c88c4da1553a9be8675809013255fdb1eee91ed1564dcac640b1a2f6694a12dc

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b61d849a0f4725cd1a494783eaf122c5_JaffaCakes118.html
Size

17KB
MD5

b61d849a0f4725cd1a494783eaf122c5
SHA1

8d31ca4f59e3764e2839e06b905edf6a79ba6420
SHA256

c88c4da1553a9be8675809013255fdb1eee91ed1564dcac640b1a2f6694a12dc
SHA512

2a041353e98769913a3f96a70ad254494caade9f522a6abbbbc0eaf9ccd1f800bd73bbd6c01c80f2d505a7c1ad011862c672b9be29be0f533ff1bd26bd32d1a9
SSDEEP

384:0uMctyFm2TaodSTbpk7oqgo0UhPqWDLPxxTV26:ftuaJTb/yLPqWD7TV26

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{834BDA71-2C46-11EF-B54F-5EB6CE0B107A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424748551"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1536	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1536	iexplore.exe
1536	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 2528	1536	iexplore.exe	28
PID 1536 wrote to memory of 2528	1536	iexplore.exe	28
PID 1536 wrote to memory of 2528	1536	iexplore.exe	28
PID 1536 wrote to memory of 2528	1536	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b61d849a0f4725cd1a494783eaf122c5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1536 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0cd5262cc43ef017552fe72144c20448

SHA1
2669836870f6394393af195290e4457476653752

SHA256
f01bb3c7f012873548285b3ca1f249cbb769793344abf6fb939d4e9782ab0f79

SHA512
45b7b1f38c7913b53fbc2050572ecfc38728fd1b3b9eb3ba5ad5c0bf206416d5816cf0a2365d425015ab448c8a7c4ccd1f0df82b0c8bd76952c48a93330de7c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6ba2ad1ae4265de5144195fba234eec8

SHA1
7334884b42aa1b724afd39bc0ab6d70cd0701a8a

SHA256
9f61003e2659706e4a4f386cf36429c2ae3daafb2736af3036638a68fad62f11

SHA512
e6095ab3a3338bd30e45542894f1ba0bef18ecccc8ebeba8ebfd953fdeb7170638cfefea8fb8d68ff0550b33cc62b1751b4d8a0e9d9303d9eca449d87ef77da7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5a87eb26357a39bd28300b26097b77ac

SHA1
35cf053b454d68e4fabaa6afb80f9677ff05bae0

SHA256
d2d4b805db31a1e34cea6d0b58a789e57c22b2bdf4e9f8a31652c372106f1ceb

SHA512
55348c2d3757324613db6ce1f8bc1d82330efb393106add4339752cd40884e7b6f9f0115c1ffbe965963ed2b8515c49904510f0060e72ce109789a73432b969c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6575aab580ee5d6c0dcdb84c486d8e8c

SHA1
f28773271d22d89499f12cf5e6a804eb8df83fa2

SHA256
f2cc0a42648dd1c4c2ffb7d61cbf5dc4aa857f0fbd1e1545f6120c962568b4f7

SHA512
54dd60689de9faac8a36e687671cb410b0202e482cdb26a021922a3110b822383a54fad7df7233ae6f97ccd58b859fcf22a6be3340b859fbdc9340f7abd9cf88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cb37bb390806b929d9cb7b8b5ae353ba

SHA1
85e14e1d3e8776a1374a7294fa0cc21eac5d1a2f

SHA256
f84c22d0c98098bed8cb8053ce75ba22a362b8efb0e738f28a1214fc55638451

SHA512
ba7c3d8493531918eed91be22b0a659f58bd8561aaf8bb1c6b56a4f9dbe1fec0ab531e9aec66c016272f82eda3ae1bcf22ca461511368e6d436a5e9cda4c4428

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4279771b0fc4632b7b08104525b47b2a

SHA1
6f2c9b6c3db4a206fecc64f238395d5d72cb6b7a

SHA256
252e7301176940980b511aa205c4ff99ba7d7d7f99bf3845bd693b422bbbd848

SHA512
65392f661f0507011aff47ee0dc55f1a80610e17da55720b556a33a18e23a90214d7fc8d9fd68aecf7865380b9c320c293d679883949ea927d6854e678eac636

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5c45c2f7cfab49337b18ef732c7f1f3d

SHA1
0eed1652cf926cb8fba281743486d8d6a5de512c

SHA256
9f678d3b8054a265b0ad4bc4989dfdb33c29f56b8334992db016acb027e29df5

SHA512
a81707716f6280e9fb6da54cdf4ae34757d3fbc202f24595c7b3cf0c6fd29256465026cf80d05e8c2b5fafc4a000aecc6bceb7ba880678f11a1c3b341a10a462

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
df472edfd66a25f8c1e4f41f16f5ad18

SHA1
aaafde6ff16422d33e85113f1cbc0bf01bbc1d86

SHA256
4e972c3c0a2baeee5e27775307183ec7cc21ecee5b1a42c07328681a4a0b4301

SHA512
331950ad384e054d29c9c70243a5786e9c57f993ce6b7df1c7c8327393f4b037e03932a888b489aa231a55e2a1ac0b7d62bc8f96b0b20e2906442c22fc24fe14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
82bbc220271d33c2049726a79d65d106

SHA1
fa8162858f42bc3270d509ab2a065b2b78fefb84

SHA256
036eb1f981caebff540218802a9dbcef6e6ac705f7b2c2d631afc904f55339e5

SHA512
091a6f74fb95846c46c17f5dd03a64f1f6b1124da3eeb5f679cab21ae9df0f2242002ada126d28002be36e1f8ef32fcbb04b70f2ffad30b137c7d80ace18a6ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab83D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar91E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit