d092bdc3fd66f9ffa0cf893ab0875a4d0c5a904614a66237cbec213b938dad2b

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b3703665ee979893b27b0367d817a356_JaffaCakes118.html
Size

27KB
MD5

b3703665ee979893b27b0367d817a356
SHA1

50a8f9a5a28c3e8c5b4b9dcd8f284ec8579cc31a
SHA256

d092bdc3fd66f9ffa0cf893ab0875a4d0c5a904614a66237cbec213b938dad2b
SHA512

22e8947242ae65408b516fe27c365122b244db30446683b6e12d2c1c45f12f1be9b5a6f3239967709397ba776aef349ae42dd294edebcdf49f1455fe4db1ba0f
SSDEEP

192:uwrMb5nuenQjxn5Q/5nQieENnQnQOkEntHznQTbnxnQ9eaQm601wqQl7MBkqnYnE:rQ/4HIywNSuhs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9665AC71-2BD9-11EF-A490-4A2B752F9250} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424701768"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	iexplore.exe
2108	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2304	2108	iexplore.exe	28
PID 2108 wrote to memory of 2304	2108	iexplore.exe	28
PID 2108 wrote to memory of 2304	2108	iexplore.exe	28
PID 2108 wrote to memory of 2304	2108	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b3703665ee979893b27b0367d817a356_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d95ecec02e1b9c7a8d73ef4e804d253

SHA1
084172e08f60a23127d31681564c206cc106fca1

SHA256
50c6755e925b7c2b9cb782d103aabc3696fb2faee60778eff079caac7163eea3

SHA512
d2f381fd5aba0fbbb489c60a3ac011edf9b67eb04dab7e6f53469ac5d915539f1f0954c94b870e6c442721c7d9d034af4b33c95b8b2a4561e0d3fd619304caee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5433ffb3604b7d775441ec1ab834788

SHA1
68fe1c8173e5173bb4d2c80eff351ab6114aee98

SHA256
d072d6b15764cdb6dc361e2e0e25aa9021d1b1e80ad4aa0e6f95ba848ac54e63

SHA512
7a53bbe675657d35ce3162499f9797d27c61abe0e9891bbf5f03bb69241130907bb13e7f7cda45c8279ef74aebc961409303a109eb8c6cb35a5eaaa9258c8588

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4983d440afba8d8594190306e0211ce8

SHA1
7822993157b2fe50db6810b7d17dafeb7c848472

SHA256
d1a6c2cbae95e261ac081443b19050b628535081d9e958829bacdc5b0d0710d4

SHA512
9d0bca94077d3ed5d3a7f8c584c4e24d604e6f527bf4dff2b7b8dafdbe62490c6d2848d68d13292ea41108da478cdafce03dcff335eed03367f4a11d094b6f84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5701dcf2d2794686a964d476df0ec8bf

SHA1
bea370ecc93ce5ac6439f4d43b141b5e443c2333

SHA256
bfd5068e9ac69b7c7c212279544e37c072a69bcbd10460231ae1e14fc9e59ef4

SHA512
5feded754a28f9f46e8c1b089adcb6507ee6c2bb97996318e54687a4c0aab2c86e4817f1659ee4d1d2f58e355cc1c8785457b44eed5548c72ebcce6c84104229

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a58f961bcb509c1e5b351ac3f16fb7bd

SHA1
edbeafe5d9001c22ac91fa36bbfcf1e16adbe8e6

SHA256
cbcf31c1c0dd8b1a3f14b35cf5d03c63936e9d22259919aac7fe5acc5f1433f4

SHA512
174449744aebc8570486ab9db562e6087eba8f5fbdf8ccfd561ae29994bade3eea903efb755bbb97c3375a906d8d35e60369438d4f06b6cb9e8e993ecc0fc7e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85dab8d20855354b93e8738bd1d69a8d

SHA1
9312d39d9c2d658b1c481db3900a5cef30a12839

SHA256
195b4ce11842b4e99a01db5d5ddf090f8ad1b798e85be8b4969d40d628988c81

SHA512
daa0e086dd4f5cbdcd72c938f13accd58d57a0e9a1c75e75c739a44832d49c69ad5afb798d7602595d114fdda49b0455aec300fe3b30759a597bdac59198a6e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bbdda9d9886e9a64e8b367bc430484d

SHA1
77834912ffa49cdf20e54588d729faed5cacf044

SHA256
cac98921a25eda287d50169651c6c94fe150fe51f39cd1c62cc115f67b24f358

SHA512
e124c694009a2826369f929390d32136dfcd9779e16338a0709626ca53de39bd109091b2cde83f581046eaaf78cb2ae519959c7b6c022f82f65a6d0ed17524f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69fd188e0f52bd48b625d0198615d6d6

SHA1
a15dfac61ecbcf0f1ad693fdc6cfcbcd01c8f9f9

SHA256
ccd4fb051f05ea0cbe63f233f4117778af3b98d78a19b761756dfedd256455e5

SHA512
2931928b0282956768990d682c502e1e845a5849ef7b0066baf0e194e82783dedf4cda4d979ba270660a10372f863de1281b0feafed2f9604832ebca20b04970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47f367bec3ec65e5e26f9ff6b3e205ed

SHA1
c8fd8323ac046b45ceb23f8037348560bc421b40

SHA256
104055aab80b1bd69a84a305af917c4537be6d4d6ac0f03ff6c4354eb91af0b4

SHA512
bb6e9f421ea8a162ac6dae31c7bd89503121f681f965c7b11fbd1f2789a5974fa755e70157b6d40b3f11fd289029b5f8396a52414f3b8e0dc1432029bc05313d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f61c904a7598e298670c4f5cffd9b3f3

SHA1
d08254cdeed22137b92126026cc70ac819c0dc96

SHA256
0bd714274e8f89fb797810bbdb9e88d0ac714c9869477b686361f24aa053baa7

SHA512
1055349aeef3cd5f4237405ef8552a486b1bbaf0492cab109a3fcbb84498015ef21cd3b212b37815cbf60722314aa1518201cc655c2d129f494be974dda314b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e237d47f71957eaa9979b3fd557b77e9

SHA1
494ffe72fefb8575944f74acda745fe8a83b11cf

SHA256
036f9776cde15038d53faf49408c91ce3fa4b6fdd0128e40bc7ba5369b828a9a

SHA512
6a4f4e1bbc9214a20129013f3cdf63e82eebc8732ea6933d8bf7b712b43014ef472ec25dd35fae913e4d9ee18b82093eb0055843c63a5166cdd21c73396aa725

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD3A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDDB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit