302d91cba06c26250000a551cf7dbf9a2ccfbdf1b827178763194a76a1c624a3

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b510dd99e374da7c1c322e9a052e9c68_JaffaCakes118.html
Size

23KB
MD5

b510dd99e374da7c1c322e9a052e9c68
SHA1

755cbc6cfa94641af0ff828df88f886023775517
SHA256

302d91cba06c26250000a551cf7dbf9a2ccfbdf1b827178763194a76a1c624a3
SHA512

9a6c7b428f9bbd68355e1fb3ac486f1f242cf7239b7b3d88527fc24baa667185a6cb72bbc6e4a72b3af52d24e8bbecc35c2d48eef336679fa621d0f58dd3912c
SSDEEP

192:uWTFR6awb5nzANgnQjxn5Q//nQie2NnUnQOkEntdVHnQTbnxnQ0CnQtEwMBWqnYX:nQ/yNE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C494461-2C1F-11EF-91CF-DA79F2D4D836} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424731762"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1440	iexplore.exe
1440	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2888	1440	iexplore.exe	28
PID 1440 wrote to memory of 2888	1440	iexplore.exe	28
PID 1440 wrote to memory of 2888	1440	iexplore.exe	28
PID 1440 wrote to memory of 2888	1440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b510dd99e374da7c1c322e9a052e9c68_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a335e00671f970a3cd0e3b6a76f83341

SHA1
b7ec9a2152b8a18192a0184ad830cec672e76e19

SHA256
eb8cc9c3edd73dd85cbba4754ea51a6db0b58e2236cecb15c646bbc060714119

SHA512
fe7ae167234625bc07ff362b087b7003f1985886e20ee8c332e9b41e3362aedd2d87d456ffb5b4ae3279569962a1dd85f689e2f3fe101549d1ce251f5dfb7cb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7f19c911e03229c8c0f1c3984cef9a7

SHA1
db4bc4a971d5501541025dafcd9ba21df1643355

SHA256
a76267f37144717a957c4234466e9d50f53508dc91230cc9f5a72cc66b95bb99

SHA512
233bd4adcf6f8a8b1c8100552e359b8a87925ee960c83edd56bd65f0fc62cabb32ad6affbfc539ab296a9086f32e0076965c7d9008990390d27ea6f45bac35b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bf6308321c3f8adc379903705ee76b5

SHA1
4222b698b5ef3952a70b5f9b77d3f96d1683eafb

SHA256
f71bf6216361fb940f363cc204d3937ad1058f83c86eea8505b25ad2cac82b81

SHA512
d4202c4bd48141d4a32a24405e9db23501b88ab17254788518a19812ffc6ec856dedc2c6e90dee6af07de50737c18b6bd64b43ced32fcd0e47065a7cd14d26a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
883336eb64809796e31d8c0c5f22de29

SHA1
4b10ede90e79a0ac49d30f80f71dc836f7e11393

SHA256
00a409373cb102eecffe58176d6bbc4f5b646fbb1469b7dd780346194632a337

SHA512
619b907dd7600cfdd35b210a885bdb4f906b387207161371fc8ef600ce9419b3dfc930b26707f789f9605f12fbd4c51f7059e39252aa63ce22ae47f310efc623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
541aed5df705ab9f6a5e40974825c0ca

SHA1
ef74abc4bce900cba5768ff6b612a9b057f1fce6

SHA256
771ba661c3a44fcf13b35377d79c27fb36dbfa4615c4d1efe642e463219bf1da

SHA512
3aeb1ef843fd8ae7fe1848b2f29677c4e1c870aab21f1909fb746999849828dfdb9bc31129acea9c13617ef45182292827fc3c6add606d578be3840dda390ec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1986157424fbdd914b2c9670a2bde229

SHA1
2a004fb2d3152e8320e818b1877c36ee056caf65

SHA256
70995188c8d94eda1c48e39b8e738fe046a0f8d005a867b468e32ddf2ff49750

SHA512
5997b6e39bec660f6e6321e1eab4a61d5809c10f48bc810c28282403955153b42559215f10b8fc7cefc9ad49ec3597507a80bfb029a5c0d6140565bd76d551be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a32e98f97b9198fe1e269e9e1d1d0258

SHA1
097c66717570c1261f7393662f082864d2a8bf20

SHA256
91ec838b66be1b483cbbf94a6bfa8f8ea291d9e86380b819865cf95fc87fecca

SHA512
2cab55ccb7ae6d49c5ccd7052f7993b5d2446b1673d2ee1cd5d7b5bb33224ffebde13cbf9e79346202157b2b2aaf826ca63debde8696749348800f70f03ae930

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ebef2a28f36093fc0b8be77b455cdc1

SHA1
aaf5ab4d5fb07141230c8a5569320c9e74a9892e

SHA256
7de820940210149529883a132b17989a295c60ed77cbdc4db0b01604b88dc986

SHA512
f0c5d7c9d40f3363e59fe887ac201510c6b43643abd63d6b1d1d811b990e6ff0514eda79bf25f71fbb1e1507cbc613e8905ec4c181a754b177b41191632e7e06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6655c30f469da429d70d2ed1ec5e8b3

SHA1
dc68272b8be2b931991b3fbfc33747b01bc3b06c

SHA256
0b2ca4b55827f81db958e3d7037c5a3aec1d41d72282cedd430511736c1ff4c3

SHA512
c971eed9c55535ae7c8a643a3886d5088ea222d7080f1997879287bfef28618a835cfcdbf1aa79a1b7cc8dc8c4679252d4ecc3c5caf13ba405361c20bbf97d70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21387d144092741e53c9b275380bf1f7

SHA1
521d0a9dc0977d3ae4734461c7e4c7230763d956

SHA256
2ca4810ddb25bae039b7cd9779cd940d6887f3d6a2e7731c98a8b4c3adbe11e6

SHA512
bfd8b482bd5faae6c8c8cbdb34d7271793c67d3d36b337c34406d1582c296312a99566336c16d49f2efa4340fba41e4ed05a75337038d6d1ab1f232633728994

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab14BB.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar156D.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit