aa52d36215475377e0281ad03c75530428736d306b6eb25ebc4055b7a3c03f33

Analysis

max time kernel
140s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3d97a9c9110fd50eb44fbdc1a30e964_JaffaCakes118.html
Size

460KB
MD5

b3d97a9c9110fd50eb44fbdc1a30e964
SHA1

2074c094a25e2a3ced4ca3680ee3abc753808f58
SHA256

aa52d36215475377e0281ad03c75530428736d306b6eb25ebc4055b7a3c03f33
SHA512

a4cc55d8067aeafc4d7d03e6fc9c579a7d456ceb844d0ddb44330d124a37d44e43ec1afd7371b1cadec3ec1a173a799a623a36411ab99f1d21a03750c0c879dd
SSDEEP

6144:SVsMYod+X3oI+YysMYod+X3oI+YWsMYod+X3oI+YLsMYod+X3oI+YQ:W5d+X3e5d+X3C5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424707966"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b623e9b7128144fac96f874944a227b00000000020000000000106600000001000020000000ce833099c583cc240cb663d6695fe72f52a5391c4ed06629ff719d56db6ea1d9000000000e80000000020000200000007c4fd48ff4bfa325f6a2795233dda89697d488807e007096d7336b0abb546b5c9000000012e93c792a8d46cc09fdd022657356787600b94b0b0e869d4a8a24360166fe96925fe4f1de5b50b4459b0d2c746a7563429e774288b82498c1285ed898416641e59fb66a348e6ca3cd3d2f470c741c35b71adca07ff17bfdf2003bcfaabbed520cead5e904d738d5670ad20418545078bfc1c84ce3483f564303042a56b75e7c2aa25291d5aa13f69707adade36541604000000024da883d698a59117b6c25a934c838c212eb9315f0c69e569882077d2dc86ef5c6cdb7417f23cf408a2005f5ff8d5ebf3879d6ca792cc3274387ae7633f7274f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0136EAB1-2BE8-11EF-87AA-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b9d7d9f4bfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b623e9b7128144fac96f874944a227b00000000020000000000106600000001000020000000c32ac962340054aadebee5b20e172562a27e300fdb3698af29305acc0fe92fc2000000000e80000000020000200000001f7665dbe25cf0efada41607e673a8ef46875c9c8c42ad4fa757699571eeaed320000000c9aa90b88527f3797e72096c4d5afd13b3a228c38ac87551bf411995100adc5d400000003ccbc1aa5fd0ce9146e3f96bcfa6cebde81ffd7b2855a58af78d348c3d9da9ca63e0c2b7edb673724b016300bb29ca66ed06dca60b4666bd8afd381be241cdf9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1976	iexplore.exe
1976	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2936	1976	iexplore.exe	28
PID 1976 wrote to memory of 2936	1976	iexplore.exe	28
PID 1976 wrote to memory of 2936	1976	iexplore.exe	28
PID 1976 wrote to memory of 2936	1976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b3d97a9c9110fd50eb44fbdc1a30e964_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09232daac28c8c0350a8700f20a5d9d2

SHA1
914a41135a961f08f9a536b247e4c1bef37e87f7

SHA256
e67ae6d3e399ac3aa74d0107f05162ccbbd22a6b24400cf69494cf8147338e46

SHA512
764a47f75b7c04b6221fa0d1db29edda5e239654e9899aeb209dc17e04d98ed743697066e67572dc22e7827a6c3b141f1cac446668498b4f35c22ab2f85dd42c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
774b352b9ff81bd6b4bbebbd8d5a324c

SHA1
0c94aba4fc34a798ba08c48223528460d6e51e5d

SHA256
7c8e4249fef3ca9591b6bd61bb3e9a96ac7d6be18e20e0aa5b8bbbfec8716390

SHA512
bd13832b19ba1674afbe99db9df3a07c5c179c488c4bb749564acbfb67d806245da3828f30e2157e78adab53918e13a863735d014e7c3fa3e69dd35e0d9877de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f35b492d42758fce0126dcbc90628754

SHA1
508d2a03ed709a626817d42abd04304531d78779

SHA256
bf95bf32c39b47caecf0bebc12ab329e508c06736da6ffe72c2c384394996098

SHA512
e86aeff668cb2ebd11f49446dded7b2e61d14463863c47e14ead75ce51ae425d1a73af91e7c01f22071e05f808cc365714855322d24b4a08bd0645bbe240aa1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1023cd52b4462144878c641f340bc82

SHA1
e439c2a5cccb76fbb6f73318a7262c29c60165ce

SHA256
c7dcb8e6d23b89a6888d5b34de40323112d48e2f9041ca83df75486b98b19b0b

SHA512
ab3890fe91ff19023a4422ef485a9f89626613dfc21ca8043d051c57c953b815b2c2bad2f995a36f7b85a1e536136a960466cdef76031d031352c6e998bcc003

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3f5ff4a3aebe7a06811b2fba85b5132

SHA1
0b5c763000821c17a22525f6f09a440c87242236

SHA256
d2efd726b8260ee1e2d397ed9de7da5d4693482d7fe25be62859891042e0d149

SHA512
fddb60207faf25934d77d2bb20093bb1a4ae7f36e08e79e58bfd1154846f44d1558268510ac881870ee6d22d770c199191a89aab22451d848ac908facae20e5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
717020a76269b6dd8056a894d40d58eb

SHA1
25cff2b1c51a7e081990b812e456b8acafdcb33d

SHA256
8a7d3899a4206fbb1eb1e0d789aee038b3b433960ccd48693a94f99bfc852fda

SHA512
b51f4d584a9a20d3c34e127915f28cc02041b30f0b774f8da1cd177e7435ba658b525f40aea36d2b70161fbb6843199f9e5b5dcf3a5e25aa797aa6902b6c6329

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
daae2cc51eecc33087e0f0702aa9ad27

SHA1
6838a1a85be2b1c5db1d29073010fd5898899931

SHA256
76e8824941994cb8524f6bc481fb3d392a944226c6d2bb335ab84adab3d92941

SHA512
a43069a0cdc4d76439a555d6945d7ed8b57ba304bfa104b13c2c4ae978542c0d6e47cef5dc1f868a6dd1f77999eeb782b93a8fc4a7cb290286405353ebf687e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar529B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit