60b212c114feda986daed61d2151073fa3d1cb5c4bdeac427d5d86e0b4ce1627

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b2921897f3e605ea025ca88a707a0c8_JaffaCakes118.html
Size

50KB
MD5

4b2921897f3e605ea025ca88a707a0c8
SHA1

b63e3057b4075bdc3771ed6976e5509a2dcc6610
SHA256

60b212c114feda986daed61d2151073fa3d1cb5c4bdeac427d5d86e0b4ce1627
SHA512

c2a3273e49d2652c5314fa77e9e1a49ba35ad996f97c48169c994fa13219ab8682799d39db3f8f6e01a82c5b684e70fb4064ccb946f2e9ec698ed6198de1015d
SSDEEP

768:wsvjzlRP3PoUelZG6bfeXaqwdL8pmmILTT:w2ZRP3gUevG6bOveX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427235105"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F49566C1-42E3-11EF-9514-72D30ED4C808} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	iexplore.exe
2896	iexplore.exe
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2848	2896	iexplore.exe	30
PID 2896 wrote to memory of 2848	2896	iexplore.exe	30
PID 2896 wrote to memory of 2848	2896	iexplore.exe	30
PID 2896 wrote to memory of 2848	2896	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b2921897f3e605ea025ca88a707a0c8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f877345ece1931552e357ddddb270a1b

SHA1
8ff944fd8739ae3e950e237235238986027f882e

SHA256
21bfc333c24fbb8ffa90370e9977818c8fc887010d0d049dfbd9bf4779f084c0

SHA512
2964f261aab55c1897fefcc9f86c5ae822da48725bbf7c9450a1929792449ffdfbf25fa8e0ccbfdba23f8a3247f5b8c98d2d2276076e7f60562e78fa9d10ceb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
566adbaa5debf0cfc8110e047bfcd029

SHA1
25c7916faa8f91c97f8a317f0bb70918c00c6c0e

SHA256
e20ea92cefadcd52bb6c7cc5465dc4384d68f304ee13e1c938b2cd44ff2cd3da

SHA512
a4b4f41af59d320ffb79fc054617d15b0bd427896e064a6a9a44d6abe6f30ea0c5be94a687bc6afd7883847b2658fe2ef76fcff3063a1e8b90d14c4ef3aadaa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70a0849582f0a83451b23f027c4c10ab

SHA1
8a058a4f3bfaa9ff768727630eca0bff8138351e

SHA256
672d30c652d641580118b4b74a35aaaae0a3b784f2ae9e5eda643cf1e2936b5e

SHA512
ed916207e36486c31af7e4a23635485d9dd3fdddd20bc42e8584700661e6f30df3f8ae78c6f683f9818042f3657a5dcac7341cbe08b3784050b323602d153413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49995ac75aa1aebaabfa46459b345b0b

SHA1
6c51f1b982cf4fa0f3762b7d8def4b0e2e97d3b0

SHA256
e1bbfdf0a92a501fe26af935a7c78fdd192b4904a3513a21965c381b9c120ad7

SHA512
6a9949f4f819fe28030787e62974fe18b6d7dd19760e75ae65538f44841299f697606e876c34411925a843016ef4ab60a1a8b6cd0889be5c68975f686ce44de5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc8a9783c7c2414a2ec046d3b326004e

SHA1
c61b8bd2e18e7d1c6db656af28696725276509c7

SHA256
f6f261f335ce3620a66ef394bc63dca9b2d424bb70266864097100ead69e3eaf

SHA512
243b90e265175603e0159e91ef65e5a2a8d00fee46bb46ae9898d03646d0df22920d686a4a3fe4649c29fcc7f18f8972716534db409926bb7f8e30a4d1895d11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2858a4e1bc173ed03c8605730745a8e8

SHA1
0e43a7dbf586f9f19ca945880b710f034e6bdbf5

SHA256
927e1e28ecfea8fea1f19067032dd2356fc94dbeaf5451a9a37d5e92f00d6fa7

SHA512
e88127c4bc764bd276c4ed1b118746ed57ca1ebfb29daea5bc820fa69d784ac49ee6e975cd8b1ff4d5a109a80f0fe612aaebc3f83aa44f016f6251c944373976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8eaa9f3dba5909b66378b56508ac8736

SHA1
d5bd365531477032ed3feba1435ad0cfc3fc0b4f

SHA256
13ea03c925db4a57e41e9cd08e3d445e39a58495148fc7e1c65d629f9521c3d0

SHA512
7205945f3964e18286d38a1d929f76b14252b3d89be4d1bb53067e047e803745f35fa3a4ae180ec3f0801f21eb01ecfd702e503902c92ea0906362b7c8d4a3e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f46785fa5abf6d17a36affb643123d3

SHA1
d45c878b42f1e8f409bf770b60c74666c3b66aaf

SHA256
fe66c2534f058bef61e4c35eb794b465aac64394bbcb6e46a21d30f1001eb92c

SHA512
00be1e05ff015fea6049298a9266ed8851c681def34f0fc93082e6f8810b0fbaf84d939b75d01370d699edef83989c8248a867404e309361031359875af55cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA085.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA0A8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit