3c95318d777f1d6777d180c4ded1e14c8e2655658f974f2d0a628ad8f928fd49

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b68fd0e238e04773b047a9911036bb16_JaffaCakes118.html
Size

21KB
MD5

b68fd0e238e04773b047a9911036bb16
SHA1

5645b40b642a3fd54dc86f515f70f4e6f214278e
SHA256

3c95318d777f1d6777d180c4ded1e14c8e2655658f974f2d0a628ad8f928fd49
SHA512

051dfe742d3565232bbe87788b022b14f1e27a59f3f90a6c13209bfcac1dccd3222130b45fbd8a6e78c242371e66aab0c36703e0be364b6b01cc6cc54923bd28
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIB4HzUnjBh5j82qDB8:SIMd0I5nvHNsv5YxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424757159"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8DECD511-2C5A-11EF-8F1B-D62A3499FE36} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2952	iexplore.exe
2952	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2560	2952	iexplore.exe	28
PID 2952 wrote to memory of 2560	2952	iexplore.exe	28
PID 2952 wrote to memory of 2560	2952	iexplore.exe	28
PID 2952 wrote to memory of 2560	2952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b68fd0e238e04773b047a9911036bb16_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e984c447cc63aa07810443a6c25d8ef7

SHA1
36e667f7691f415fd4063c5866be5013245c90e4

SHA256
7b397212b3dde138d21ae45bc4542ac658c9c31b605c1445efe56b46ba730eeb

SHA512
efe786ae0229b730e0d56e3925d2cca15fc4b713ddbbe8eb55de22c315cf4e7bd9eeaf23e6ea187e164a3e0e124601f16baa9700eec226690b6326468e3ec98c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
129dfe564cb87a766d04f5fff9a09b79

SHA1
b7bdb44230a9e961ae5062064e4ac4a3d9e4e160

SHA256
4fa69702ee11949c9c10a8f4a8340ee45542b25c6c345d8d4b8e12dbd5922c51

SHA512
5feed018aa32dac1b12ef74816c897178eeafc8c7d53df228436b93d3ed20d7cccaa8566d32d1ae90e528e24c1c6cabe41eb4ede56f2490d72aaac160ef2a439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c78983f865aec2387369f3c1151e7bb5

SHA1
79950308467aee6824c0f844fcff38eb6400fb76

SHA256
328ca3f17aeb373325523b3f6a6b439bc25f85508991688aedb1ccf778f45279

SHA512
f7948994a8204d16f4249f287b4c457396147be3a597688803aa6bd99b902ee25fb6553c5ebbcd31bd97c2ddb1306f1b2c52b2a14ebf5c3f13bcc5245c2a3f03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06a73189c13b10908870199250a15dd3

SHA1
ee24c68e9a3370ac27f84862d2e34180b8a44400

SHA256
2d3d3d537648bc2f619849a8eb2ccf5224607161711672c7cfa1049dc6dad78f

SHA512
9022913d16007fa4f63ddf31c0daa470c6ccfd565b145e74a724fd296ea3819acb6d6483706617486ee1797db097aa51a4cc2871ecabad93fa6a6000eabddc20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9946aec195ff3123c4966a43534f1a7

SHA1
fbf7756c444fb54f51f614643df3f4da51ce53b4

SHA256
05c2ccbc586c97381897114d95ca26963d02f6a8d5f40283f4a7813ecefb188b

SHA512
016f2e6d0382532546ecbbc373c556fb3205c31ab64a46cd429ac2ec5cd7731b79a1e795f10a782b1a57d56f08b390e739b6fa65984de35dac334b91da6986a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05bf4ee524558ff73d406731cf0b058d

SHA1
d242f5fde4af193e6201cb2f6caa8dcc30c4ffc2

SHA256
5de4d9cff6080e54da67cfa116d0709a045b7e2a6aeea645c6801b0131d0ec9a

SHA512
d0b13c95ba4a37310785cadff11336e25bd68c377efeb6e2e976de339340f67ab1dbe878114f10834950a016065447a506e41abd4432ce646e75a6f4d4aca03e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92c6fd746dc7486e70608af1980ab770

SHA1
6a2e4866cd5484489d43c46732a606f9ff6aa2e7

SHA256
2c222fe0026e72df66298c4faf4a8bd859af30958c05b43483f711241d0e366b

SHA512
1a84f245ff37281adc5f886d582348a261e60a98e0094483b88773b5d0321892ecc7422d7d2acae066545c7e47c778963849a6002517ee7e264a54bd674789df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
879d372afa2006786b55815e2dde72c9

SHA1
057777a7523d56f17831191059484fd6e6161012

SHA256
98c0bf36552524cff2447c20f12d1c7ed99f1a11bbe8a9d64325ae64a653eeb9

SHA512
fe18a9a557d941c4d97bbfd100e464ee9f916cd253a6dca0213bd7f39a49303ce6716e333c976375901bd238d966f253ec6416e33ecaa94d044b0e5c75d75f4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b997ad144a4aca1b12aff68b42354caf

SHA1
15acd86238481a9b662ec9ad9cbb48cefed77781

SHA256
01fdfa12d1f153f998257556f78da2b1f787d970088642afc570b3e9956bff87

SHA512
e7728db429fade2c513627b6e9c149ab5a4047953ace6518fbf1ff58250e2926e84cae1defd636fb925c838a1418530a77438348607f6409b0ce3a6cf105caa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6BCD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6C8E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit