624f18f089ca6f304213f0f7788c70890b75bbf8586e5a86d53fac7b1641aaf2

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59b4e016a1ae09415a07f0cecba6dfba_JaffaCakes118.html
Size

36KB
MD5

59b4e016a1ae09415a07f0cecba6dfba
SHA1

4eff1b5d64ecb3ea0f95e5ce444ae31a56da5c13
SHA256

624f18f089ca6f304213f0f7788c70890b75bbf8586e5a86d53fac7b1641aaf2
SHA512

bc16d7643c745b13f19abec0a85d1137c0901e58e1d55f2927f62b0c895f173fe763b060a79ccd71aa51aac1cfea733447dd08205dc89ba9e9cd42b6e63da9a6
SSDEEP

384:nmQ/lKSLEI+Iuy89ZNnauV6SB7gqgEs17tPwvBWLO2MBpH:n5NY5F5s17t4pWLiBx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427510306"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA14CC11-4564-11EF-9E8A-7ED57E6FAC85} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2772	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2772	iexplore.exe
2772	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2208	2772	iexplore.exe	31
PID 2772 wrote to memory of 2208	2772	iexplore.exe	31
PID 2772 wrote to memory of 2208	2772	iexplore.exe	31
PID 2772 wrote to memory of 2208	2772	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\59b4e016a1ae09415a07f0cecba6dfba_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
106358695279eeb43614405cc4b50f3c

SHA1
e20bafaa24bb0d6128b08441c5d9a7be098911de

SHA256
8858637f54e4614c4553fe24b76daaaedb02fb93cf0941b189c58df9b6c6c19a

SHA512
3c4df1c36e6632d9da7a3c3921475aefa4dd5a887e3da3afcd05c24bd6b89ea21d7432009f114d37cbd2ce46a7c03e602729542905171fa64fcfd79977157767

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
832919c2a8a93b1c468de78fa1b29fa4

SHA1
2119b4744b8f7df10ea811bcec08a92434e2f60a

SHA256
da3b8ca15fe0c172ffbc68391f3636b83255b649408744cb003a562d529a68f5

SHA512
b0b7ba790d92903e87ca27ded395e1b8ece57c8c09275abed4e52b3d9a927e92ec19c8833ac4d87bce41bb267a9385981d1e0d4b15f1bc1952cf4c7adfdc4c02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2376919b01f1c49cb3ecfea485e33276

SHA1
d5bf6d39309ef9a5cec2247679edbf37c3212fe0

SHA256
af19ec1aa681d3e0ee4ffe7cb25e635d712d7df852c7620caf72c214f52f18b8

SHA512
1c380fb53567cd74b99acfcd80a0be36b727ec682fd62e6a9e317cf5a74404cf4cffb171cf78d055b3ee1fdc0fd92e9c08756e8574aba14ab8f5e030509570fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cb7e41a5416b572fd782be58941f0dc

SHA1
6044e90e4205811db8d195587e91a89bdf68e3a5

SHA256
a045c4fb9b24dd99f811e8072052940556376bab16968ab1aef4308baaeaccde

SHA512
bb94c9b227653505fbcb2907c9ffee10c111b1ddb4bd6618e5b2b529a7d8f1ebd7ea024695acae8c7294125f188a293815495bf9dc689a02ca9775d28b9aa220

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17deaeedf7c4ef4014196de7f49fb8c9

SHA1
a529123054fdc2a498e7ae957189da3125061fff

SHA256
30856d02fb147b88e10553eac93f1e23b73e8ff03cdd3603cb65621e294f8b74

SHA512
b60455ff3deaf9d624c18d064034c2783e3225bb7fb93ab3eae31de35231e12087f748c73e10d83a7c1885f74e70d3cbb05fb31c927501058d6c3f76e2230af9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b78326ea94c1645fb904e4dd54f8c17

SHA1
5823757f9670f0e6e01a48bcd059033b9e564527

SHA256
c7e1a600b3f1adeadba3b35b487c6376a362420b49e3e3e5ed792a2273b8d02f

SHA512
36a5b152ead256990c87ba588945df79cbb6a1e1505893c4838438feca8ec037bad7be0fa798e1b726bf0da493b330415eb9670ab04336c50a7221c3e66e195b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae9018d5fd5d23defa259565b4eb50ab

SHA1
e96622371c50ca710e3963821f0d4fa8910d87e2

SHA256
77c27eaa26e81f8199c4cc2a8a9fe0a5abafdafe79fe068e8aee09cf00d52e09

SHA512
2260555f5b92c5e85849bb06043c9256795e901c4ebdbe02db8469a8a1881b6102e4c5ffd68fe4687e93076abf2f6000295250de9d00dcf47a2e9d0d85fa86fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4398cd07a93b792f2e3ceb0b1628d0a

SHA1
54c9a49d2ddd91f266600532daa10231e80c610e

SHA256
94e791c2b03013f30fd22c935858c8667ee84c65b2aca8a5b377362a8fd0b9c7

SHA512
887784a80e62bd173dea3436d528af29cfe57747abed48d421cf8c1a199472b9b9127565027d6311d35232d4a57c58e305a884f9d34286ed4ecc65a381739e6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6682818960c1318be665fb7e728e3c71

SHA1
c143db5356c9eb40d278553591ea0c49f776a497

SHA256
8f70628286fff1f058925a3ce4e3ea10d57d339400c7dca5f0fc22ad5452c9af

SHA512
f36fd8af604e72f68803ba9f575054bfebcafc7a271c3919002531c6e0474821d4f0783f929f376113516a54523bb03b4bfef387c01dc888af518c98242e8059

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFA94.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFAF7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit