3f0be1241312ce4dfb343d142aa84c8d8cfcebcb8c5d4501cb05c8eef98c58a5

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b637b9f0cf1f2c5de76da357cf92db5a_JaffaCakes118.html
Size

27KB
MD5

b637b9f0cf1f2c5de76da357cf92db5a
SHA1

b5963736aea09928f265f4dfe4644465adc37294
SHA256

3f0be1241312ce4dfb343d142aa84c8d8cfcebcb8c5d4501cb05c8eef98c58a5
SHA512

d2061abbad3e3f5f7147a8cca2d3cf723c91b204405649b76355f2a7715cd29869d07e7337670f765d6fedf76d99d3dc7138da6b566740fe464769681637f4f9
SSDEEP

192:uwfkb5nZanQjxn5Q/UnQie/NnPnQOkEntAunQTbnlnQ9eDTm6uPFjQl7MBfqnYna:YQ/rW1aF6S9O5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424750257"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C168761-2C4A-11EF-9B2D-424EC277AA72} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
852	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
852	iexplore.exe
852	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 1724	852	iexplore.exe	28
PID 852 wrote to memory of 1724	852	iexplore.exe	28
PID 852 wrote to memory of 1724	852	iexplore.exe	28
PID 852 wrote to memory of 1724	852	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b637b9f0cf1f2c5de76da357cf92db5a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:852 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d51cfa8731f399e0e26a2bbf47e07d0f

SHA1
5342a87ffa38a71991f1ccf564f4cac644a1e04d

SHA256
e52a6ba16abd12880cdeb39ec3ca96d3abc4237c62fea132de3df3c718d8e58b

SHA512
af9769e2b3ace402585cde4daae2fbcff9af46df0b38ede38da7c15784195d41bc83f4101ef57901d967b0a3f2c56039320dc805f75dc2e4c74d28bbe95c9ddd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfd5928c8da949ed38e0258b6999c4c1

SHA1
db8f471c98a24f8e65b87870ec152a54d1a54d37

SHA256
57525dc45fe963394ae7ac82a88a04ee525035b80407d6a378a2c1b7233d03e5

SHA512
f9203afe3eeab111498d089f01605d71a5150993fcf5b936e9276457e5effca322d328635c1916cc7f664e5c4c66e261854c5388d3c300baaf579f4e5cd1a90b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45859eca948fa1ac7562f1c3acee7748

SHA1
9009647293f4e7f48f262777159091b06c374072

SHA256
dd4810e2425f9dd237c222dca77885d94f19e374ad60fdff6d39ee3b4c00ea90

SHA512
be50833c933c73ade7b6b56e778c575e7e404c82d9aaa7a8ee2aadbe707612dd59771886934f0501ab675016ee9d4b7bc61ee6e80394e086e6310f3b39b79cb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86f0f5eedd1b4e7676489a10859431f0

SHA1
f25133d0682b9e6b005c41ecbf1ece07ddfbfb4e

SHA256
06a7650a83f269576bb8a486556c7ef7c2ef800d542be58472540dea4c9541df

SHA512
414bcdd1d7718fb3ecdc77adfbb72953fbfbff5d06b66b0c2a5c599be4264594ec1eed36f917a1e165dd0538e1fc875000c911f7735bd34414e854d6ea2c72a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbbc454a428efe05e7b49b6bcdd4f510

SHA1
51dc74c9cf04fd60600974f3455cdba7fe9d66bc

SHA256
0d6b9753d887f7873cb33061b47502dc14ee8d229e49f3499ac6fc115b837a97

SHA512
e47109d385360779131e3c7d8d05d58e8066de3cd5adc09109362016b037f8075f29d2c108960c38d10743e7ba94651780e6e6d45b5d6fefd2224aa5df06a461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfcc79c0d1e9b511681fb665a0b7512e

SHA1
6bd691420e8f7470e1ccf7cc629269df40e6e685

SHA256
1732504343b074c4cae809e2eb51b6c36c5925e263be793b54546866b9b49250

SHA512
b47c3d05e9c01ac6e0b250ab70721d906dc5cf5f503f22f31d2553aef3ac42435eae418e80795f01e81691d28ff063bc817ccdf774333466e10b693f7616b65d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc1a748166c8fc449928799f6ec0a864

SHA1
c6efa6e1143f11dd2ba28a476493efb5604c359a

SHA256
ffc905153cb3124355a36d6d87a4d9a3991ba9556f41504263178c6fe9e6894a

SHA512
c2eb2f7bec67eaf69881a467b7111230f417c00cd025175e8421c11c3457822fdf78a8983f925cda0782acb89e0e38c7d6be92f82307f68dd963d06767ba8b33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6996f5a78e3097df932f6d813d2deeb

SHA1
51aee65eac0d11a45f9faff6916448af8c46bae5

SHA256
94e195957f703ee3676d12972fcc7f97aadaf40b16ae6cc61ea0be6186a13030

SHA512
7bbff73f47892d6e158dd97173179a9b3038b4a98432ab473df67b063174b0b7155666946cc7e365b952875f736a26dc552984bbb4b6dbbdb9fb41d66c22d30c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc01562015c0ca8e8b03d6dc73ace331

SHA1
5475049e0739b147312304852b53caff80a47cbd

SHA256
ac955f1a332613b9dfa131a89b4abf17f2546bb4f748505b540416f5689c467e

SHA512
3894ec7b40c38b0d2f9d980d929df2e2aadd74a9d96b9d3a49f7a33c57b91bb5f89585c74399ae11e47ec3d39974abed3acf87422743f50fca55020f1ee542e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab19BA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A59.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit