60d5a24cb49e1b4dc3a02cb324180ffa9380cfdb9aa66f860e1f56cbf9765271

Analysis

max time kernel
131s
max time network
140s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

42161e92fd4402b5deb93439a18ab882_JaffaCakes118.html
Size

30KB
MD5

42161e92fd4402b5deb93439a18ab882
SHA1

5d8b4b8425f0a59f04398efec1eeaff951ac2352
SHA256

60d5a24cb49e1b4dc3a02cb324180ffa9380cfdb9aa66f860e1f56cbf9765271
SHA512

4560d025a8190fe6fef4a314838c455940c5b1ea455371b6c26a202546095c49ca4f5ae655eabb467b2c895aa7d69406c2da534f14582a82811ce51568be6b46
SSDEEP

192:uWPmg79RF/AH5Bb5ngHmgqCxe/k1+bv7nQjxn5Q/+FnQieCkNnK8WnQOkEnt859p:LQ/dZsQ9xYpyQ3ZbDnOR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA212901-4124-11EF-97E7-D22B03723C32} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427043121"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1912	1712	iexplore.exe	30
PID 1712 wrote to memory of 1912	1712	iexplore.exe	30
PID 1712 wrote to memory of 1912	1712	iexplore.exe	30
PID 1712 wrote to memory of 1912	1712	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42161e92fd4402b5deb93439a18ab882_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e90156fcab0048cd88234656f91db70

SHA1
fb882537fad46815875f6c1e4e2ac5005507ad39

SHA256
bb27ce15b6288189207d9ff0806829a1b396b1ac760ee012f5eee77eecc5aa86

SHA512
6a1bce8a25673bca1f2d2bc8a0ca300274dc96d6574e8d88f2c75de60f7ebde0349b8758a4dd428d04bfe8a501866450cc015f53fd81562727ee46ea096e6ad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd4945df19452bd59b60741ae6ee5cfe

SHA1
ceb4009bf9ca8e1e2ac2aab27a965c2c2494f864

SHA256
8bc59252e65356f33306aa5a7e81e2a0d5ff5d6cf69a80d87b697821c90b37a5

SHA512
d6db22eea768592626b7c6b0147c327d75650adbed3c2c7aa4f0da9f742b0cc9895be9b9cc5b93e0f5ee8146c08d4c79386ea764cd5b51f54e05cb1277761762

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
830aa02b8a863081eee99de4c4722b59

SHA1
21782fabae772234546db1ae159da7d2bc0c5970

SHA256
014b58721a36a5d97bb70e6c62781e571403254aee440a5b54b9305f22462000

SHA512
8cf1b4f29adca707a1a84ac78bc5902666868a301ffbf71a853cd72326b8b642ba85f81f550436d7f40e620d5c62262afe18ba33520a3bbc728023b53d81003e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79eb50cf2c0c111452f07196e8dd4a9a

SHA1
8115e356315e468e09e0ddc526c780c1b98bda02

SHA256
e1a0806dc3fede18156d76565fce4eb1d28495ea1c0d8e274a3410c3ffbf413d

SHA512
9e31f6a819d347af1a8964a1c8b76dd0cc890c3f4796f6ed8af7f653334294b5b01ed79980543297d1087a31e81fb79c89a077ec1684402f8896f3a84a66a4e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40ce6a74dd82844b846c2d82204f5d2a

SHA1
1c514c1cb64033e64ee5d4bb6992933a1762511f

SHA256
3393b6d1ab4a4128f2c48a34806346ec49065d44a692fe316791eb00fbe77724

SHA512
89ba0a4df4cd0a8aa9b06b8093ac7723fdbf3be023afb96bf829484d367687d14421a84cbf24a9c8b29c6b12404c416de724f10926d5b1ebae39466d68f27099

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6952e88a7152a433c3f2ff206b4b3e8c

SHA1
44fe7d84c32e5870c04d5fc3d947b5693bbd5152

SHA256
017aa6ef441a7447c4faaf47e2be72bd6db62cd63bcf29c1e9cc89a28d406bdb

SHA512
1b360caa15599cb431e8dfc598e2b35d8f0f1bbdca1921b43089d2352fda7a65680bf9823c2c69be811ec088e8ba7dde2c71706dbbef0d091cb4fdaf1ef5779a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53dcd0ba0d24e1f2cc3fb6052f2b8419

SHA1
765a474d57e8f47a1b6eda0efd18748e5b1ad21e

SHA256
78b5597c0f08ab1a21cfb32b8f635dbbec32568b8e03b38d6a5ab526b7b632bf

SHA512
a756385591607afcdd3f97139699a20c93e01356bd8af6b96ce82db256662100eb1fb552df6988db8936f6431d1f7b2d09dc9ac4f2b34bdac5842012d6498000

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5cb902939c7a1a67d33ee10d49920ad

SHA1
5e9d6d87cbfddd93e3aed3269abe26433bad0ca5

SHA256
f34997b55049cd91d17bf6f441e2f9288e1a2c528ec9a2dcd3f063d78652d1bc

SHA512
4b70f489665586601d23b312bf4a8147fa0b6f0affd7e2d7bd4f0fba07b0dfdb48d8897661f5dc053ee6aedbfdaa1bbde13877730ed4cf94341b9e5e282247ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab931D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar938E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit