5a6d6a6ef8ad2e0526ff3fb5f4a50f3a3d01c524ed3fdfcc4b2d16457576587b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b4004ba64c531aada57ab024099fcede_JaffaCakes118.html
Size

42KB
MD5

b4004ba64c531aada57ab024099fcede
SHA1

04225d689c71ac1dbfe817a8cdd597e414364427
SHA256

5a6d6a6ef8ad2e0526ff3fb5f4a50f3a3d01c524ed3fdfcc4b2d16457576587b
SHA512

9b53a7d71a701f5ee167dd703312b633c3a2ff1477aec74d00a002563c323f766eb25c30f10b38133246ee77b401f180c83234a221f33aa8c4e849fb92eb6eef
SSDEEP

384:XQ/Q0xkwemt5J6lKqv+Go1VO7cQ4LJKwAMZVuaWOJoxw:nRo3tjcS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5744F821-2BED-11EF-B9DB-4A2B752F9250} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424710252"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1696	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1696	iexplore.exe
1696	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2776	1696	iexplore.exe	28
PID 1696 wrote to memory of 2776	1696	iexplore.exe	28
PID 1696 wrote to memory of 2776	1696	iexplore.exe	28
PID 1696 wrote to memory of 2776	1696	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4004ba64c531aada57ab024099fcede_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1696 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6515296c66f8badcf0229ce4cde54279

SHA1
25aef07c5bb16aa9949061fa809caf0250734158

SHA256
c05949372cb98bbf9e9948a0a52441766abe2946062337a623861880f4a30fcf

SHA512
185220fb4ef6eb54bf0c85e729c4d89060a2a3babe8e4cd6c0e1e4c02791bd09d90f6fff6b3638b4a1238de1a43970c36ae53e443743757873c642a3ae02a214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc9367f3c2660bb441d91d13313dd301

SHA1
5b082ddbbcd9ef59cdee0f38ad1bfc3e4197c616

SHA256
f4da6ecc556959444f209a526e045c35d8198d13ddc4a99a9c275d68dead69f2

SHA512
a89a916632b76fc375b669bc3e467c1e6fc4047cbeebf9838bbe78fdfabb6ef8c91ad550e2289f22ee4af29db801d6e2ee70ba0cdba72745e0a47481e12d992e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f188086a6facc9e1ed70da2109888fc3

SHA1
b721d099c1745edf47f893133863cba059073d3d

SHA256
006f9dc2389d75f3e5d21fb946073192516ff1551131a437a75ca68834cb21d5

SHA512
8578746e8190e3dd729fd3cccc200665ac859892e6905654092e7d6b97902e8c6a5d1ce7f417b967a0882dc02541a7699b9c32f0ae95897ff1c7537c3d332d5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac7728afabc7eb68dc7ae5980244b58d

SHA1
abf88048e1e33917dcd5bcc0dd53dad1a5da166b

SHA256
9e87b55d579213f3c85e7be1f750209cfcc7e0cd7f8027f92f081534b81b734d

SHA512
8f5269cd03d650da427640ecf7156313b1828d969d1921a868b35f0b7ed87888f87900edceb4591c9f51235d7c37085c27824d97725862b85ec3a42c422a6261

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b14dbeae6dae64ed63e749c7624c8649

SHA1
25a70be77991bed6f1846d3a093e004292fc53fe

SHA256
d40add8afb1741d29e4a57eb2ac132cb53304d15264438df269abc7a6a821a12

SHA512
8afdf58b5836c3db148d8fbd9604d4782b5618d2bb8d0bf10d6854b9dceb41e266e447ba2f251ed07705f78515881922d76faff9fe5eb049e0b2547ed4a60ce5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ea09b3eb20f110754de9b6f634af7ce

SHA1
d9e4263460caf1b362a2b49e2aec36fff3b02568

SHA256
2983b20576860bfff763758f7e10bcfd8aae328a725de4313f33fe7e1be4a6bd

SHA512
859fd5be4567764a371fb6570b225742324083ca8f6e60e9d624e233f531eb48841b7713b4767d9287d014fd7f57a6d49b236047abd16121de776e2eccb389a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e18c1963b9e9b20fc835e0e6e65a4c8

SHA1
d9a559c021d33a6e9216b996058ac21e5cc997f6

SHA256
1f0a18eeb29873c676addd577e89af6970b62d0809cb744c3b7dd7a72bcb099d

SHA512
e638ab0eb4246279107adf517ec802750875a9ef2dbbf3112d9e932bcbf9ec3840aa8e96f2f64e8d516e72cad119d4883147e44a6ae02a9c3822cdd95a323efc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffd05162952819b8a779cdc8d0b1ddec

SHA1
ad034e8a3f4961331ec6b52df09721e8e5b76c27

SHA256
a4b6415f3d785be2d54be8183bb3baa7bbc3926b753ff8fa27bbef5c20cbc107

SHA512
0db37a30c839e5f9ba5b8c285b50a4580970c8c43eb237108019890a7ba34af6040ba905257c9420a897b552d546a72186994f1e3a229799c7a02ec0ea99f275

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ab3c97a7c0cdabb67be989bcd4d2ae1

SHA1
7f12ec6669a14968aa8b8bcd22350e1b59522d94

SHA256
9abb89e26a2aaef586af5ed48ca628d84a0134de11bba0acf27b7c716b6f2d85

SHA512
a83662b3a32cd200791eaa3041798c2dae7b23494bee6dff4a68dddf539f32098044bd6c0117e98adb4ed498ec4dbac2e02455ca332ed56345d8bff3b91a5f4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC70.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD33.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit