cf3208f30069df080066b777d17867b80ff0dcde00a3433e746c94e5eb985cb0

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6abb33ea6a83356c3fcfb0325e9ebfd_JaffaCakes118.html
Size

27KB
MD5

b6abb33ea6a83356c3fcfb0325e9ebfd
SHA1

c93c18ad3e01e5c1b2ed165fac7f9e660fa12420
SHA256

cf3208f30069df080066b777d17867b80ff0dcde00a3433e746c94e5eb985cb0
SHA512

0f1cf3dc7a2dccb1ff62990ed1f9b9f156b131f2592c8e172a95eb6fe96a9131e6990f0176c0a2685385b62b3b70ef1f9f1ccfee1fd267f92115efcc2b03447e
SSDEEP

192:uwhVZqIHHqaEb5nU2RFhRapRas9ae8nQjxn5Q/2AnQiey/NnKzdnQOkEnt4qL/nA:HQ/kDACMlSWB84

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424759001"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7ED7C61-2C5E-11EF-A304-E60682B688C9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2744	2148	iexplore.exe	28
PID 2148 wrote to memory of 2744	2148	iexplore.exe	28
PID 2148 wrote to memory of 2744	2148	iexplore.exe	28
PID 2148 wrote to memory of 2744	2148	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b6abb33ea6a83356c3fcfb0325e9ebfd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d0a1eec481db8be90527a7d0c118232

SHA1
7dfb9f359f2f3667e1ff451d64ec26edd8cba647

SHA256
39da1261a91776f3bd843dc5e8fd357cc345dfebe6a82fce377d2e9e4b62920a

SHA512
1355556b58be754c83a149a8a75e2d6d70777ae1d7c1b03d7a18a8a4f82a7fc962cab9ffc298e90c7b4f455944575364fd992b9485b21025b1c9efd0ec301080

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c2b96db0054b12ae264160f07253ee0

SHA1
94f5af54feb879b6355ed1fba206cc9db7d2ca14

SHA256
19e816c9db7b10ca8d496075ef35e32cbdaf86076a6fc4ca82b80e96117c7492

SHA512
d627f65bf07f75e361051bd8e1701239d79f523eb913972d08e030aed6d881a821159c9bdc991ad5dd35801e5674fcf642faa9e14923559222ed5a0f7d60299b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52ae2d6242e0c9ff1b8b870f9565ae15

SHA1
d0cba2d8454fd3e9276bf1d43463c48be69f389e

SHA256
91109076f8beab772a6a263095408d9df7af64e3119d8cf89ff0a30d1e325445

SHA512
a5de11048d09cd6a7c4110d19dbe46ea8bd22b688c70331c342e051c42356ad1540f0982ec448dac0535c4d5c2d151aab5759fd1e32071f4e96b6dc384f493d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9a3bb4891a8d836b58f9ff55140bf0a

SHA1
b1989be6213fa61e16fb4c3f1074e119b052c41a

SHA256
38cb973a4570f023bb60e780cb0c8bf6d3e222cd978b118537b1913f55e76623

SHA512
06b81c81f70108766fcb9c1255448751743ef03eaf71f4994eef5b0ae848a6b92ec1111fb2fdebc37ef79f9da24a0ccd63d05d435070c342bf16703b9e32601f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bac00bb8b68fba4287e4737d4ec9dc79

SHA1
a97d3c592478a631d48b052edebb340c635c2e6f

SHA256
4863655f70426dba12f295733ec1f6efe32c9119faee436e18be3ab9aeea8a8a

SHA512
09c9ad09f1de853891e18a59361e8edc987d5645707655f8e3a7435eb9537dd41543aac0bf20affe4a92ca12835cf44a098764aa846548dce98a4676db6cbae9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fe79e3c79ace8d3a5e97c51fc461c53

SHA1
ee9610e0bbc6332df25268a9e3ae89d452f8bf03

SHA256
b52d5a8b196df4c170d9c26b3f88103f39d77139143ec03afab9e8c34092aa23

SHA512
748b25f0e868dba04268d6d225105e2afc77a86013340f0e5418c1b12bce134ff61ab693ca820b982172c4a08c2e2f5b404d6c8889bda11718f059da892091c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c8cb18d8ad19249799d589d2ef0eb1f

SHA1
0e96d00b5b2450e1b4c04b22231600a12dba28ce

SHA256
10202aa8c54d2f30ae72c08d79b6a74b806dd94303c8f7206497f6d0879613af

SHA512
14d16601cfd2870f2df0bca6bbe3189b2651b8b76764b621fbda02f765a75715634fdd0150d5e20b6a9aea1a48432a0c5b0cfd1cfd6177a03e8f2fc5d04b1b8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53fdd90b70d4c36e7428b7ae93d60600

SHA1
be5c4eca689c9f4dfea0aea2ae06d01a5abb50b5

SHA256
0e7edb90b03437bac3211ab73649ef63a35d53aed551f878379b2bad7d64c53d

SHA512
2e1d1e89a78467dfb1b405be5b7e5276674c57cfe476d4f7466df474ec19295cf2ebe803c3f65af6208953b82e626c5ce9e06718cf940ba9ae6cc3fc255f8516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9da46e9b7ad2729564b9e77c30d27ef3

SHA1
7bf169714c35b4f844d01f1a3f69b29992a03e05

SHA256
f924330d82beddaab7fd5c5cd9e2e173bbced99df800fdab048d6de08ef350cf

SHA512
ca6efa5cd35a9c39e61811fa7a341409ab63d92bb92a9f49a2705553b2492ef852d01f60924fa2d2303cf15e0ff4927a0fa26b1ad83fecb9361c6efa5c35902f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13C1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1493.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit