4719b26c0c93588013545cacdff9c1349bdb3d4ab9d2c8470e4822302d0fa67e

Analysis

max time kernel
131s
max time network
142s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62ae5ee5f1b4b072ba9e16beaab758db_JaffaCakes118.html
Size

43KB
MD5

62ae5ee5f1b4b072ba9e16beaab758db
SHA1

032c8349de8ff0ad7849c027ca06be2daa359971
SHA256

4719b26c0c93588013545cacdff9c1349bdb3d4ab9d2c8470e4822302d0fa67e
SHA512

730add2a4a985380d69cc5fb9408852d83a6b3c802ebd310b249423f863224ebde51307e660bae0239cc06292fb9d8d222f382bd307cd3abd936d44783fe257d
SSDEEP

768:1I+vbG2+0MGi+vZGIikHhGRGXiOgOeGBGlGslstepFOs/wOenF:K+vt+0U+v5ikH/iOgOAFnYOK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{39856691-480C-11EF-8340-72D30ED4C808} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427802149"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2460	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2460	iexplore.exe
2460	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2436	2460	iexplore.exe	31
PID 2460 wrote to memory of 2436	2460	iexplore.exe	31
PID 2460 wrote to memory of 2436	2460	iexplore.exe	31
PID 2460 wrote to memory of 2436	2460	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62ae5ee5f1b4b072ba9e16beaab758db_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68997d30e4f5af20b01d295105d1fade

SHA1
c0e6a2eeb720af878893dbb6172178cadb5bd227

SHA256
f943afcac8e7818664130ad3ca6c9c10d96e1249174a829ffce05c72bee0bb4d

SHA512
ccb6d332ad5e16afc077127cac80cf044e1a5dde1c828a2cf7cb5ad6053f5ae748bdadbd03be25e07f899c3ffe0484af8b59c7a01fd4232c805056b7cc0faff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07d931e71d04c1464939ea8eb6d0b2d1

SHA1
b14a20e620d5df5100b9f6e3d5fea87e6acae576

SHA256
68ff13de4a21b0ab1c5fa4a00bfd765b138c817586bae6b59939644b4e544fe2

SHA512
3d7c81f6fcbc4db1dba2f24223561adf9c6b3343a9e29314dc7fab97f83830ab57e87d287503c7b5968fcb3b4b006a963588d33d197dc7434f51adae303d1048

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91058c10e37475c04dacff73937566cb

SHA1
d70a04a6272fbcbfbbab032869e522848d901694

SHA256
38eca59f562d4553fde1a5d5bc3e153e25837213117cda5e7f72c2c56e74b136

SHA512
66e9f4c2ee085c15b6ff87a565954483003c033720a1c321863aeb524bbebb2fe1611526eadc741d654da12d445a1795150c384d35f8e17269a0845d5fe54720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f18f69a16cbaff366c3f7265da683c0

SHA1
1325a2da20e877de360846f36799e8ef192c1094

SHA256
9fa21771bfb6e7b6fc7dab4176d0cbdb6673baac10ec60a523c6b3648beb39af

SHA512
6f3d111b621168a13fd94db512adf9610d5a7b89683194102274c7e13a9adab9dc78c0756edcc071aed582e29aff18cac1452c7b971f194ec3311d391012b446

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a39c3ae0bc352b181e655bcbb9fff5f

SHA1
ea26d07191e9f65f933e3178bdb5ebf107e1ece6

SHA256
9056e2858d4027f9fc80d9e417d652ab08038d161132751d45442c2d632efef3

SHA512
cafea26070c4ce29714082ce4e26e0ae433f1c77cb2c4957777583b6774b6aa01c29561958502d13c3357478b916b01640e084ab0b0d78df5a12854c23b90c2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b7e5a5aee10d96cd07755486b73486f

SHA1
ebaf3fb21b4365502853296fc1bff18ad0635f1a

SHA256
6b5e3008721dd5f7cc530760b8ee4b87ec2cb0e5e08869d08d966b8c8820f1c4

SHA512
316cda1d55f62c29b36711cc25a170be2af5c6b20d761278c61a51acd1a0b059e6253072db249f7d5d532ebc0489a2c34afa45df3b3b76224b0bb1a3bff08e52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7ec2da9d1f1525b24c6da15477dd276

SHA1
093e357fbd235867d303efa8af697df0052dfb43

SHA256
9ae370ed34cd3c7e7c25c655f08c9bdbf2f55828e874207505d194a77d308ec3

SHA512
0ff05b256886468a0c35eb9ba62e7e80ba596dd94a7b461f6347c16b876b2649fa250989511a7e36cf5a2228f0f35ee1df2a044251e934a2a1fcb8c11ffc3904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9fc4348cf7b767cd8f248da7b50b320

SHA1
b0e4f53fa83f798ca377b18c9c66352f3c493a38

SHA256
814fb6981e7c779c56db3ce0c3d2ace6e98eb2c04c0b292f820f0f72453e11e5

SHA512
5565ca974369f98d8cd6e5586a2a324f9ca45c99799e257328e76cee470e129243d74e226975408fa2a10b0da8f28ebbf5f85e3fe7ddbae19eb7325a53e4ca53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
436a48379930b017628868f128d54388

SHA1
579f7fdbd8928106c3066293e3eec31eceea5376

SHA256
622b321b01cd8ac14e53478f8d6bfb5f8812d25d19c5169c39d7e45b0719eca6

SHA512
7ec6d09705c8cf86e031f37db5543144958c6a84d98da8321803973899f73bcdaa05ee4f2ad6641991d77b0aab18f74f0a62683609d9bbf19b978f9b462e4eee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDDC3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDE34.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit