b635b625c52be94b71e9053b1cc27498b7ec91e9ecc20b7343fabc6c68038528

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b2e44fe44bb65116fb77e6c9408e3c5c_JaffaCakes118.html
Size

42KB
MD5

b2e44fe44bb65116fb77e6c9408e3c5c
SHA1

451db1152eed63c05bbfa11916fbcccd935977fc
SHA256

b635b625c52be94b71e9053b1cc27498b7ec91e9ecc20b7343fabc6c68038528
SHA512

a4bf159284392ac90f12c0cd972a053209ae419fde3d3e2a43ba4c29dfe80b536f76c0ffe82492634b6e344eeaf2cedccbeb46f07ce6d9696f80af99f51c7ee8
SSDEEP

384:fQ/YIx0QKShxZ+FOuXmWI1RmP84gf5KwUMZpiS+GdoxQ:rNkjxjka

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BAFB6FB1-2BC6-11EF-B98D-FE0070C7CB2B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424693670"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2436	iexplore.exe
2436	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2996	2436	iexplore.exe	28
PID 2436 wrote to memory of 2996	2436	iexplore.exe	28
PID 2436 wrote to memory of 2996	2436	iexplore.exe	28
PID 2436 wrote to memory of 2996	2436	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b2e44fe44bb65116fb77e6c9408e3c5c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d8f9688a8ec569e06554d4e1f15f67d

SHA1
156480974f4532fc2ef1f3d71be9851d546b277a

SHA256
60b1c845cacc2b44a5d364a2f63cfec6e62c953298e939f8ac79d88f0bca006b

SHA512
6c4441c2ad0d2e4ee396b7b4bf08441dbb79ab48aed56f3448c8dc678ec8445b85dfe2d12bb4bec090c2e560bea5a16bba40d4e6387e58faea5baf61a5ebac48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
778df4294a73a4bee28f5c811d1e8c3d

SHA1
b8bcdff1ffe29c2ac747421ddc4069b62ae347f9

SHA256
7a7d664d71a2c8292191634b6e804d1ffd4959f3cb5f8698b2ff0563391c3499

SHA512
01f98135fc9023851aefcfb78a6939cc9101fee94e7331f152f021f3339e65d398cab9ba3abe791d93caa4d096d9faee722a87e8bb70f4a5def263654ae4d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c171216dddc048fd0da2cd4d2d61a78

SHA1
3bb9a6468c7dd6e5b2ece0d5b545b4365f5c346e

SHA256
fce3cae85b934bfd4520f13048c11dbb27de3024035c884a3ba9264ed90096fe

SHA512
3abf9e9a3f0a7e4c3464fa94222cab2122ee525f4d05f4ef14c8d969345890c621c31937c03efe26054f6109a9d6ad7a505adf1800ad4dcc041be26f4061247f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b014776e48e440722952c1dcac117c07

SHA1
d64ea180eb56eded2a78ca037be347d20af2ed51

SHA256
59b5df06e32135c2b22cfdaa31dd77975c40d557c5e7786d8b70003c21bbf159

SHA512
9c775d363721d215dcf89174c9a5736005845e1ee557f319d2f0616e36e26b851e386912a78e97628f23c5edc7879f2a470b6ec8ac6798fc4c21cd1012786c75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fac40c4d1b25bc9b8131b1253fd691c0

SHA1
832b53df99ef43f38879d18adf7d3939063866f0

SHA256
9b7ea5ecaabc646cbd64a1baada90fcea5796d1674a1578e0adea69552969afd

SHA512
8db850f49c1a529d84c8aadb2b82db21bdfb619f94c0c8d769141f4a4796b35b0037659178a80355698e09eadfe1ba4fb98a99e9f1888f192d14e13d4eefc1e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b3466ccf2074afca04238469c996a8a

SHA1
e8ba560fc21436bb388b41c6f61f3eb70dcd38e3

SHA256
4bd4d82141cff5a6ea3644f6f5678467081d029c9f7e7d328ddb6412fbd77d60

SHA512
fb7cd7d393c156abd03170fc2499e524cc657592b8663ea425486d4af2059cd221c23d17f0a8e046d75fd43f9ca438c1461d11ae97bba332e3ba2b9101e13876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97f2583a8e0db376273c101b1835047c

SHA1
8c9ccff1b4c87be63b222585442e6f00dd85abc2

SHA256
3e563275051dc53d868630f300c375c69b4c6f92acb147778200bffcbd5baac5

SHA512
763546d2cde3d279e37c8444b40772a6dae2638875b3d7d3d8a731861e7cb790ad5c334978b3f4567c0c3942b5a23ec27f396054aa0dd1ef127bd2ed205f7534

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7921ace393b91f8db9443350b249d4d4

SHA1
6cfbe7ca2417653e567c24ae5ff408f23bbe4a1f

SHA256
4e87d54c2d4e5068e1ae3982bdf7735edcde5082580f7df327e84671666ca700

SHA512
8169988f4d9ecd50082a9746a4a6d60339749fec3fd75aa8e273658a4352d8ba75166178ee08c1e8cb785c8f172ba5e098227fb092875e16461460d416d39853

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1319d84d1247da90227dfb6b74f010d4

SHA1
055389203f7247d8b3e63febb09be8a346261fea

SHA256
50707c251f325d453dccfea363dd7c1ae084c85599746ff1b677ef3ca1c0b34d

SHA512
952d9f43fc6d70c70ee7680498382db050ead1eda3adcf6340729b266b681b1ce1728f736de38858a240c2af8d3fc4e9293de29706d67df66339be6534b14cbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab58BD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar599C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit