a479bc8da5c6339b7c7d7753bf94bb02d29e5fc335f2b74bf86083b9521522ec

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b856dcbc3b9b2ae85f5764154ebb0954_JaffaCakes118.html
Size

27KB
MD5

b856dcbc3b9b2ae85f5764154ebb0954
SHA1

796afc44072f106629a8b27d9d1a8cc55543bfbe
SHA256

a479bc8da5c6339b7c7d7753bf94bb02d29e5fc335f2b74bf86083b9521522ec
SHA512

c521a2d574d2d5936ce4ce71b2c6780825851cd3570e3001095fb0ccbffe1130a479034fbfb894834aa4c65982a0fac491e31a7afbd4e46f79b1afdb810cd0cb
SSDEEP

192:uwX8b5nvunQjxn5Q/+nQietNnCnQOkEntCAnQTbnpnQ9exlm6unLVQl7MBNqnYnV:KQ/8I/iLUSX48

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424785115"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4C13831-2C9B-11EF-917B-C299D158824A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2912	iexplore.exe
2912	iexplore.exe
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2428	2912	iexplore.exe	28
PID 2912 wrote to memory of 2428	2912	iexplore.exe	28
PID 2912 wrote to memory of 2428	2912	iexplore.exe	28
PID 2912 wrote to memory of 2428	2912	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b856dcbc3b9b2ae85f5764154ebb0954_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d1b46c0831d514f5d4d50b024a60033

SHA1
3026a73a11c071d6fd1d6287de7ca81d3c936caa

SHA256
91b70e69c237cf8c907deb4b5e6d452601346727ab461d3b597457e1279890bf

SHA512
8efe562cada8ec804d6816e3df525ac5edb4aaecf0fffedd8f7b3ae29ee51d221e0597b5945d37eee56465c139279be59dfe54ad82474306c12bb4f99c52aa96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e3a6f5d4de6623798b3f44baf147861

SHA1
8762007516bb718b2ff7b08eaa4fe039ee015f04

SHA256
d09de10bef28eac2d1815a6487edb11a002f790d5baa0c03891dca09a1848f7f

SHA512
1373a3a216517fdc43e532d0d8d950c8224a1897656aa432e90a6a6ad76c4eb2858e183ea725776167b551425525d6a3b9583eedb53c3281beef7f78bf64fc93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be45cc9d48a848efcd692bbccf4cb138

SHA1
bbc1eb4cef75a619fd7a44c036b05df9cc6b0cb0

SHA256
e1c78592b8e2eb48803e1700e91ff5726b2ec897923ee638d6c48b80ce962b43

SHA512
70c656450d3c78b3f45f91a7b052fb09e3459243873e2a2df54243a9d5fe29b1437ac56a2f684afedc22995aa29d20a86940b0a014528fd98b38e87e2ca28227

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2baa915dfcc4a1c6806cc02fede1a96c

SHA1
186960fee071e2360caaacf081056f29edea285f

SHA256
b15f88b30d70bcf2caf9464fabe4c2ba48d0c7b40bd6ee345bb72b15d47c4d25

SHA512
97d732c08147196145f21cc97657e885062915fcaa3eceb4f0a06e11c7ea088054f1e6a79f12d745714f1aac557803687710e9cf51b1a1a6fddc062926d96f43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76af15cbb0cecf41ba162a872df6faa0

SHA1
4b720e60849c458e5e646599be245c2da31c67c1

SHA256
8da4b2985b2dcb5a5f4590ce1e27cc9fa16ee228421c415a4b71ace99e0ccb27

SHA512
c85254c8e42c8080ea55c958d084261a8e31e33a41103b5de8465d1edcd14c60fd5ff06757f834dab28dcb38f72dc16259f77ce065190f5cb1b781c7bbefca50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82b03c7c682355a3829e97b673e1b612

SHA1
6c6754ccd5f8a9b37f13f7b9a36962008aca0170

SHA256
d21e5ff9f897cd72e7f221256b4df10a9d815aca37ae7b3c1aac66daefb2240b

SHA512
3836a0f97a1f5bbeca7c0464b43118a59b8d2a4eda5b2abd65d55bf94e315de43e42be1677327fef2b1ef2a562c4ebbc179410e0d4d24108e85acbedc6378376

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac9ff1190e7435d1e4a2691dc2f2e3d8

SHA1
f03190d949fd7bb50fb794f8ff02dccc1a20ad88

SHA256
99b67852cfd748bde00b32037f9035be6c79eef3badd630731d3a990ba571319

SHA512
87eebe6c3881655309139bc058321c0d311218d7f6cef38205a0ee2a4cc4e5a1f31ba344c2c68dfbed3a73ad28f657874a7aeba7ac8a7aaecd6d070b15cb704b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53cbd483182af5baa4aed46c20f08e6f

SHA1
7965da6ed22750680f8b903f1f040b31f36824fd

SHA256
e3ba5f770b5c852d73feb3bc3adbfce798365d06ac9a7bd39bc6b45e4f81cb99

SHA512
ce0c7ca451b1ff0ad78b0001197235e30a834260b0d98411c4d9cfaf6f416e6e265a415a2d9cf8aaa961e30c5a68c00c084e85b0b7211d040573dad315deb226

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecc05631fb7a1174dedf84c76d3360f1

SHA1
466a5fe804aef7290871cae39ce91c669d6049b6

SHA256
79d617375f848a9dc68c45397acfd04d4c8b5a91f298a6d59b96540171f9f104

SHA512
dd4cadabe58539ee672d750bb9a5ba494b6939587df87272a2c26170dbaadf15e7fee45e5b1c63698b3e3fdd600a9d6ce9c5902630f1967f6ef0f9b4116cb01b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24574a93769c8261a107ae9c06d30029

SHA1
8e6cf60b3d914b2f7905d58d4a52118824a4d646

SHA256
f5bddb6948a82aa8432868deb8fe12f7fa0b5d41b94762704051f957df746b98

SHA512
9ec7bc4114f8b741f91d2bd49492d3726d21e66cdc196bd00a44064ae0cc4bb163db06e97828d513dffad7a54cc667f7c6c6914396048db6b96b6cfa40d75f1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA110.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA1B1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit