cb35583f7539b4d070438fe80664d2836451be2747e45a517e177761e76957ab

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b68df201992aca37fbbf8890b9cfbb4f_JaffaCakes118.html
Size

23KB
MD5

b68df201992aca37fbbf8890b9cfbb4f
SHA1

49e4a485c760cbf61db0273609f6b1f99507c271
SHA256

cb35583f7539b4d070438fe80664d2836451be2747e45a517e177761e76957ab
SHA512

488f730a8aab3a572e41a05cb11155c1aaf74fc72c8c037ea97570d6c34d968f0473c833d2bdaa8421cb04a9b460ae621f1ca147bfc2ad427b78c847dfb3cebf
SSDEEP

192:uWLcb5nrynQjxn5Q/6nQieRNnDnQOkEntKcnQTbnFnQ7CnQtNwMBxqnYnQ7tn0YB:WQ/1/et

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D5F7A51-2C5A-11EF-B6C6-7E1039193522} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424756970"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 3020	1732	iexplore.exe	28
PID 1732 wrote to memory of 3020	1732	iexplore.exe	28
PID 1732 wrote to memory of 3020	1732	iexplore.exe	28
PID 1732 wrote to memory of 3020	1732	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b68df201992aca37fbbf8890b9cfbb4f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78ec8ab08cb8634b23a6ccb606c66ee2

SHA1
940e3b0e32a5a5e07926ceba0a45139e1f69c4a1

SHA256
15fc0cdeb99194042bd19436d32f5620c2e86ca9e3fde1b04fedc556c43d3c88

SHA512
4f4f70b5d5ca937a7779b2531c6ae030a2e91badf8f557fd30dc9b3766763b7260c4107dd631d193e6621a2ca7cb4c836a8ede55896ae40c78a516a4f6efb551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f89b64faeecabada950dc665b75e5626

SHA1
f6b5cb602f75ca4dea7d5d3e03224bcfce04af42

SHA256
9348bb5d5c26534414f2db8883da13f1b90bf111fc6199a9afde162a58b82547

SHA512
8c016713554d75a8308ab895d0f2b2200152f7dc8e91a76dcf91f693c5aeb3d8d9c2c8bf19c9c4ea5179eaa945bda12f79cd43578436b128cc62eea964705e49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d673ec6f318a0170258267e204975522

SHA1
ba995b8f7555f5d90670d84d13fe7b2410c07871

SHA256
60865d8aba91ebbb7fa7a0759b348c2af733515cc85918a05585c541011b8a81

SHA512
25a48839cc1e78d36f1c8d8fffa39c12fd24b8c406ab323e69cd4a425b7eba6fedf9af5a552dd61a7f4fd3f8a3287f8466b86c1f450ecfe37acd1a2eea906596

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7ab2f85b168f79bba70c2f620561dd7

SHA1
6b323c3fbf74afb406b3d5d1afb8ac08b14120ba

SHA256
773f4539e2ba009c43b161883d3e494b25695a544f2d60ee9e5ff93c4bf732f4

SHA512
2b2219db5d85fad8828fe5f89f62acaef7872ce1525fa40070b7103fe2facb14954d44ab6c5a7d946c380c7917d9ebe5ce41f805f9a50d3a1919f7b00d8ab4fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15b5860a083e7f171493c2d1c136a0f1

SHA1
148620767fff46c9db0e719ba9e9266c3339110a

SHA256
d1fab45c7d17b488578f8ff28e13e47a3fa86d3823ee37cf83cb0e4997d0eee2

SHA512
83a4d3da87b87fa17cdf6c82ab4675f09fba0bfddd5fbf6da8b1b3518ea0dc9db5715cb0768801d37e14ddfd2fd8137628217e2de46dab0b6e2027aea5f96297

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af79b1db7133212b1d24cfca609e3b6d

SHA1
ccb4d1f372cdc2bfe7e403e8f2280548c14536ee

SHA256
6f26ca6db8be3b9cb6d64b37d02efcf699f3deb7bf54f6ee9de3db7a151e011b

SHA512
977ca2a182b1cd8d1370cdd891583ebb896d61610268b5ddcbd948d7dd1ce2324b2f411e73b3dc0dcc62380b5c0f36bfb9e1d1b4bd78c8ef49c5b4c1e7e925b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15ad2b0538f8bb9ed6605ebd78b02e3a

SHA1
eefe1614db02cbb129a874bb57502f96df7fb634

SHA256
90c34a49b60a9a6e3d006764b54a7ac9efe25198890f57659430f997aefbf267

SHA512
9f057255ae29943670274d680812ed05e60bee2834fc7ec75dfbbe8823186f899963397e72a558f2219fe1bddf16033be5f2c89f36fc20ea2a3a64a2147ab6af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db087e9a4ee888e6a60af7f1872c50d3

SHA1
d1208023d02cac6bf62aa9fa5bd00b322f50f7be

SHA256
964379092853d6bcb95d11ffdf22b7804d221b01a5888a9f0a49fb2c0fbfaac8

SHA512
791aa6fc249752602ac712bf4365b41dce6c7433b8cde39e2c01c619f556721b211a73972d8f7fd4574e6e2cac45c7a40cb5605c954973ac1896670e11a457f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b911b2179375fa89153df8dce5a4947d

SHA1
fd321d67ce3a7000cc6aeda6ed33b3dc5aecb24f

SHA256
090bb642121fafc421ab7ce47a422e849947312bf48e9f510e5f44828e6a0932

SHA512
89c202a4f7bfd78fb01bff1f2cf73a0678b104e4ffe2aa3463065cee4eae4c704a9754bc40b99cce7607096e2f4250d5250da692539b4e4967b36748f67127a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC21.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCB3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit