d24aa7a0d7d3711d3c213568601c971e750ce2e9e42167772459771775bd207f

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b69727017c9e6734bd48a30c333dd1c3_JaffaCakes118.html
Size

27KB
MD5

b69727017c9e6734bd48a30c333dd1c3
SHA1

2342d900fe2f4acffa4a46f5e7872479ae33fd45
SHA256

d24aa7a0d7d3711d3c213568601c971e750ce2e9e42167772459771775bd207f
SHA512

2502372e95a4971c241a0dd6d3b9953d091a7080468b1d9f411ee7c00cf860656225183596a46c4c2d01759e3699907c64648f242e5233c5555bdc05d3fe8771
SSDEEP

768:VS8FJ+xz0RS8W+bwvf6lJ8bw4YpHS69NG2gp54W1f1pWIO5alYrlNXpYGplT9OdE:VS8FJ+xz0RS8W+bwvf6lJ8bw4YpHS69D

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A13D2601-2C5B-11EF-B98D-FE0070C7CB2B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424757621"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2668	2208	iexplore.exe	28
PID 2208 wrote to memory of 2668	2208	iexplore.exe	28
PID 2208 wrote to memory of 2668	2208	iexplore.exe	28
PID 2208 wrote to memory of 2668	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b69727017c9e6734bd48a30c333dd1c3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb90da4ab1b91e3e9a94a1d6a514268a

SHA1
387c727d5979bf1ca753880654a11d8efa6e4918

SHA256
9d43e6250cae85b392af8716b3279c92d842f90429a3ea248867101de8b350a8

SHA512
a949245871bb436bc79b56e1085cae4ae08e81ac7ded07c9a218157716888884191666131604f10303ddc421a647e853829002de2bf142782821297fe6f4720f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02e625e55384c26d8af7c64279ea5a79

SHA1
52e8bde83b23ac98976b2c64585292000a501fca

SHA256
bfbf8a1a0cc334d039061ceb5eaf5858c4f6c6b71bb561d78a198fe3cb8e80ab

SHA512
66da481c7cd93ee5cec7f4b527ba461dc870c702bd7f066f5425f9217602b018b93c85475450e86032bf471cb68e17cbc31789b65742a50d2438a3c78d3b7697

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbad2bdb6c250205a5db2d0498226ee4

SHA1
050256476d1c84c3df58677dd7ca7512a4add4c7

SHA256
e9a74c66c0b7d91077887d2d1624d860d4871375eb45171571ab3a889c6c9f73

SHA512
d0aeccb7799ce889de3bd8230fbbec56a42df001d13225ebb6fef32500b0a8715dbb2acea12ec00a9b91d1ab8314ab7df9b45b859bb7cb28f02a58a5fb1d9725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1525a40aef3c3b7d86c1b1e91db6c68

SHA1
0104b2b9b36d59b99b7579960ac87583aaa6a9db

SHA256
a9bd0bdcf391fcd0030ed3585869702a4047482359774e45b1dd1702c600dbfe

SHA512
247572fd957344d62dc135b0676b836a4a5b14d62d10d02558f44921fc4ecc022d8f00e924e91cf3181fa6cb88684f74985757cbbf53a990f24038bc3afc9bc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ef64bde6555f4820ccfc83ac8230bb9

SHA1
0b4e954be862865f7bbee8fa8fbc7836cf888ba4

SHA256
99edad6644aa8e14514f9f433357ab6c036686988308f8ad3066e965bded957c

SHA512
7e53d187328ec86d3f100771b54a1acff248117e76700094b7ac7dc4c8ef43db8941a6d47cc7134e10684a61f6e8ad4edb6d41936e5be43575ea77cf5434bcbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adbd0b3d1e46b6a1123a7cdb8ad1e035

SHA1
dc6edd20d75d9d3c4f232304e91c2a5f7c031ee4

SHA256
e386ff5ec78616d0969f51a36fb94ca6b59cebd1c00d968ceabf84bd3c945dcd

SHA512
c5666caecfe38c776a3c82cf15cbf42d0e064213fe77d0b594f80a0c7fe4d240daeec66b6ddc6e9b866f83b3dfe65a1af76e81e49606e2fd7642e2f2aba5d3ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
117ec5baea80bad80d56156cdd9ec27c

SHA1
06cd4c24d3c54f5c78794cec2f477d0d860976bf

SHA256
2f2b709ce4bc350f51324a4c47717218fd95ad0f9ef7defae904b8f83d979169

SHA512
12772d515c030f37e41153fcf23ea6ab58c5ee84af3654b32fbf2cfb387dbed6ac0e856ee6fdacfef9b037538565ee1c56cd9e2b545698456fedbc9326ce5fe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ceb2f80edc23e0b8c24336945f6f6c2

SHA1
ec16cf9f67695c797c5c07b570662edb0e2489fd

SHA256
f12a49736655d286199e92e88bb48d4c6314bf0076f4a18871426f74652a00b3

SHA512
83d470406b0ab0138793d0358473d423fd351a4f44e91f2e093975a4f76c2d50bf3d8aaefbf91dee34c5db72c416b13b2712e56e353e48f52eff1f2d29069113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
305bcc6e3e572083f73b6edd1520b981

SHA1
7b37617f64e6ced7c53431370bbc0e6443749db4

SHA256
54b480aa3e8b403f366e5bec8d45eec55db38730b7222b8d0c2ea039940bc37b

SHA512
4009041ef9ed5c1434c8371f73fc59834d45e3a7c5f78efbb6600904e73b1527b8b816b23e57e9d40e475da031ef123f4fe06d81a9622031bb1ea5ee6f79479a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
383799f3152d099feb3223c4176d0449

SHA1
fac7715bd79a4cad3f89c1e1ad7d7cd858df7cb8

SHA256
95e49baef37012df67a3b29d08167c5519e393a2d3030fc8e0b08796fa98180c

SHA512
96c48df81f2ba73f8aee189afe6a2178a67e8431d048f1e6b05ce6c4c4b29782913896ed10300757496f78aac74c61d752d6c6aad3f51307c0d862df00a8d17f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc01c6585c26a321b117316ccbf1c0f6

SHA1
5930de3fe7767e80b0dde3e737bd7d35247813f3

SHA256
9e411f9e37ea447711b3783f733d9d541bc800a83a9b288673a0ee348e8cf39c

SHA512
73c385c33840d8ccf6c77997b0dc3a5c69424173baaf39eadbe42335200d4a120a7656e03790d06b55154a7fdda8e147c7262d1c4e23d80cffe550e6b085830c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab566C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5739.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit