cb8665c5d3ba3063ed433b5649b653434be0d6a57454f16ffc213cc0fcc04b22

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ec2e802755d30073c045e639b320638_JaffaCakes118.html
Size

12KB
MD5

0ec2e802755d30073c045e639b320638
SHA1

dd670f435a836dacf5d6397a451295658e50701f
SHA256

cb8665c5d3ba3063ed433b5649b653434be0d6a57454f16ffc213cc0fcc04b22
SHA512

c821ae4dc7a36ebb45ccd9355ebba40c20152968eec5cc66ed802682f1312735b6c0ffa6d7b81996f31cc8aff607a6d04ba05912b588e0bfab6b05ec252b23f4
SSDEEP

192:2VolIsr0KXyJhVCNN5CH8k/w1wvqyMBDZznxMCpm01JauBuLbdU8d:solIcuVGjCh/gcMBDZznxMCpm0JaguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425494958"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6111D291-3310-11EF-9486-4AD8236FB259} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1732	2204	iexplore.exe	28
PID 2204 wrote to memory of 1732	2204	iexplore.exe	28
PID 2204 wrote to memory of 1732	2204	iexplore.exe	28
PID 2204 wrote to memory of 1732	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ec2e802755d30073c045e639b320638_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a3c39f7ccca4d28e9696cbfebe0a597

SHA1
3ca0da75a2c51c005961af1b628d48fa69876fcf

SHA256
c00f1a1452c61de87d993e139cefad6143c3e78becefb6f951b262405dd20829

SHA512
eedd051ab07c40a3c74da30e788cbe460bcf11a36cc2b041ac40b621a4cfbb9f003cc5ce4accbc162d288e79a26b7485b4c6516da11debe3bb98e0646207cf7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
079ed135252fd6325ead7535050e083c

SHA1
175b10ea0903e4f2e5c8b14d1a7a42e35d930442

SHA256
c2f28a2c210afb8829949f2eb672bd266daa988038b7639f35c8c1f6d19c89db

SHA512
a7d9a00393e9ae86d19a968f24742f9e093841e8f4f95228a4efda1a01fd3f4a0fdf86109b4b0e189b2c623f2d796bb6c43ab2f617cf76e5dbbf72acdca5951e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1f37c8c9a6aa06985fa8e70a770d6c1

SHA1
d3eddcebd6b2ad02b4de84ad3d7010e44212ff44

SHA256
a58b1175e825e4229f544adbf0cb1564032c1dc5e1bfd351826122fe14da05fe

SHA512
621920b53c1ea333d0d5d8176542e585174d8f83f20774e28d5cafc233ec5beb60b7c65036133f6febc4c2124ab5461af247370f758668deeca76fb6dcf4c6e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2418aea37385fd0a55bd34714060bc98

SHA1
029605a41e6061da3d92295060045a2051e0f647

SHA256
ad75a1d52225eae49cab5db3e78c91d53292d041fe45cc352ba4d7465d479e33

SHA512
7b3bb2e922d66e9af14894a2c93a39b12083c44649e5bc81b741243579858b6e77da708a200e754f88e028707c5daf0a51569fa24945e598d34fd3a2d6ad4109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b75c0cc7c21cf2cb4b6b5e8e6e94f3a9

SHA1
41d151741d08005a0a6857a30fd17e7f4de225c0

SHA256
759ca2a12f3b5606248c907ee3443cf20e9c9e090f91ed294c1ac33a9bd08035

SHA512
3fcec31e99b8e33a625373c1b67c5700b7174b0ff31de55baf6a47697ad4eea4be82fa95b425cbda6d8f9f62c3fa2b2ba7c765da84a4944acbbbdba42918492b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6ad6d9fff8f80a1260bf85771941208

SHA1
1b594241d43c2473d41dffe90bafb176eb1dea28

SHA256
1feed6138df3bbcaec1a1869c438ceef3906ed20efe44a89077058f007a063b2

SHA512
afa45615464221ac9d41d76a00989cc01fd1573b290e11c45765c45a62ef8c24449a02dc7a6f35697bcdbd8a0c94da9b8614eea31919cad587043d037040292c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
680ecee8a48f55bb95f629db769557c1

SHA1
cef88661a8b921b09313a707faaa25c4569cc08a

SHA256
8f2ad5dfb25943d7fc18ee78cb5c8c41f13ee224e38852c60009030bd9fd722c

SHA512
8a4a545730cb916ead842865fcc75fd99a43719e1ab98efadb66488474c7128a19b389ae34994fb2b3c913ca5fc0745b0039f89db6a17e24876e72eadbafc3a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d01a1e551b860cb967fbb77700995e47

SHA1
f3a6ba5fafee6c3bc05f5d809ab67586e20e6252

SHA256
f61735fda62f1c430d2b5a8e9b48a13f4d375f2c3a98d5035016bc6a00728238

SHA512
570902fbf73b5589a41865387389fa3e50c7f110d481d58a7838994cf76331e21d34e5215622e55334484e729fa732fc7bc9c2feb1bbf6480c4d1cb594a37d22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b305d3c813f7d3743a0533d4a89aa350

SHA1
25a47ccf10ea47e2f1309ca6f29aa87d31b16be9

SHA256
a4650f006f0c63cbc6706680b74436e203e7187b8ee133cdb86d8ed46d4479b3

SHA512
5555507703408a987102c38def532c73e4a10d87644bc738e6d395f1ae8e0da5af5a84d7f7556152816756e1555ff2d1ee05764ae8416839bdbb68692ae5c2ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B5F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1BCE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BE3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit