dacb6fac31be538c98942304a3a1f1ea1ba47300996cec0223c2940bee6b3873

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b665427d847dd37db369614e212732b6_JaffaCakes118.html
Size

23KB
MD5

b665427d847dd37db369614e212732b6
SHA1

ee70c321e128698499c83baef184871c463dbe9e
SHA256

dacb6fac31be538c98942304a3a1f1ea1ba47300996cec0223c2940bee6b3873
SHA512

e8cb91c8c5a217f96ccdc537a2889ead1b00d3d8fc16e7cfd898bac384628e03844be0b372e70b878b3d8598e2734464fb7967f214d3ac1c462f11ad8b730221
SSDEEP

192:uwjhb5nYWnQjxn5Q/jnQieSNn3nQOkEntxdnQTbnJnQKdjgvMByqnYnQ7tniYUnb:IQ/GT8b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424753551"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27806101-2C52-11EF-A5CD-D671A15513D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2464	2032	iexplore.exe	28
PID 2032 wrote to memory of 2464	2032	iexplore.exe	28
PID 2032 wrote to memory of 2464	2032	iexplore.exe	28
PID 2032 wrote to memory of 2464	2032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b665427d847dd37db369614e212732b6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b8192ce6b9e9193a62a47f7358cad18

SHA1
4e8599f9ed85cd9f157e4dcf4f973decce06704f

SHA256
43059a7af1e46c42fe703742662f447b61b05fbf13fa86d0f28265df5eec47ff

SHA512
e06c4764d9e62254bac8cbe668e7fba6455f09f66f849e045a60c3223b46bc4372cdbe23212aa7da4accc78b4cd185328cb63fd3f056bb1089ab9430ab7d776d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22f67572b14f3495f2cbf783530aca6b

SHA1
f06cec1060917bcd9d42de1e80d3b94b57e9d6b7

SHA256
7e919a4248e0575621640699dfae797fad530af74c09c964c1020464dfa65a16

SHA512
072d91b08266fea23f6254d727fd04cea391484d0a9b6647f77d5d00fc6014801029a653cd0f83b379555b70a5cba238457cf5dfb111ed3d579c75dc0fb64e1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb01b6c95796fde4f9d1dee3acd389cb

SHA1
2c5d7f62fc4ec2cc93383ed55684996c17c5cead

SHA256
16fd5f798e16f906b5477fe818597ba6b672c1b46a265a44a82d049e63a42c5f

SHA512
38d10e786f685a48b14022146bb4981fe7063a21f7a80ac1226a86ca788a334cbe8c79763f8398e1ac41df5059ed49904cc30554c8711121c88f4c85ccba11a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55f7002496d4119df98785d2e4952086

SHA1
346b7d7981442aabd94ed931015f22168c957284

SHA256
c3e353ab6ab17d1b525459f04cf83d59073ab2dabdbc544a954f901eb4be07f9

SHA512
fab6a1bc8c3285a318711a033eaae30111b2ed1612736d199b8955580bf98070369fc8b9a67ecd239da37e56439e2e76190389299fcf26bed4751605589418b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
065080c3c42be7f33e77ea49779769a7

SHA1
d6ef407447bed5b86e698de1915beff1f5add100

SHA256
3fda28be63c2e312167e3e9d86c0644f20d27d583cd18f7989a9208974a81772

SHA512
94940c734d8ca7712c4781f1e70486c3f4a4489c804c8c800f7b7b3cac08f2ffa6c6b04c6b630b285c4dbd273d10bd8200135d966b074d9ca7f232df765f797a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
629e1323e2e26c049724432e084506d6

SHA1
aaa8320c6e0f9bd42ae262c9e39fb9bd19101548

SHA256
f0adf41eff54c95d8e34b3cd245cf84d4d2094d728435166ba6c56979f503074

SHA512
16f40c665a081012838c9e9e869d9d24fc29218ae968d0f9905264914b26661cf5aae2e342e0331d69980aed99a5a345abda230affa81ad66a729a074ed1d41f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84bc6765158b186e06b7a76097f0ad4b

SHA1
73184bbcc8c47ee12d40458e2ed2f82946ac395e

SHA256
46e221161421ce89229583ee35616a12afd9d3f86b52d2fe85cc6b09c02426a7

SHA512
d03c4e83133fab7efb075dbe049abaff3d316131c873d6b385602df22dfff198a50ef7652cd661507e02505592174eafbb60a0c8459e9a8e98063854f2914a91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8c3a0414a1fb08c9e31c7b1c8d88f5d

SHA1
fd5f4b7e830e8bb4dc4599c0721f6f7f788801c6

SHA256
d8aeed088d370774f3bd483ea84829ef7f38ed5a131b5a6bfa33b0191b4af045

SHA512
725f92caa41b5e965387dfa367555d6a824e2d0da3be48861f1d34449e0b731af57f2ee967fd2a3fa28d8c0c016b5bba74a7c2359a7afa755d828113cc0c30a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fb2301e3198827ea241473e27e7d387

SHA1
9229e16efd6b6d1e0f741ba6337889f3491a31e9

SHA256
ec6709e168810febf001ed4c404e538b397bf076ae754aef9b5839aa33d91648

SHA512
2e4b5cb568844fb83893930e8046ed53c4c1ecc58167c77ff6cea2a483d3d408a19706cba91e2bd06288fa40128dc317a90f1108c84f26ea36abfd700f4046bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab230D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar23BB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit