528b9ceababc3ebb4b9fe3a0efc10704fe4d0f98e6d040b9d079cb571276329c

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b3a8b44933b8fa2ff948f22449f2c00_JaffaCakes118.html
Size

19KB
MD5

5b3a8b44933b8fa2ff948f22449f2c00
SHA1

b4a27c0e5c0ffe2e742653dd2ef378286bdaf42b
SHA256

528b9ceababc3ebb4b9fe3a0efc10704fe4d0f98e6d040b9d079cb571276329c
SHA512

2938c2618475890897fa7ba159e1d79ef2d7785f5e34c5df7c6e426eaff75fc64a6e66f47f31ba653c2812ebe574e4a40e61812af7197bf53fb2890fba3fdfc0
SSDEEP

192:uw/ob5nh2HfnQjxn5Q/VnQieQNn6bnQOkEntv/nQTbnJnQmSgHMBwqnYnQ5VNnlI:IQ/g4q9L4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427540775"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A97BD5A1-45AB-11EF-BD32-F6C828CC4EA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2324	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2324	iexplore.exe
2324	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2236	2324	iexplore.exe	30
PID 2324 wrote to memory of 2236	2324	iexplore.exe	30
PID 2324 wrote to memory of 2236	2324	iexplore.exe	30
PID 2324 wrote to memory of 2236	2324	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5b3a8b44933b8fa2ff948f22449f2c00_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
288e2193341e205ad4f22de9a62140cd

SHA1
377645f348894c8dbbd1c049ddcbe0df296db5e3

SHA256
dc586f729254623149e369db1f20f3e090345cb515dc0dced956074edbca1488

SHA512
0fc2b6b3fc7dea06212a720737d6d1a1c209f4856b636a3f7f150c886c372987f3fd1144b76f68981289fee34b4a0b7f53c68181d823fc0fc1617fec4fc6dcd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b48b3fd004ee15463d8966ee8382d7f8

SHA1
e7d708d228a2730041ee332b9344c1ac0aab8501

SHA256
930b59c3ef179602ee63796bcca3a4a7f18e0c00e377cd2d39d77506826b49d8

SHA512
25504c9b6313c795d3fbfcce069017cb1e7264667fca566641b08e1b174dfc19bb1cd8d592a565b1c222a7abe7c0939ab14f85db42eb40682949b37ea9d95977

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f63fc89cd508ea8a5f8b2a39fd6373e1

SHA1
3cd16543561d50748d92638faa34fefca31f7ee7

SHA256
93b8b5d8589bb60f0ed6f9ca83382e768a7459914b49e6acbdc301cb1aa499af

SHA512
ac0be60f1595807699113e30b9b934930729d161d984c3fe8b72e0ff3d2672aa6fb42065c06f7012bc047cfd9874e9a5385e3ee5a7ef8a0c19ae8607ebe99493

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02c7757d6798b4b07a1251ae362c6691

SHA1
1789d59c1c7e2440bdcaf7ebdb06d9aa1028f3b7

SHA256
2dd91859de9680e98384b8b41fab435fea62d26c5a61a3258bc43c7a02d7a7b5

SHA512
23a28a5c8c4e67ed763eb24869dc8fd6c8a1a2b27e0917afa728f4904ab5c299f3d5c6a17c9b11b5560d7b76b26d7e844b14e11280ffdf4ae7241ab87c3ce714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee785e57c1939c47919302a34d3fa3f1

SHA1
f3f04320d8f2911b49630fec026cffd3e34fcf8c

SHA256
a54b85e8d2c47a9ee21702d1fd79ef4db2fd23ad5f7d43a4b5fb810cab64fbc1

SHA512
33d530472aa1d3c871bf7f83c093fb6603953db861cf8e9e4995c7c34ac1dfc419ddbf2267c079caf88bbe2c19d21c8ffa0ad7e52216554761c0542949d477f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e0b1c5d95e459a15960b68b0b7bda8a

SHA1
fb327c2c349593bda4e1b487a8f54f494caf1dc8

SHA256
a440a8e723402cad4579bee8c129b2cfd25a414f33da5ff9465fca1d8a125b49

SHA512
3120e6ede5c368ab7b4070d90b1f40146b219cec03467e4d1a360720090fd397dfdb04b1e98c8d0f9bc2a29df6fd0e71072fb440799764df0c7ca1182b545295

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0cfa00ac546b60ba2cab0263467caef

SHA1
f4adf244213cf8972c5f03e8caa4fb0c253f6423

SHA256
82b359ba645d0fd1615078be4f3ffebdcef58726c349c98488a2259065b6d6a0

SHA512
399b52933b26109f91399388747bed7f2215633d3b7653339fe9a48d33510915815883bceed666d1d12efa78aaca100476735dbce8657f815396cabe3dc1c99b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b377ddea2a8dcef8e91c4c6ad595a84b

SHA1
149546836b2210f1a3dbc70005606e1ecccaa437

SHA256
65f364b96acb2a62981e93aa86f06ce635907ed9bb3131bfb0d5986a365fd444

SHA512
6c1b43187ab6c0a3da85f2dfb313c7fc20498060379e7716b02c5169fce8f5899af5a366a20cbe4fdf956112e93a4db315c222db665abaad251cc112d83b8222

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9eff714d424b390e9ebd5030960dfcf

SHA1
5862e9387fce31f195ac8e4e5e4a5666f1a0f0d4

SHA256
4177bdb3812434417a2d6250e1768c486f6942bbee6780c54369fffb1b589cc7

SHA512
b9932133ed9eadb7462d433951d5d098d4824ddb340ba5e31bdd1568857f6ce85a7210a5a76db83ccd668dc6fd6cfd6ad13080e11297273a386b7b919c9a4452

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9F0E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9FCD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit