SHA512
5ee39c0fdba5e9290c884f8b1accc86d2b10c1b347711432c2e1193fba59e2196581d339c73cc7ca1795802892a50c6c972291c604d19604456810044f6a48a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5886090f2f2b7a40c38cfc91737b171

SHA1
872f179fb50933c9aa8a9a6b11e8d869c5b3692e

SHA256
9320804ab0b7e88176e8148a93105d15a9ee8844a55c3eac2bef9acff8c821c3

SHA512
29ffdf5bb2f385e4f88e07050accb463e6ed5f55bfbf220672269bc70df669f15e4ea3cba3ddb802ac3bfff6065ae8dca5719e4ee2c60fff3dad54bdb9f7da50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f172308f2e49fcc6fb3c49ee9b3b318

SHA1
fe0cf60163e8d574aaeeb3bad9e5a204d7fae974

SHA256
80d07e36154f20d229775e653bbb50f616db24c4837c812f846618692cd40cd1

SHA512
ab7dc889c458f7b22f570ddc0905f63fa397311bd4625c9628878ccca03dbb764833d22d6eb0795346c8b871df88036639ab590fc4ce09afb1c121ac3111dff4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3d889257e808c2bff3bb322edd1fe24

SHA1
9a8e277ac4fa32302696fe23318af265217b4e99

SHA256
a70a93f0a41b5e835d9ebea853624a3f24b65c0b8adfdd3e661e266ffb1829a8

SHA512
884c850ec3987809be5f3a30c2cd581fdee400a7cb5b55fd96c498c59297c266a16f796c1ffc4102179625a62126305f7cf1c5157bb38f2a97f12e847dddeab9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe78244021b4a65492bff16bf2bb4e51

SHA1
cfc2f0208487bfdfba99fc3c5cef7d994c3bf4d5

SHA256
8ce3051cca660d8930ad58395e6becb8007614880dddf21b544cad711681ca0b

SHA512
a532d11dac5b44c79b77df6fb4966652e7a43737e3c2232309f4c8acd2282f486a365ece5f7f599760332824c953b32465c183b73e4960c5442ff8ffce3cb2b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2e165b5d08e139f3c59c7241261d7b1

SHA1
df27aba1563f73d94604f9a6981c4a73c08ebb80

SHA256
0a4561c3ddc806c3ea77299d8781a273d53b0110d6e2e0509b2c34b20e7ea279

SHA512
26bdcb7b36956a747364d003c6d0778c071183f8a3794bd14e974c6a7fb104699f327871e2494f65f002b9c6352d7df31fce2b297ac41353f3bdc2a36cb6246b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d97259e8b62461b6937f6599d4ab84d

SHA1
167a4e9073a8b7695dc6617ecdaede8b8778a6fa

SHA256
b5273d593d0ab68c2e588246ae837b49c9b018160d9868c0db466a63dfafc36a

SHA512
50b00f881c8ba5820507412f2a4a86462c55ec9242564c290758e36209aaa73b207d559e5d8db1863bfaaabf7adfbc56a1e63f388579a7c1001c1437398cef1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C2A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D1B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit