6a5a301fd4ec633c3133577c716f1415318a7bbf268314db91b5bb32f11636f7

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b23a1bf765abc03fbc585a3d8ff564f_JaffaCakes118.html
Size

50KB
MD5

4b23a1bf765abc03fbc585a3d8ff564f
SHA1

ec87831a99a6c3b7d82141bf182471fa84a542af
SHA256

6a5a301fd4ec633c3133577c716f1415318a7bbf268314db91b5bb32f11636f7
SHA512

a4345efb39a18a7e3914f511ceb825dab6542e7b4331a78fb16bdb9f35cf5aef8ca45d1293f6240eb23170e688ee409ea5dd20a03a1715222abb22cc3f31c56d
SSDEEP

768:SIcSb/C89RK6cLlrlNp7gtbSJ3dn2EtT6CUtoXL6NeR6CHJW/iy:SIcs/C8nOhXpUt6nbt0omBCH8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427234749"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24CC31D1-42E3-11EF-B1CF-FA51B03C324C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2064	iexplore.exe
2064	iexplore.exe
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2496	2064	iexplore.exe	30
PID 2064 wrote to memory of 2496	2064	iexplore.exe	30
PID 2064 wrote to memory of 2496	2064	iexplore.exe	30
PID 2064 wrote to memory of 2496	2064	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b23a1bf765abc03fbc585a3d8ff564f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d282d8a9b395a7a99e257e43c2acfdd6

SHA1
86131938a5a2d37f628a398a8e18983a76165565

SHA256
c591ba02932f705a533bd0b2d8abd1099e87154b4b0576c0195c05e57e897644

SHA512
708ef85c5ca81ef889a83e53456048bbf74f81f4abd200103497af4387198a3494cd5a986e4bfdc6f8cd2e018c224f0db44f78b9f9e3775b6e60c4ca8b0affe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08280e1df94c494bf987f387492801e1

SHA1
7d1212c4a0d758d2df1e61dd14cec87ee4f958eb

SHA256
41de4fa428fb0613758b660502939deb772a61e4ab791521936e10e821aa0d57

SHA512
6c86fc87b162fefc139aca65c334307e5498cb1e96867e31210bd0e32eb983ff716f44953db162401e9546cc6b1d951ff71647067ac68b2ca11aefd893bcdb54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8697b25adbb70aa05d873346cfc6faf6

SHA1
d5ce733ee8aded9883ffa5881d84bee0f5043876

SHA256
266513e5d85d61ed7702ef9b7692a6a4df75cab9fdcd963f3c096e35525437c6

SHA512
3b8c0277a24bc0659d56c6732ec0093782310491bfe5b5f8dcb248dc6bd5c0477a0c6db807db68bc1bee9a83e3cf9211d5f43ffce1f1e488c2a88cfd58cc83af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ada54cae46aeafa49df313029bd130eb

SHA1
fa8a6a2e6e8520e0883366b543332b481f69b49c

SHA256
a891b2364b57f14f772a2b8fccd5ab5261b0af3b4dba5960097f4fe8946ecc6b

SHA512
7f322a27a849bba02d52748b86f716d59c67701690cb4c68b68c02c370bc69dc9aebe0e16458f982983b42997543a3c9193d8388ef910a30200e6e44f9d92335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b5cd363373eed73e13c25a5aa38a8ba

SHA1
c4ac62cbb62ce5ef907cb5a0a9b0e6c91dff4f19

SHA256
9c21148395dcd531eb62ac3c12570aad9830d731eb3b6a241a4252c0d6665b60

SHA512
e8fbc500ca00cedf7b087bddece663d4d082cf4f88dadcd7d659f344e042fa597a564bc7b5336a049c69fe10b074345f745d27640f63a7a8003cb00c9e6f0daa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad10117ec7f96b78d50f96b04c829232

SHA1
f78d4b7931c1cd6febb895215d57f70027cced78

SHA256
e48449fbbdd9ce19a7a34e47f7038462ba5b0307dd3750c8a5244f1dccc3debb

SHA512
27c100eb99a8aad5cd5ecc8167eff2e2c21224ab45161dcbb7d500e7e4bc597805f98cfc9e97c2b34398241f6662e40216f2a217b46f6a16a6e3e144cf846aaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
209de817554630d6c59d95ea50dd1fc8

SHA1
1bf776338090ec4069dc20fdcc9d76c11a297e82

SHA256
55083bcea1ce4428baf3a810b15049c40218b9a048238a0ad5e4485e47dbb77e

SHA512
3314c7aec7cf8f8c7fc8814dd087a4c92f38b6c425854f49fb12d0af4d9fcf07ab0ca40b00ed3558e402eacdee4237e9c9ff79610da03bba1fa5855258baa6ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c972b11ab85779b42a0aa2a02db271ac

SHA1
4f03141dbb157b3c3f4539c756a22c129f12a776

SHA256
021ed1c028ff6fbdc34daf1085be2b06c935f8ae1828a98d8e452bb1a961c844

SHA512
413dac064fdc6acb3c5eba46a2b7342508cf631394937994475bd912a055e5a4b6443217bbbe8e98416a235e862ff2f1d9ff807ded48d7f85ff22ff316ee9740

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
724ec6ed3898d243e10c6221501a83b8

SHA1
a4257dc1e3e7818d1f3dd3825ef86d97084d7638

SHA256
fe011c0247edd26a5162a010a92ff96123dfbdb64f472c8c33c787adfd979b0e

SHA512
3f5bbb1baaf44586b4ec2986ef2efdfafd9105dbb86690fe8fd1978fd71a3b1258f6a5d537bae2ae6721b3a14803a21c5c1b21f236b774206694b04041055aa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC3BD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC45D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit