8a4cc9780bb20c322bf21f92d917a7a08ce3bdc54120b339643aab69a0373d89

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3cab3a6465dea6c964fb9abad52db34_JaffaCakes118.html
Size

20KB
MD5

b3cab3a6465dea6c964fb9abad52db34
SHA1

08c53ed810879e53df0bc6ca3fc815ca51be790e
SHA256

8a4cc9780bb20c322bf21f92d917a7a08ce3bdc54120b339643aab69a0373d89
SHA512

1ebb7f722b646fe85d58b1ddf99914be55b545bb21551c3bf70ac969c8ce2753afeba4ca484837b893d60dd217f08536cc10f9f0e80b0f679192ff17dc25ef12
SSDEEP

384:MCL66aaKhqj+S+du11pCm/lJHRseYkRpZnks:XaN4jX+dY1ZrpZnks

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424707056"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D634BBA1-2BE5-11EF-820E-FE0070C7CB2B} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1244	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1244	iexplore.exe
1244	iexplore.exe
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2104	1244	iexplore.exe	28
PID 1244 wrote to memory of 2104	1244	iexplore.exe	28
PID 1244 wrote to memory of 2104	1244	iexplore.exe	28
PID 1244 wrote to memory of 2104	1244	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b3cab3a6465dea6c964fb9abad52db34_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1244 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae4adf99575a4bc766eba1ac1311697e

SHA1
f9c7fbf0635c2cf8785753ac5ae7cddb9c4848f2

SHA256
0424ff7955255a840436ab9a95ecfc240a7ec249124cab77657d2b8545cc7f91

SHA512
a6b5143e04f912ded0fa3ff095d21f26aff048699b6fd54e8ccfe6add5bfb1e7afbe88975cb2c99376e942ccca50584e57999524315bf46abd9d2d27099c0418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fb477541de21157d8dc1509d962faa7

SHA1
dcf611e5683a14669db00393da3e1884c4bea12f

SHA256
b3717e808fae4934bddd437ba222a3673193bb64c7da07d1c34cbc12a91154e1

SHA512
113c39463bbefe9c17870355cf5fba8ab059ae6f5c633f8840541fc7ec3a6ef5ce03d36d68d19fe489337b8caec84ff24de83b9629eed34074703e25f01cfda1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c8f433f125cf902d8632ebbed75b317

SHA1
15998ff81d62e478e925fcdf8d0f8f3eccf521f9

SHA256
d446f2a589ca83085855142a62550ed4c157d4681337c10d4861794189e44272

SHA512
3fc189a4e8b3003f4d475e2ae8d0b8a279e6a7925062b79c0c5a07c1878e6dd8e2435698c7881e8bfe981be974ef668a42696ae4807e4f2c0a2d7dd5d06dd666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f087183b3183814d51037563efa9adbf

SHA1
b78e71b88d51b19df835544228d314de22b0b585

SHA256
21ca9356d25c532a4d46fc96ce8a0708251d69b80934afb8787e2ed78193fffa

SHA512
f5789fd554fa977460e96a7a76aad5916a1a0621bb4ff1b46f25ba6ffcb65abf0e888db55cea57b0401dc70222cfb5e497a94b51ae8b38a406c9a921e922d22a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06c5fbd66a636e42fcc855f6b0291bc7

SHA1
d33d793a528e190fd59d786832d9366fa0328377

SHA256
1e3e02b812e6b35929433defabe9032acf3ba848a9174accdd15d7f6fb8ede12

SHA512
ea9bb9aacd09f70fa041e0176bd2b44cf26668996f9b5a434b2800b43ebacb134b5bcfac57919eb03129623ef82f2120171531af42d1f12e188d91557acf5e58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c084048197be8c54444367639d4e96a

SHA1
3ccdf78d3071628cb0cdf85b79c714687fc578b2

SHA256
f789a0110dae30bbeaab925ede919bf2525df64a5ebbf01241827276f596cc6a

SHA512
c7f889ef196330a63814e345d0f0d2f989631756386772267aae5ad7ce0fffd0a88b12aea32fcbcd634e877e0502ab7daf4269e78092928daa806dd078e99eb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R54TGSS0\biz-vektor-min[1].js

Filesize
431B

MD5
1cae0711eccb3a109fb3fb29c3880a9d

SHA1
7d8fd3a80efc4163a5c9811a2e43f4bd5da60435

SHA256
1ba5509373ed47e261ae5cd6e79147e710f0cd177ab1afaf95ed172caefb3035

SHA512
e03530c4e9148837133910c1a63733780026a5b6ce3c2794ae27ad418900a2df116f4c61b74eca50692a064c8b00ccc7e6e5afea6e978f19fd3a226fa2725311

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EC7.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2517.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit