5196419182ba741c3023cca721e14c6e1fa6f110ac6eea8d2a8ae0d07b1aff0d

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b7f4b812923acf8b3bedf2185545ee8a_JaffaCakes118.html
Size

34KB
MD5

b7f4b812923acf8b3bedf2185545ee8a
SHA1

0c80ee4e20fbc204305df2e6ae47d74d53a4dd1d
SHA256

5196419182ba741c3023cca721e14c6e1fa6f110ac6eea8d2a8ae0d07b1aff0d
SHA512

c966f2705a059a0934d6f14ab960c747202f9f312152a2348930f77a54dc2378555a64d4068c429b6d53991d9f9574d7936e86900af9a80c2eb9e337e129dc76
SSDEEP

192:uwHNb5nLunQjxn5Q/KnQiepNnmnQOkEntqwnQTbnJnQOgkcwqYFcwqYhcwqYQBnv:bQ/DEt/5BnDOrpe0AfDN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1DFA16D1-2C8E-11EF-B3FC-D2ACEE0A983D} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424779305"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2996	iexplore.exe
2996	iexplore.exe
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2188	2996	iexplore.exe	28
PID 2996 wrote to memory of 2188	2996	iexplore.exe	28
PID 2996 wrote to memory of 2188	2996	iexplore.exe	28
PID 2996 wrote to memory of 2188	2996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b7f4b812923acf8b3bedf2185545ee8a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
507bbfee2c02d84fd155d5ba59e02869

SHA1
999dbca75de1b99d835c1c4677e0912000a7f2b8

SHA256
a46a1cdf27f7e700e599b8e920945bd883ae5c18059152e4f72cb810b9a51663

SHA512
e96406db579eaddabcbe3ad3f0d3fd880e3368e17e09149cbb6f240de6b3a48a1256bbcd9b71d412ff8a2199b9e2674864c42c97318136cf43259398f339543e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd1d0797805df9f0c4813f63390bd6b4

SHA1
85c355c4f73e6ba0b05158457b83a554b326e5e6

SHA256
e260a372ae9dfe3fb2076704f16eddb369a52751a11a2694425e4ffe8794ee8c

SHA512
a71b7441d0c77c945c4e4e1758903aac9e38a1a99317e160eae492b7297df5ae5a4d5631155a453820ee50a6d77f1bb3e26691f7febabd1807683d89c3436f41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88b514ae0fab01d945da21a6ac543507

SHA1
0029b06c61b3e0820d7c21deb6879f54ba24fb68

SHA256
fe63cc43fc85e9a719fb3f3afd217a0c3ff38ca6499aace6ad4ded9e2fd51a41

SHA512
c7581ff39a1e55112184e74c94d774da58f58c29f874898f4559bdd71810006e4eb550b79f9a3bf6f0c6fd1d18e17e9066105505e1bdac702e01acb562d4ba2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c73c77bce85e81d5a5794c7ccdc31f6

SHA1
419b5d0318d8cb94cbe4bb2e507fd3d99e956cd8

SHA256
e57d6b27dd1aff28092cdc3a481dc19580e87811fd5cc891207236e995dfb138

SHA512
5768dc46e40d327064b0b25f3e7e58bb11cc7a1110f0d6d568a296745c1d4a4d1a360114a4b5b27cc6b327031bcfd99a2164b01bf29926277e721f49cd0c6c00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8af6c4e5bb806c166966efdc60b69cd

SHA1
1bcbec33e3c0e6a6ebb2ea8abe9330801dc157e7

SHA256
3041f138b053659a7ee33b32a05d22a8e337811c4f46cf878f1d0f7a259dbf90

SHA512
2a3b9484ef0b4e16ebfaf1e215330f9dc4ba4f6d1ec58cdd24fc7a2556ee99b6395987233eef280a99d85ec95d3f5bae7961d620fa16dddabeaef4c264f1487e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49c3f4c4c4e63b3f4cf4a9289a7bef2a

SHA1
8f47b0b292ea65699a62f969c452ba6a32327d84

SHA256
5527ea18b136dc00dd13710c7397d3977c7806f4d8b3d7260bc324193f3d2398

SHA512
543c85e0bc4feff95921b23e7b901aab470142e793e253fbc9c67dfec79c8952610a354ce600c783da2fc56be8f4d4c3197419c0744608e2a833692f5c10b14d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8db4cc8f2dfaf47628b0b696d68ba30

SHA1
10136acf7d272b1b191d498830da65a7d07b7b71

SHA256
33e6255beb3ceff553bbeb293202508e0e9bfde89595fa9c8fdf749f87a5d6a4

SHA512
b216f56b979681bc8b36dd8638d01db891438ab6c50e1079b56ecde36802418cf26f25492d44669f4bc212c7ffeb35480c7fb09950a1b4d7da851f0d2f3d37e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a364229303cc6f44dc10ca8b3cd2d7e3

SHA1
e21c272a2e4fd98814890d1e4854fd56cbb2120b

SHA256
9a0bda4c44f6f9e207d1073c636a763bf85ac4af3336b8f6aa6a52d8b79cbae2

SHA512
a3c6d9df78ea0c05257f292810165591b2a0cfb2fdafbc569c3b07a09bb25723bf918072f687c7b57a3f3a8f2ccd4cd1546b403394ed980b9539aec354890846

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54a5bed5831449b2104c9db8891a6c8a

SHA1
f1ccf0bf0c47a507e16945c6e055d0a39871d71b

SHA256
2401f7e7ae9f58ca6cd351ad1b06b996c47d2c3c408fdad6ad3eab2783acf4da

SHA512
68fada30d18f431b44469f324a9e278969389683b02d15a228a8cd833da861a6cf6dd8f0566e351cf558f5d0772d7b85a28ee746519e663fe16318d2e21ae771

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
249e80ed9dac682aaf294de3a1c77078

SHA1
38c95151ab0764dfcfb2bb36a2c0bc1e1432c917

SHA256
cd066df901ce4c9e4447fe8cb45b9e3134d3144a5f21b80b4756bbe0a5fd57eb

SHA512
6f9aac1c3fc446bd80a2e163f86291c37247e2e3727c7d7afa4d3aee7ebe545879689a64e24b7fea8134a48620508946df9ba3adf565de8745543a09e349a768

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5A52.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5AF1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit