d55583ba421256d48a11a8ce0d7798ad854ada9f70eff1393c8710ae00cf1ea5

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b42ccd0744e259ee7718a578bc472795_JaffaCakes118.html
Size

27KB
MD5

b42ccd0744e259ee7718a578bc472795
SHA1

79b8b8c3abd6e83b1eb697630346f8fdfc3aea5c
SHA256

d55583ba421256d48a11a8ce0d7798ad854ada9f70eff1393c8710ae00cf1ea5
SHA512

16f8474a7a149b598f2c9df19cc5b82c06b80a095c3b484943bf76c937fbe71227f348262cf0a344a24093e1bdd51a89d321bcc79cff815ed965441779c6e519
SSDEEP

192:uwzsb5ngenQjxn5Q/znQieCNnvnQOkEntZ1nQTbnhnQ9eQCm6AR2qU4Ql7MBiqnd:VQ/Rpqy2zSUnw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A7A59C1-2BF3-11EF-B54F-5EB6CE0B107A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424712727"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2064	iexplore.exe
2064	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2984	2064	iexplore.exe	28
PID 2064 wrote to memory of 2984	2064	iexplore.exe	28
PID 2064 wrote to memory of 2984	2064	iexplore.exe	28
PID 2064 wrote to memory of 2984	2064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b42ccd0744e259ee7718a578bc472795_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d048d5ef2df99e61b66114f02b104c5f

SHA1
005c8fd2f82573a6fa0ed86290763cd7d7ddb416

SHA256
86be216a1ae6cd3d9ef8d9e4d7975a8c25dd74592e8aaee795f159c5f6bfd569

SHA512
d93209ca1a56c1f22ac29ffd2a2675a69415329c406f26999cb502eb8e6613ea0c6585c7872aaec267ea477d9f41bfdb354204e5fc5d333923b52420a1cd174e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b084d516390297917fbc280ff010abf3

SHA1
1bf9989fe798da60c88c1e5c6cf63b231da4ce34

SHA256
37595a6ad875f5ead6fc1cf835053c222869e066d840c7a7c7faca8840305b87

SHA512
c8a253c6c43e3e1a70115f4d3776e25c77c4d10a47f66794f1449e8c8795348376a25b61dfb2a9eef33efa390a68bc9f42226ca4fd952f4eb8e98403d180a55c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12b823c028fe35d1fd9122d85628c198

SHA1
68949b6a73063741bd3ae6aaba97109216809b2a

SHA256
fd8c51c3ddf621186d2ce9240670a21dcad0f4640265dfeceb352249b6b2c0ca

SHA512
3cec560fe1d18c28905d52a32fbc659856f5e4a84b74280ec8b821a0ac596108551e58b0c37d51e9aa4c9faa15769e796412e341b0d08ea215ea44404ca7d113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
679371115c20461a3c5234aa859cf2a3

SHA1
550106fcd8b528c059b94d95d980dbf19fdd91c8

SHA256
b6e52f31ae11ab2fa7d408c0c1bcef288c9ea6b579c3693f92036776929dcd0f

SHA512
953178a1da04f3ccbaa301fd4593b0dc3a734953364a2e9387172d8230c671c3b43b4ef732a705dbce296a6fa69b3793c04234010823c0ecc3c44d1c2574e31f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a2aca6b8954aa06571d16673cdde70c

SHA1
5d12474226641fb58d1d08e6bbf7e13dc8b389ca

SHA256
c9d46b97bcc98f90121edb1a1ad757f5a8de9bcf76540d0bd9775abad292449a

SHA512
c1b8181ca307f1d1bdb1aa3213c66698045b65a24e09d85b83d95305a97f3364b6110eed67b0b93672ba7d1675a1addc4485f2efd2b130321c207be3eaf387d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f068add15afbe5ff8925304de7c079e1

SHA1
03d3a013e9c5695a8a1afccf3547c307d0a13461

SHA256
ac373af6976615be87d799ac30e871c6335331c13a70e80282ba98cc76c17e10

SHA512
817af54dfad989ae20bfa54ea09b2f560d881884030cc6984c98b32663d103eafecb95ccd07574e916c96a9c76a101d046fcb1b27f6b99341357b5baf5d26bb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98861e12a12bae6de3de97524eea7a21

SHA1
e587d189899ebc1b27476eb675b4acb4f4c1afe0

SHA256
0df43576905c128bfe308cce8e847765c08ad0ac949fd402d24ffdde150937d8

SHA512
d9717118aae4c0ddc6db9a24193fd7f22455f0b8766ac054f0eea30d98e05b182d41f6e06d14dbea11d3e5515cd83db650cce7d3b23abd2f1faa2df25f757a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3ca492639dc17364c217b4321d92a67

SHA1
87708b47b65dad8661c09cf71f9d887a75ef2da0

SHA256
150a216956f70997c98f342033c5413b2ce9544ac4a8583c39e867075cad0393

SHA512
05b48d5182138bf2f6e6df56b780c2195d088768ace163cf7c420f2b1af6b38722d5deb5cf9f678b4bb9b44b744c06709cdd81210fe561fbd77ed5373bf1d58a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
225e247223caf1b641e279ac5bc3658f

SHA1
b669acfbda2028580b132cf3313044c8cff5626b

SHA256
6748e34390c2725ec6446c8298a32b9e26634e69901d677bd3545643df12ce10

SHA512
61fdbbcb5813a0d7f05c7e14dd2f795d4aaf9b7ee0e84b4967d20e8e139696d9a7de53a96f97c16db2975ef2262b08983746f62dac0f5b81369780c273945d3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7C0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8B1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit