20b04ca620b90173c959038d0307a9a7afe2a5cc140e369b639d8cda6b2556b5

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b39ee5d67b6e8b9c7c28bad417805af4_JaffaCakes118.html
Size

134KB
MD5

b39ee5d67b6e8b9c7c28bad417805af4
SHA1

abbc2c68bdb53642631f126148b52ddaeb5d7925
SHA256

20b04ca620b90173c959038d0307a9a7afe2a5cc140e369b639d8cda6b2556b5
SHA512

97d14e05986d37d90c55964aff3c3433ee9663b7aafad303814805eacd5cd8548e67078ac7f64c37d4a21630f63e9d79d62e2bb2ea5e460ff5bcbab16f8c2cb6
SSDEEP

1536:SnNlb93yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9w:SnjNyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424704470"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000008ffa17ec26a329f8426e485cad36a1fd06aec321ddbc240fa38335ae80b9e463000000000e8000000002000020000000d8f5b9f0a80dd1bf4070e4d69d5d3d364ca11e645957ea9facc9c1ce20e27d8b90000000de1c0321b7097718a2e63e06bb49701bd5bcf7d02d9c9705b8cbd23f7c7d387cecddd983b4a4c4d43c7a9d34748006990f3f757466558d38ce1a9fc08e6fa4dc503f933eac9617b34d9cebca1d5a69a4228f38841f701551987814cb6ba1eab2d545668ddab74a4efe197ea1d1425046ba76f8279b7050fe04862624f57710f7c89c76e487bceecfb6797e9500465a3f40000000d78882ae40c5c613585c107198c1b013548e2672bed27928392ce91b6f0af3be03399d4f9742e8895bc37751a7bc8b0087992f38abea3cb341e6572cf059f683	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c401b5ecbfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000a36b449e08a556efc19512eae4e627694213b091af047b03600c969c947b120d000000000e8000000002000020000000fe2473eedb67fa0407b3cc07acfd75c9baeb3e83a39db2d3aae5036e6ae7a626200000008db396502bcab6b8adff0acb504617296455b75fb0bb8f8481dbd1ceea9765424000000063e5971814aa18009b884007848ee3133fb0716e73c41bb2ee88de795070042d58e404d6b2dca00837f81882d8411158f60b94fa48259a9fd887d0bb8a4712d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF9E94A1-2BDF-11EF-AF9B-7E1039193522} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1176	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1176	iexplore.exe
1176	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 2936	1176	iexplore.exe	28
PID 1176 wrote to memory of 2936	1176	iexplore.exe	28
PID 1176 wrote to memory of 2936	1176	iexplore.exe	28
PID 1176 wrote to memory of 2936	1176	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b39ee5d67b6e8b9c7c28bad417805af4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1176 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bab87e6fccabca3acef019b87dfc54c5

SHA1
1b1d1c426a08db2bbbd0d5adc15875e2ea31a07c

SHA256
c3799aeafa0fbd00d4837db8c9d9cb5dfbc4a84e88dce9a5c1f14007a4ec42bd

SHA512
ee178e08f42ff5d9352a5c5ad07dbb11aaa2457b2f3f8cd51a90e558d46ba6104f663e4358def4d3ad492ea012ab02aee053331cf6e6a1cc585748176bcdec8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57b2a54c65858ca87759b7c2f3d08c11

SHA1
8d17b86f73b214a7e3acd1ebdd8f904e4b963066

SHA256
68ecae933eededc3cb4349903565324749e9bb53fe359ae29f522e24eb8caa48

SHA512
1834924dda5cfd058e384a04fd0a04fbd9a2f3647395ffe4bc2499b2f189a5cbda9d1f69cee5be2b90a86af0354fb472e96e6259e6d874adcaf9b21c875ff100

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67579305f2d1617b4b12846f7e1a4e5c

SHA1
77e288a6f68e2e6743d2eac7447e7f3083851a80

SHA256
5f311eeb843248deece75a46549483dcbc0d21a4a0991191509860550cbb2291

SHA512
7150577aab10288fb0826b9a0bb6a5343faa17bbcce041f470d10a4c1ccb874cf9e13b9999642353fce245949693c002f6da66a68314a02325bc82f310aad680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58dfa644ec81d485b7c49b1461fb7b51

SHA1
4f559d6eaf970236712fbc7a1ef78a77af5fa2e2

SHA256
5d53dadb4d140f4345ffe58ab0d281fb9f00ea5f8314139d63836513c419bc8f

SHA512
496c8efc884aa93ac6bfc7f55de4aad8ecaae8ca5b402fff47b5115f42961b3b8f8ba0dc8f5a2865d5ff6fbc7b0e33c14c8407954d7a5562a491223b48c797a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33ce35f47b7d584cfc092e5d02e011b8

SHA1
92f5edbad14033d36aff045c01fa190db9bb68dd

SHA256
e9ba649968a1126c54f198d931571eb337cbad2c92f4ddbb922d57cb9d225a02

SHA512
25c9318c4534a1ae084746a039fb28fc32b5ac90c6fce2be9ca80d065062b77fcbe3cd3ae65f043e9aadbe961019477ffab7ec4b9cf461509ea6739eea972f93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
654029f2ccbc9c740d129262c40173b5

SHA1
d5047b25a683b9b369188aadd92a917a387409e5

SHA256
eda78c342ef0ea7b0da5240550d05c32033ee94dc0d4435936cf7ddf3b11889f

SHA512
7e582baba9dff8ee52b30f2b101b07d086cb1df758a1503f2adc080c0ec69375514d415c19a4f3fcf1bd6b45009a148f97153e390a9d9c7c291891a57f3546cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1dba7b32dfcfde2f53d5198e28a88ce

SHA1
40c708f1fa905889a9a0490c47f7b711318153d1

SHA256
21a8236350ca23873af07e02033d88393e7805c7690e473fd00d947ee392a0cc

SHA512
acc93e27c9d42ea5943ff12a588774a066d509211aa5e5c5959f910d887900dab50029694a213759018c704ddcbbc3f3de539b3b970a8790adc33cf17b774665

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
065d799c549dcfba1906996a5529d25f

SHA1
813a5162b5a3a472539c3fcc332dc2fb45751cd5

SHA256
6a8d8731bb20d8adc2981493f22d4b7c8e192bea0b155e5f2991affa67210414

SHA512
7f75ab30d04254c1d1f8015d2be6274412a5ded7bf6bbe2185c1d0bb871e0b289595b56fbaa814aa50e5a99188b7aa3bd10b80fe70c8397bd50d6d53d69c6d58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40bd18e169288aaca4ebf98f09170960

SHA1
38463ee064bcd5355d0b279fe9b629e34993ec8c

SHA256
08c0b17c3abff07e77577dac53187ea1c3cbe8a0d9846d53364ffd38ee6256ce

SHA512
fac0e7637ef5d366dd2aa2de31f752a1f6daf882a32f3725b4c9b8726b403e0afb840429871e5fc6e926581d5221db48bc47e875dc75099dda3ee537377da6f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6cfd72703b882428e6f20ade87be4ec

SHA1
a98f6194484edd498bc69124b0be51b7f9e333b3

SHA256
a3e77fdb42de35eb4f382d267f4420042df8c68f509ebb4c53b140951afad538

SHA512
4e7a9522185557e7e5c44e73a56ace01734211903334c9453a257b72125cb5a02bc0014cefeb625e0f31ae437a18666166b290bfc3a0bb79d9cb67a1a2858b30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5a135118d2239906b6a89d9c569acfa

SHA1
ae7c9ecdf09997c84c6293d0d7486cea07c70199

SHA256
3513fee1a858dea734ddfdbaed6bb9630ed61cd9e265aaa8c85d1d48bcdee3b3

SHA512
e66ea124fd6a05369804d4c90cad9f21dc7a9d8288cafe65580ba455b43850051ff07dc32c27a77d7ea97ec7680b00437f168560f70f84b2620c5d0ec0ca47c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08ad35d9dff1a31eb54eefae72bcb7c9

SHA1
105b580826344036718326101d165026c2027eab

SHA256
06f62c5e3b1622827f2eb15edbf05b1e68549103fa3cb5dd5ea302d4a84b3bd9

SHA512
8c1a0d178e092f2e8757468af85735aa38e1463fa7c9f6a85746da93e05c423116a039c28fba39f9ed228a96d754f38ad2b023c327194a392f9d7d699c82c04c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36da187e5832363fde61511fd75aa435

SHA1
5e420b68a5b333316fac1fb8d10442643679b288

SHA256
99b455a6f5c583c03a4df8d745751e80088c1f80a43f7c50a8f85b83a6a8e861

SHA512
c73c3341472525fed4f1b140af5a6268ab2cc8ba13c138222c411d7933eddc9040dd63726ff473ca093ca2a82a327ec21e509d827ec898605f40f45602fe4150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2627155f9484f6350d7ef2e6a500bdef

SHA1
6fec4cf5f574f8c62dfd840c1f61d4251c41f56a

SHA256
c40c8bcd30af3ca56c7750f304353fcf0dd6615211eac21dbc3f975071d18d5f

SHA512
c73b3bedd288c919a092b71c08609d997475cc777f89b78fca902015311918bcee37ad7bfbea8cbca732104095982209ce5e00c666a6d0254068ecac1ed6e203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d50eda7451537f5191f469e825d4d62e

SHA1
9559a0ec0f7d36550c4af6d54d07f497b95997ce

SHA256
48d287026a14e928c7552ff527448c400c9cf45355de80d2461e34ba6d956dc0

SHA512
c58cbb9e57a855e7bba8636db18d759c043071223ecc6c198ebb11d79a3f26b26e60aa118c7cd029cb238717fbc0afbb34333b4c9d8cdf341b14559f573fb97f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7f9650e717011e3e133438670506aa4

SHA1
4c6f973abcddc170a58e487a3e49f0a6b92ed687

SHA256
a64a96002900f5e6a17f814ae0f8f8e51a66d573d1a77ab73df67ccc97eff4f5

SHA512
5ec7417b32cb1e91b4660a681b2fb678b42ec4904c6fd8aabd75170d76de0c453cf750e16cec2eda2059442e7893b013f4cfd9a7da81f18dacc5f06ec4fef134

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7022.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7101.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit