14fb524c752c322beb0531f6b10c9f847ffdc656def0b3fa785b005ef5d1aa0b

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b605da68e9e578ac3f9125b2c59ca303_JaffaCakes118.html
Size

65KB
MD5

b605da68e9e578ac3f9125b2c59ca303
SHA1

82d4fae2fca70a73d26bd5f802ea2090224876d5
SHA256

14fb524c752c322beb0531f6b10c9f847ffdc656def0b3fa785b005ef5d1aa0b
SHA512

ac7914b216ef7b0e783c3956d7d369a535438838c1c897ce8fdf252f452480aa8f846865e5fdbc229818d47e4716479bcd117f479be92c70fe253ab8dfb5b341
SSDEEP

1536:fEHDZDkoOfW+oEV2GIpcLxJ0ghNxgefN3MU39DMglNJfXwJx:McfUMIpcLxSgeefR9Dt+Jx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2AE7B21-2C42-11EF-A243-C63262D56B5F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424746994"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2548	1704	iexplore.exe	28
PID 1704 wrote to memory of 2548	1704	iexplore.exe	28
PID 1704 wrote to memory of 2548	1704	iexplore.exe	28
PID 1704 wrote to memory of 2548	1704	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b605da68e9e578ac3f9125b2c59ca303_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c2b757b75240b6c39907e497b6da4a0

SHA1
d64792b743a128488d502dff770f4caab3c3579c

SHA256
6de0bb9dc7ad4cda106258a4b06f7c42b762b0ad7bcab896fb55f4fde15913cb

SHA512
1a2bc1623599d276e920e0c1aa52599241b2a64dbe1df3f071e554874e8d866d56153118c11691bf002bbe9a40410ecdbecac84d58688068bbfeb85cc11df7a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0a2372b527ee3fa266cf6a5308c3f31

SHA1
652e69777af85b2a61bbd8fd8d1c0f8ee5c231f9

SHA256
f898a08ec50fe46f3a00e9f5d66401ca514c33a5113869b4bd98d29a59c072f7

SHA512
e35e8454da2c8b1a11c7c613d1082ba955397a12bc7f2deba43f57d450ceb6611dd55b3a27829d53c7c93544498aca03e409df0c9440f8869ea0cf733b7ba293

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
562b84b3ac3bb3315637a599cde74583

SHA1
ccf80bc0b65949f35565d1b46a3b7aca1e0f3063

SHA256
1757dd72a31a47d7548ccfd952ca9e6a20e170c4ca48e684e6d63d40834641db

SHA512
5b6da32f8e8f93c753fcea61e5be32b4e5e94a766bbf6d3bd39de66ffb3608e1fd680ae8681600354477f87d56deb61bc2fb1ef0c78d322ffe8788e9945cf879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b73dc615c6160b35589851a532a40871

SHA1
a50e912ea0278ba797431c6056d0d60aa7a48f18

SHA256
69eef1e3176857aa4759ee0a27263223ebb40dcb96f1c45b02eb7355a4422a7f

SHA512
6c0e1280df9011ae75cc8cf3c07f571223515c182de654c58df45949cd61e9008bed0d52b57269550d51def3b0d4995141cf2646853a1383102977d6e356ea74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
131b721220aea70a72d0d38ae701e4b1

SHA1
d8882a5610de6734eff3aebc1ac675ddcfcb8d11

SHA256
14420ab92c731172d6a4438336d0c8b7fd32f9a7fd50eca3b8d5d13d9a9589ea

SHA512
fbd8fd24a11710c355174d3dc5c8da720f25d6b468f8245e53738330cd545c0d80fd11231434d34662b16a610a146b40a8bef77fb0e323dab97b786a23af5385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c4d0275673c3ca14725b75f4cff5e3d

SHA1
70909a230e89349369b9fbe88a119139663f6958

SHA256
54a7a88ec54097f7c41265a39bf5a235e6b0d5d0a05837f0a99d4da55a69447c

SHA512
b66f058585312628ed52ffb389042933f8a48eb6ef924000681ad2a0fae10c6afa50771882c743221b8463c4971a6a26caa2326cfe11ceb2376989e7e4f60779

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f6389df2de2406634b95dfdef501021

SHA1
06fc3d198f8165975aeb516ddc625c13430b8bdd

SHA256
8e0de02f67520937b1372eb73d4c7af80f3cf4e01c3794ea1f3a9a2d6fd707e8

SHA512
9c5ab798d3b3180ab86abd9a34d613cbf9fd5d617ae2e783775b0725328586ff4a0fa57089e7efc825228dd5056e87ee7109ddb8052398f194f20e0b01a5a66d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f596eb8e932a494451127e5d453f4679

SHA1
8fe2288acd01a5f0ed85814badec13a7ca41ac88

SHA256
27d4d1e2812c7c4bd26a26eb73932f6abef651245e0d1ca227cc7adf7e28bb48

SHA512
56c2dc529003e3593e2c1f5246b5af2b2927196d33ca9adce4e63c51290ed9a6bb4e6a736c889fda5d1e84bb953970bcc37e9de919f3f63f1750f8b03c7b98ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
060ccc578806c7bc97dbe1339dff13e6

SHA1
2734425e8abe2169c3cb02d718b62eba3d5841d0

SHA256
858870f242a79b5a0fb1cfed8e0e147dede474afbc5cfd39adc610c0e0330201

SHA512
ebbe48396219249c0e70120e959151cd05a80d4c397694e9d73245ed51df1daeee79dc47b2b54ed8e6448638b5ffd2f6439074d28c4f5ffb8ea42a7c04a4ba76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5F11.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5FB2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit