88c106e8faa8602ed2aa71d5765a3e3a1090a2da403355a47a49a5efda577fa0

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b505cebe451628de54b18e1fd3e6c7f2_JaffaCakes118.html
Size

26KB
MD5

b505cebe451628de54b18e1fd3e6c7f2
SHA1

c239502064db6bb71334ae2f62d038bde3489022
SHA256

88c106e8faa8602ed2aa71d5765a3e3a1090a2da403355a47a49a5efda577fa0
SHA512

c4992b286240d392cee69b34ce807b3a94d1c20b9f587c71ed20a4b9727f2c2b74fa11c6cebf428a8f312fe4c55fe17c21a7f00507a86e2be7494694ea34d6b8
SSDEEP

192:uqTDrbb5nt+nQjxn5Q/YnQieLNnrnQOkEntkmnQTbnhnQvCJVevo7NtKFo+NzQ4D:nXQ/FygcVR9f+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FBE3AA91-2C1D-11EF-9340-6EAD7206CC74} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424731144"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1812	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1812	iexplore.exe
1812	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2300	1812	iexplore.exe	28
PID 1812 wrote to memory of 2300	1812	iexplore.exe	28
PID 1812 wrote to memory of 2300	1812	iexplore.exe	28
PID 1812 wrote to memory of 2300	1812	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b505cebe451628de54b18e1fd3e6c7f2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1812 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c2421a149a6acab488e88d6151318b8

SHA1
a71ccef31c631f6cb9d698a30f13a270e80033f3

SHA256
21c43498a655115255901ca093b5654993109de0fad4963dbf8822dcd22a1f27

SHA512
406aee474b9255aa7ffbc93bf7d73e5f808fbff248041f41b27fe98b869f94c9b6265e8b00e1855cc50d783ac63d61d112812addfdb56c24dd0d1a15b5d22875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f3e961f9a3084594be48bda20d47ad9

SHA1
3bb0ebb124e4bf5d51384b49b7765a281ecc368a

SHA256
63b5ae89ea713a8b5ad226db5f0ce3efe8560206ecfdeaff45560d777518489e

SHA512
1f8301f870c5f9104accf671704c1c9e1e93d5168fbc67cec0787050efab541476ffb2474c6858cb204cf5f9b95e6ded5183913e2368cdb5516a8a1be7d8a2a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2d6e2f21c4938503da9d8ec1e4fd891

SHA1
e265cdce4523186137a41d0ec9144565b1aaf3d8

SHA256
65ddf366c590244d229bd5a492337a0dca7ec52a580bddff9c78937598dca51a

SHA512
95404301cb20ad294979a458db8d1a08c9fb124407754ac2552ed6a36e8409bee1aa0863427d8880f3aa9a7b3be26673def0427efee67acb0b0168935ffde1e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82137042357fb96a67c10c6c1e0ff6ae

SHA1
98ed8e5f965434de565426f615cadef1b0be7211

SHA256
6495521c56b66d65afaa396b76e011fccca5d21c6a0abb7624f86e51dfdc6406

SHA512
ba0aefeeb9910b3b4f3ba9df7f33d394c4ab322f3c1c80e4f249976b7213d79a5cc362f57ab73b149a050d2fe01f64fe82c4bcf8d83ec1d0f053a21e33763cd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5544c1b9f5cadb9570a6ba619d4dc2d

SHA1
11a70a177e6ea35c75da10c5b52d42f63208c4ec

SHA256
cfc084411e694c3296e9c715e92f81e2922a360f514c39edcaab8538d8836ab0

SHA512
fd56c23620f0018b1f40004bdeddc2b47be1a25e8e9ec0a5006409007ca1eb87b16976bcd226535478aeff76d52c7bbf421c734e4862dac3abedde298f627abb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84f786e072ec20678f638758789e3740

SHA1
8982fb994523f956b5309e507e518f793aa8b665

SHA256
15c8d83211d0ca3aa07e98491c5a6c7628b5fdc01a06b4f9373ba0a25faf1533

SHA512
c31253a37e09b5e9e129ca7f22c242178a44a7325bf963b1b558a2ae85a11a278856dfebb562bafbef0e8a0b639466cfb735175c59f665fcd7f28a45aad01fee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5f0cc71b21077fb149ba114fa4836fd

SHA1
22e58298bfb53ea9252f48db8025af0b171fbf81

SHA256
14fa728267c27f984b41c0b6463b3b1c16cef93b0057c71fe8bbf32e3f23560b

SHA512
0cbfd1ef4fc544d4d47f97155ad8db4fe5678ffd35d85abcbf270328fd8ac6133b339fdd75ca5bf1fc2ed57a74d84bd5b60e0692f0f1cc982cebbfc09dc138bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d82651d2f73c689306a6cfe9804927c4

SHA1
d0f587249d9ec05628e0256c2e2ae02675d57567

SHA256
aa5954ed13ae41a6e9f8d3110f6aee67de21652589d913c3173f5edcfe4b1dff

SHA512
6cc747467db27ee741ecbc7cbaa9662b098d18f29d31ca0a422f2cc48a5629cab4e16d292b1fccf48881fa6edb45335d2202d90d2b7d99c9d99fc46f2d995a03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d43f4f57d7d51ae2a9d7f4770c24e110

SHA1
cba86008c893063e3486d57e8a377e489e098767

SHA256
7311f35e22f0505b6267293595773fae4883d67921dcade2e329a85c6f743f73

SHA512
a0927e3c3294b4698ea9fde549864569bddcc6f641280e7508edfa6aa1926d7f3b6be366a42b008e481a7f267991763713e0c16d8da74c730e8988b386ae1b47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1103.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1213.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit