610c2e1cdf7bec8707d0fb90440fb84b7801250a7080593ef2f3f05a3ec3b070

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6556c7553df67b9761318df61ebe341e_JaffaCakes118.html
Size

29KB
MD5

6556c7553df67b9761318df61ebe341e
SHA1

1de0c48b58abbdb8686793a04963b2a3a7019b7e
SHA256

610c2e1cdf7bec8707d0fb90440fb84b7801250a7080593ef2f3f05a3ec3b070
SHA512

37746365e192af787a3e9d9e8e5e35a1c9569dd39bb91a1c880cb2c668fb038ede9d2d5292a4da7ef2261e991499c0afd03a55ebe035a25e4427c4c6b6755afa
SSDEEP

192:uW3lrb5n0HUnQjxn5Q/2nQielNnHnQOkEntiInQTbnxnQ6XCbAoaEjWcwqHA2TQs:oQ/8U15Kyb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427858205"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD4C68C1-488E-11EF-9629-7667FF076EE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 3024	2236	iexplore.exe	30
PID 2236 wrote to memory of 3024	2236	iexplore.exe	30
PID 2236 wrote to memory of 3024	2236	iexplore.exe	30
PID 2236 wrote to memory of 3024	2236	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6556c7553df67b9761318df61ebe341e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1d12d29893bbe290d80122519ef6606

SHA1
38e516389f994123856fd6ae5a3da5ca999c98cb

SHA256
e942da1c9c39f6e4c1a3a8c223b8f9afe9574ed24661b2b3a6105b13dd0ae196

SHA512
2a3ebc46d0e59f722d6be25c6b0e060207d4e0789d811eafbb7fda5b51fa2fcd7489d0c0d1381616ca4e0360f5c98428e7be114174ec8fde5b674d66add38c83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f78c3f3ae8afe76ea48adb262c19c5d9

SHA1
0571cd609022d9df411e94f91f670cfcb90b8f2e

SHA256
835cd6bd5b2c05d7c29f28b6c4936f563b14b3394255518d7a9062b393ec4e5a

SHA512
5ebfaedade5313daaebad31545b9e28daf0c8d555e1472894806fcb146d8ed2f5691159ed35890130aa751ccf81187de8bcf26c03b2069de4fafcd0af89f0637

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f996a2f1da4a3a83cf801ad345a9a90

SHA1
ccb0522d55e9c8500f5cda16ee65ed9c5b275322

SHA256
65d78b71138735be48b8f5428a0d269272fabde11cc4e66d07dee24b621314aa

SHA512
77732a2e3ef526b75e2bdc037cd5834b24071ab4d01ab02b19da7db2da5d0bfab9c7c60315692727c7c0691b64105586c7e5e962b9901b4e7203fba11c02b7f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7fee17630b97d741966122d421f8662

SHA1
875687791dbb2282cab5ccc79ec1b390d49878ac

SHA256
e1d2850085bc5627657e331415ab931c49d998e7d999953e40adae6ad77a163a

SHA512
699e633616753d418541bc744efcd324755127acfd693dad77f6bd36ca1371a167d8ae9560ef1fb4e329e63450a3ea94ab26e2fe960b66eb14653e36e3c3aa83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bedb37d44aab24e15d163508f632e95f

SHA1
ffe70ce973f70476d3f05e001dae4bfa8452b269

SHA256
bc36bc91fc32870d1047fbe854b31dfdde6c5e682e6b6fc74ff1d97becbf11d1

SHA512
6954de2bd474b38f803c54e23d57dc177c611c222fb54ef4e2670571b0f956defc70334c05ca130c9ee9979cdca0c3bc0b65ca7772234299fdb9885055cfde20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
698dd74672c6025d65c0f4bacff0940c

SHA1
c4ef4937c436390365f0c939ea50c2d525f20da0

SHA256
7bdfaa73c6dc57b6c1541c56768a51f3c16b13bf304450dddce3162dac9ccce2

SHA512
3120771e317c593c4c069898aa29d5918f75f84188ba370e25cfda5d9e1445ee7bd80b5426205bebd38c3556efdbef5159580e490d7efc18f137590fbc14ee9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8395c2c3dca9471338ea13d3e2e8c025

SHA1
c70f72d6100cdf7441e06cc92ff2e93635be0753

SHA256
bafd9880b5c28361c8ce31c1f912d882e46895d4d0c4c1cbb1cf0b8b26b9ba3f

SHA512
84b7d0a9b72b1af38da6590a32dd95b80ea573dc73d0a51e7ef74edc7b9b925ab16c27819baff7cb0cd1ec077eb64f09ec4f79dde083f1b9c8928cb06c5f597c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d54a0ca119389384df41f977dd156b1

SHA1
048f8b095fba88ef474f8972da90d30cd83b3abe

SHA256
e50a40d4b792cadf118995c1a98eb7fb0eae864e4c44c5b25cb445f503cb1df4

SHA512
84e79ac341ceb8edca8d583cf67dd115cfc05035a6c21fd51058db00bb61f82ae592b23773dda53940d075cd076d1064f2b36b43b8818d96e7b4a6b8923d6db1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ec175a366b61e358c6336f7f68a4e58

SHA1
7d90c14ee6c33091814f758f5031e76d13fcb2d7

SHA256
26ad9f29a6762ea1f78581ed456b9cc012862c66a1f0958de210aa0fae777e69

SHA512
5c6c3407e31dd8ca63964af2d05025bc45bf0e290c8c3ba14be6bc33a081eea68c4f1d8c5f74fdec2257f163ceb634555131395f26175ffe2fc31cb499849607

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab252F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25ED.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit