f9010c71970ccbe6edd852d4e08df301af4e59b3c77edfb2ce7185ba38e21135

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2d91b09a941c898ffc9c13db388c78d_JaffaCakes118.html
Size

28KB
MD5

b2d91b09a941c898ffc9c13db388c78d
SHA1

bf9c8a03d8a523ea99aeee6cd0ea06bdd28eaef5
SHA256

f9010c71970ccbe6edd852d4e08df301af4e59b3c77edfb2ce7185ba38e21135
SHA512

a61d42dbf279c56b08cc5c9d12af60d57b0d25eb47bdc692c37c586a947a821af3aea3ff1367e4077706a25c3babce06e0d3f978f8c597c58b0b4f12ca774984
SSDEEP

192:uwL0b5nIj2SnQjxn5Q/OnQieFNnVmInQOkEnt2AnQTbnNnQ9eVNm64D5xM3mpQlo:kQ/z583W5xM3PS5SQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424692934"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{041E3171-2BC5-11EF-AC4C-424EC277AA72} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 3056	2140	iexplore.exe	28
PID 2140 wrote to memory of 3056	2140	iexplore.exe	28
PID 2140 wrote to memory of 3056	2140	iexplore.exe	28
PID 2140 wrote to memory of 3056	2140	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b2d91b09a941c898ffc9c13db388c78d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0e514d8b323489aab66cd6e95650852

SHA1
edb26312a151ee544cab51eae1bb425694ee917e

SHA256
5c5d38591ecb3b029b7b372e4c884c8e0cf928cc6a3cc20ab65ba45bda424083

SHA512
b2076342d8b19da9dd3134437a7fa82e90b97a6604864ef4fd0ed86f16583fc202cb1a3c43ef78b47c2e154d036e1fb9d703c42e96cd9ea6118f271b0a79760b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57f822efcfb5e730b0ad0eab8c8bbc55

SHA1
2df9783b2255e84ccdb92e9bfbe6981ea8939163

SHA256
139de8d16b7225f42e7f56241ffdc10a506d484e63ff72c38e75fb7b22aae94a

SHA512
9f5705cdb6b4f781275db4235673b64fdbf78cc21ee12a29615594989ca7c3a4c03bf6238c606f3fe0e4bb5df1e4b6ee220309bd913a21e27d9859f952f6e2a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fabaa1e3ce772da3f0f9328a0af037e

SHA1
c0fbcb90961f5b679102b498e685b70c74afdcea

SHA256
7e841ba2a08c8109156b4ea360845df978a811ed3ae98d387dd31c32dec1f4ba

SHA512
9e86fa062bc79daefee7fb14b96f85c733113c2a1183bedac85e7639ce2f6047b21aee21d43043b25bfd3045ccb7d2ed278179e1e1683a0e42d698d493a58d79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6b9827d683bd6d94dfad4f4c5821f18

SHA1
2751841498d0fe0c2da0b561906df6c406268c38

SHA256
278823fd84c5580c3ad09c27b294754bb6be2011fd02167ab2ed0f46ec3bea88

SHA512
7b5c8157a6432a0a8ad072cf94d19cea83787bae41e990fa2ec87e0e69aacf58c774b31ab516e4cd2b0a768c25baf99a27f2dc51e3197ee9dbba6ed5c0afcabd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1af6a064ce08303b989b1e7fbf625fd

SHA1
14ae4dc316d84d8515054f77f8d74cf20d262c0d

SHA256
65f9388bee21789dd9b4e815f2d9b75df728c2e42931a7f8e8c0466cbfd9d216

SHA512
c985bc2d5f6fefbe9e7c207b28ac7bd7ef9708b6c10d27e9377d9a7063a39bd651ff804dea07f564751375525b67a6abcbf90baf390b92769562c9680b8e18ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f0f050bca4564ee53436b33a74bf2a2

SHA1
08990bdfaf2196d1442facd58839162d76f811af

SHA256
9664e8d643fa3a3d02a675bf0143f6a336332490c5f21e889cb7562190e0dda9

SHA512
78a330fb6a55108c513eac8c81195e71dbdcc3422358a22883c1880e7bcaa0dfd857cd6e5c1f24bfb279ded23afc8b7bfc791276ecb9b0fbb9b5986edb4f2efe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
631e625bc6fcbd9fd24253b07291d727

SHA1
f58eb13a2e7de2a5020d4d351869e87820c9385f

SHA256
57aa16ebae40ffc17b4ecc9e4f053a4b744e06303b04955350c72ebea810bfa6

SHA512
175432a83ec5655a9138154fff65501f2427935a2b3a2f49b54906ff97cb4b8218070ab60a8281eb1ad9b0f36bd95887e4b7c1cdfacb3254034fca1b6bc4efb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c30c06258f3b037e44b55db5640c47d

SHA1
67c92cd63dac84973225405cfa3b5fd743362d64

SHA256
31741df9fa5cf816aeada9eb7c1b0b6ea8ae0faa1c28b9c2f5315c7a391d58d5

SHA512
f81ab427b3ed46222a0ba0591b40ab617046e5a6bdddc0935ac59d4fff1d88e36ff630bbb7fe1eb2c51c2b9128acc2b2f2cdc69568a90fa4c8c332ca1e97cca9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ace62c5497db70b97af7c5d8bbdfe38

SHA1
810ff98f4c6b12be43b391db18d11e6844d2c367

SHA256
8a8a79700b54cb5067ccc8e0d70922e56ede1b8dc68cb63505a63ed6ac7a1beb

SHA512
7196bd64ffee1c6f045546871db1beeaa41b0af6ab589aeb32e36fa0b4264f828821a9557e9e9a6c7cf75e558bd592e00f94d6fc9e15e00d77b6838cb0ee3e01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5EB5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F35.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit