61e497ca5d0b944f6c5cae4eae6b76bd2a414cb52cda6c8d9033dc70004b348d

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f474ccac9464eaebc8cd53a21a97e23_JaffaCakes118.html
Size

23KB
MD5

0f474ccac9464eaebc8cd53a21a97e23
SHA1

65c5f98788cd3456b2a9808699f8ad119d7c6527
SHA256

61e497ca5d0b944f6c5cae4eae6b76bd2a414cb52cda6c8d9033dc70004b348d
SHA512

254213032f45433d5244c75b458c1f3525bb8ca9f6c94eb8b39c9c88541ebfe86c33b09a69665f01dd6e877f1e40aa0f70fe3a54cd067a888d98e0ac7a3d8c36
SSDEEP

192:uwjHb5n5uPcnQjxn5Q/BnQiesNnMnQOkEntfDnQTbnxnQ6v06J4RnQNjMBMqnYnS:yQ/zv06k3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B61F111-332A-11EF-BBA4-D2DB9F9EC2A6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425506170"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2044	iexplore.exe
2044	iexplore.exe
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2624	2044	iexplore.exe	28
PID 2044 wrote to memory of 2624	2044	iexplore.exe	28
PID 2044 wrote to memory of 2624	2044	iexplore.exe	28
PID 2044 wrote to memory of 2624	2044	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f474ccac9464eaebc8cd53a21a97e23_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af3c7fb9e2a6687ad4a4db3b1de13246

SHA1
7e30787d89da1d763c5b873c915fedce5d0b8832

SHA256
b371bbf680a5f81ca1cdd43b58e38f9aa21025b839fdd47ba6030dc539fcd0a2

SHA512
0cd53f19aaa73f7d2f3e6069b7379a0ad8d332138b273795a01b998c77adec5f30260dcd045d3ff5e6899084bb02ea73fe3e2030ebd2bb80b7d641c271b3d85c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1710b9d7d89fd01f677cc2a9d0f8017

SHA1
16687f55a193d7f258669e4603e580fbf4dbe148

SHA256
2b61a87f5b3d99590c97c2e839bc4e0a8d419a21392fe8fb5e762eb6a4f8da09

SHA512
f5c39dc1564edb63bf79a2e8f4b8045b8e0f04bd824f419837bd302ce8ca4fef8924620cf93194599fee2e8710d489a661f6804e527530f01d9370cc334da827

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ca00f5b36966c5bc1beb54601450b0a

SHA1
07c672c866319dcf82608172bb6c74ba5f79db93

SHA256
bc91ec529f25146341ab2401784f575efe5aec0d60f2adbf65bb791a7faa2dc7

SHA512
599cd3c631dfffaebd2335633a29a4dc8c19d1c7f70d8d3da2aaf5762958b02c849f245c558cd621f09c2940261cf8be2072d7a1925b6a874729cfceaf2f9c8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88c4c4b117c10bce763f00f04211c3cd

SHA1
574e683cb3a3d070ffbacc7987fa882a972e599d

SHA256
1a96e6e25bd1c7f7ec2304a9386c32330700f66608268f9b530fc47e3bd9cd55

SHA512
0d5ef810bc1195fe0c8bda19de6b57d470376ce6913dc851990acb828b62b1fa563bfaa85bb9f09f70839847c29bb56a41fdd905bda0c4de1dcf9de2f45790fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f94c166f3ffebf4691db3e58323909f

SHA1
63d14183190d18a6904f8d82cf53c892699ce50e

SHA256
588e2aa9b6eeb9b83e3daa32a6de40988d026f8afe467879cec3efbd8d943d43

SHA512
2c04415c51a6ce90925e0bd7d0e1aafa3ce3e6436e440aea3d412b2dbcb4ea4be1b010c0c138559e20a299b3835c3085d4ff8b24dce2ebadb85b41a5acdcfbaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ed6d685731e555626025caf65ce7b51

SHA1
b116cb1c80b92a6296705ecce9ca66c30f89b906

SHA256
652c75459ef36c40bf09308695f03ec28dc10cb6b68667514b4a066dac468180

SHA512
b13647eb9d9b83d4e07f143af7e9824918a614c0651233aefa4540ca4ca96d5f5ada788f45a10aaf39c5d5725d818ff2a9fe4b6cef12c3b6f8a3d1fd93d76373

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf0363f332b179bff54a6bacd550c6f2

SHA1
4f4d713125bfb75df6a6edb13c3bb3f29e970780

SHA256
c7454d19a345c91c81f5086c17e24435c14efddf0f479f0350b9a6c8179729ec

SHA512
6e735b2c858a4183629cd959d8e36cdf269b0790aac315588e5fc640b1a3fc09e8042501f7cc70bb756e5ece39082f8b1cf69631f9f23006f9bf48cc7b44fbe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4c51dffda14ce353ba9358537d701b9

SHA1
b6019fb405acbb1cb240ecf6486add40361a8f94

SHA256
337e9b0d780e1bcb659a4b7ee823b032b9b84f46102ae99b484fd0b7bad77bbc

SHA512
f7a456b00d26393df694ee51c60ea1b573eea4e6bb2c04eb6dc330f90f791faf556d14cbbeda68e60ac43e6a9c92368e593814c7e00f4c3934cd34f11be5b359

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab122A.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar135B.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit