2dee6f3d48a852f78195c7efabbd610b2cf46e5e2c8e78d7df3dc40c5947be3b

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b841894fad4cab072eaef9ab89036f56_JaffaCakes118.html
Size

31KB
MD5

b841894fad4cab072eaef9ab89036f56
SHA1

c512eaffba529da2382dd5e6e7091f8a01695963
SHA256

2dee6f3d48a852f78195c7efabbd610b2cf46e5e2c8e78d7df3dc40c5947be3b
SHA512

88812b34b8efee22a23966ddcb6035c250168b690e86c5f46eea26839e83f77e3d311c843857ce9b7cebf2e39e7565f9805bd1ef9c6c16d242e7d77f1eb600a2
SSDEEP

192:uWHTAb5nVvnQjxn5Q/gnQiebNnynQOkEnt8SnQTbnVnQKMCODAkRyFLqDxcYLujJ:DBQ/RcDhyFuVpLkZQiKJqCQMOWM1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424783800"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{954C2FC1-2C98-11EF-B93A-F6C75F509EE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2968	iexplore.exe
2968	iexplore.exe
1512	IEXPLORE.EXE
1512	IEXPLORE.EXE
1512	IEXPLORE.EXE
1512	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1512	2968	iexplore.exe	28
PID 2968 wrote to memory of 1512	2968	iexplore.exe	28
PID 2968 wrote to memory of 1512	2968	iexplore.exe	28
PID 2968 wrote to memory of 1512	2968	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b841894fad4cab072eaef9ab89036f56_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
532ad4bc3ea0e3e6bb65e7edcabdbff3

SHA1
742d3bfcfb7ab45c7389182ec7a65800e082cca1

SHA256
a36ce6a9384c58b2064a30e7b0a1e5a975b8bf7aff50ce5d6b23d32dc2f3a63c

SHA512
aa5c773c52cd203a0d4ce41364607c62fbda19c10655c101976bf405fa850e74175325b18f46c5557d2c52223a2873393d47bd29e4e3667411d4cd0c87fcc5b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c673eb9db1f486ee45ed0c051d03189

SHA1
b482e65a0762c43c0550a1cb0182248931742bf9

SHA256
3eef2b0097d09c04afd75016aa9a18909e905f53eee21a8a83e9671f4f021476

SHA512
3ddfc72bb72b7a5b3cc4e11efffde6100bf1622c9c5e65532ea3e873b8aa70f036142add7ce315cab2065845cbb0c940f1e2155853d19af8b17b2bf5ec878f7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95bab2d8f2c517cbb9aa4469a69013be

SHA1
b38aefb3e3c652c3824df6dc0d10167bb92d438a

SHA256
ff68967a51c35cd91610bdaf11616b2bd95070c8945711b2e89d9b55600e8a8e

SHA512
96af2619aa517e40803bf1fb29d45a27b23b42c7b568195c95c483b8772c64cbc258e109940c60fd0ffa2c48d090633ad49e88f227d94ec2f7e9df4a9cea85d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e859fa2f8245ae6fc47630328d6ef7f

SHA1
56602be3e99a51064935f408bffc0df8f8b573c7

SHA256
605870415590c14fb4b3ba14c43463edcaae46de959abc7fe85fc1aa5a776ff7

SHA512
b77a62fc70dca712a381909f4c924826d907cc88b15ccfc921445718a91f4725435dff223e85dce57c04a137a88108528829320a1345bc2f989bf9b4053d3a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31ababcd12469d2424941a20fe4fe915

SHA1
cd32d09acd29d19d0bf5ef621b74815926cbc09b

SHA256
c225d3d27aa0bcbeeeb10e18f3b851afab6439ff460c7d389a13002131a1dfc3

SHA512
76c465df31b01d777c1c0fd5de606551ffb76211a4f00019f622af85aa16598dcbe8c78f3ca897fd830fa11cac4dc30e7fa1d94a91169c394ab7b7acd71cb1c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6bf8a2c204846cae3dee01b5523fd79

SHA1
93f3e30ac0d0640a7458615a2acbb3c979974f10

SHA256
5d11afce8ab88c26cad706029e04f842c77ee038a80bd26b478014262c9a30d7

SHA512
e50f94cf21ebe368a4f333ad6042109d4cbb6626d58dfee4afbebd1d7da1bbba1323ea8a85593733be4e9dd15f55fd06140d96018f46aff9cf2387a1a14df345

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d534fdd9feeb3935559c7a3b64450562

SHA1
d3e6f5d1c14b7e5829da95fdab0d4698662c0d05

SHA256
03957767d5977364db66623a76a741a3cf114aee3c0f638a8aff2ccc2743f8f6

SHA512
d64044c10955c35f34e0d1d96a2ac8768c61b803e28eaceebe2c940f780e4023014568c84924ff3398a2a3e202126678933d09fa7e2559f190dce345ddcb5b28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f32ecc3b5d29ac3728ce833c34b68788

SHA1
5a8465d4ee109537b06dc8de0c7b54c53decaee8

SHA256
d9115b905cb5c6b13122e136fefecbf3503c575641d54d9ecef2a87e7a44eb00

SHA512
4860524e4ca6de13a19ec2b46a420480b3e6ec3c29c65b550cfb0ea5f78e341f9fa388da69813e16a16424fe8a6702a75ead8fec59d0d3f3163b6c9d592597e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24e0d3a5a3f2328f92b1519c38ebe857

SHA1
651568515cb5aa7e65e2c94a4b2cdfa527cf424e

SHA256
9e64d670ce51b2ec93f91c1d78bbf0b88f205ea8ca1e9f05e870ba2b56ff129e

SHA512
bbd24aeb44846335442a60395e7a8596dfccc7a4ac97577746e096d74172171b06e139670c21628bc514b32577e769d13529f3b96392152d4a9146f43a4bbda0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD9A.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE4C.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit