6e59540c0be2b8257779d3f5e67353e8826b2bac1763fdd30f143621365bf2aa

Analysis

max time kernel
149s
max time network
156s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7a1715cf4eee9b369c618541c97479c_JaffaCakes118.html
Size

23KB
MD5

b7a1715cf4eee9b369c618541c97479c
SHA1

27c38440a6aabb6a3c8d86ed9c079cac852b5b67
SHA256

6e59540c0be2b8257779d3f5e67353e8826b2bac1763fdd30f143621365bf2aa
SHA512

cb32cd401c64b1560eedef8672080eb9f5402a841b147e826799eb3df3220a9963e3da03c295ea7d7cbccfc916fed1c9ccbeed43862c0c9a729bfeb1b9324c34
SSDEEP

192:uWnob5nOOnQjxn5Q/lnQieYNnQnQOkEntrjnQTbnxnQqCnQtKwMB4qnYnQ7tnuYU:LQ/GiP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB723801-2C82-11EF-8B35-D2952450F783} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424774523"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2784	2208	iexplore.exe	28
PID 2208 wrote to memory of 2784	2208	iexplore.exe	28
PID 2208 wrote to memory of 2784	2208	iexplore.exe	28
PID 2208 wrote to memory of 2784	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b7a1715cf4eee9b369c618541c97479c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae97b881b46c009ee6af965f222f1b97

SHA1
dbf51ea4b4e4c1da9899a8cc99db0aa69146d79f

SHA256
9d64a724ef13b9f336ba16848399fe8f62f3e42b60d601ceceec50ed9a9d7e05

SHA512
efb4dc70880b8bc4a097fccd8c7fbb03003525badc61b4c2793561a51393df73d2eeaf56dabd02d9c29edb79d118c07471d836450db6e9158beb9a45fc607965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18ec7365272505431ebbfc20624eb7ac

SHA1
f9a5238a33e93338950f8f0047439c0ae7171453

SHA256
78275f97949517bfc6e32e3b572888f508f6eed3886001167e17c19b738aaf79

SHA512
f69ac5db578fbe4a3ddf021449fa30399304062ded87484c23d67aa84b58821078726ed26266197762cfaf1cb183a5ddcff2baee009b06b164fead454d2a8065

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66b8aa416b13ef53ab95fb1d745632f0

SHA1
300c667489380dd24211d291e63f58bdbd930685

SHA256
c269096b94be2e170ca31e56db0133a27f1287775dbc7868bc568c368d914eb8

SHA512
60e7dc1c327fa132040c0a254d42b267c7adf320ee6e6680f91d7309542f8a00bbe89e770113303deb89c3b52ec209221b9e578c04804bac9e3d0789cfe726fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e631e820b56de002728d7819f1464466

SHA1
e172a590ef9834bc66ee103b7f05d07df7c302af

SHA256
dbc2c739fa01071959855e3a480d75bf45efd06e2977764b1a92a0aab7b9e852

SHA512
02c4a7739adecaa3a8181e871a33bafb042666577568fc82b8e371f2ac5dd152a640d11b028d711785f95d7eb2fd7751e6e78945d9e33a0b0aa1f067da4d1e1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e85ac2c838ab368e17212ba491676ef

SHA1
d1df6a8a732acd771ca6bb4a9b8fa2579410ab68

SHA256
ed9ca3c890b93f887ab8c76dac1c24b61bbd8e0c46e9fbf03c0798c2d1953f2c

SHA512
f0998bb9c8adc1f239baddf04bf49d814702cfbe9edfe3c2f321de28909fc6c753b35d92a7437a50f651ae5a8ff2fde490616d8e0962fda2a4ef4460e413e028

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2399312a1affd696fb64a2ef2da66823

SHA1
db4c363d1075e9f3e502faf091ff85daedb30b1d

SHA256
6fbcab44fd49265fa9c70b846e79300a2ced5b7f6c6bc12b3f7456419142a98d

SHA512
60064c3d80408c5713570f8db5b8fd99516fd984fcccd8fbf73e06116212ced86818c8e372fad2b9d66b1fd9d3b98584dcead0fd8fa9750a59eb1e6a4cccc63e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e45eaa7de93542a82e70a464a79fdc29

SHA1
3cb06d9c7841c7bedc9701aa7689cc93a3b572ea

SHA256
60b8c22a4bc9b1b1bbe5f2b160d67e10c4c756c153f86ca70a8eed00689d21ea

SHA512
10302ddc4980b784ad1764fc603aae1d2536bb41ba1c52ad90dc69ceaee4cfa974e0a2268d4ecfae8aed3c2307d620bad5e859a0a631a4da72dab8d6d8c3794f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46720f39abf75df9b0a106f7d8e91f86

SHA1
bf33f1edf9861eb21c2d7fdeb1cb644291599e22

SHA256
52b49c78c17fc07e8fb30b76555bb0f151d846451bbafc171037c5458c5262f2

SHA512
ad0e1a6601975a6f118b7add4be40dcc61096f6f45734c10b4b2870a1bf596d2020de2d3d9c66d0afcc6b8436a2f1f975666fd4ed322c87e1e9125e9ec07f9a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6E4F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6EFE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit