30718fb81fd8783f2304d246a070903b584bba7ddb584e68a1bf2357b82ff466

Analysis

max time kernel
132s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 06:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

667bde8e4edd20e7649ea540ec9a9855_JaffaCakes118.html
Size

34KB
MD5

667bde8e4edd20e7649ea540ec9a9855
SHA1

340a94b2eaae70ceb1cb3017dd25c932b71652ad
SHA256

30718fb81fd8783f2304d246a070903b584bba7ddb584e68a1bf2357b82ff466
SHA512

4963bb83dc573878e070bdc5d5616bcb48f6a5c8264926e068a783ef3ad05686d680e518a54b61f307ee124d373cc8c766bd5b9a7637c0d68b806f5dc74cdb8f
SSDEEP

192:uwzGb5nFSHMnQjxn5Q/5nQieMNn+XnQOkEntbvnQTbnJnQOgjcwqY2cwqYtcwqYV:rQ/wI56L5QpIwi2jVtj+P3Q

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427881350"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A1983F11-48C4-11EF-B985-CA26F3F7E98A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
904	iexplore.exe
904	iexplore.exe
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 2512	904	iexplore.exe	30
PID 904 wrote to memory of 2512	904	iexplore.exe	30
PID 904 wrote to memory of 2512	904	iexplore.exe	30
PID 904 wrote to memory of 2512	904	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\667bde8e4edd20e7649ea540ec9a9855_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:904 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b6b18d7acca75249b4fa7b7f0694926

SHA1
59f1ad235518cf242a606bfeae0aa4910f50f56d

SHA256
ea091a17fcf33e5093c0efd5952077277134897f5b829f3899ec4d317b0020e1

SHA512
3e33f19dac9397d924d5d07d7eeffed207ea44745139ab94bb1d0bc91a6aa796f36c375bf2d8ee1a8da4aff791409b505f74df4d1b7fb22e43ce6e0de3711bf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
398f4b75c0b6355fdf4e8b9a863c7fb6

SHA1
b15bf3e245aaba033594d20b161ab4da34b10177

SHA256
1d2a14991c14942de466524f6e1e6a05111695e62d2aba6f6ac38bd0ca022152

SHA512
b8cbadb1e615ff590084ca0264c2f44afa386f2fa25715443aaaebc4e79740d679174176925a7b7af540e49362310bc2c1233d8bbaee243877551234da1adb6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
359a8791fa1919464da9f887a1f2a1a2

SHA1
64b77e9a137c85ae06d94ae46c8648a07349b0cb

SHA256
4d51aa01bd571eb5598ae66ec3da7c6455013358de2e146c6efcf250947e6f6d

SHA512
4994123bda5ed265bd0167a8dda1b492b4aa1c255eae318974eb9be0f0df4c85181f142aa22c82c81904a252569b00766c924b8c85994c4e7c593896d8eb9e84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1aedff11d9030572017501bae2a7c83e

SHA1
c4f828f3781f03fb60d4b01cfb2133e1f798ee0e

SHA256
7b1b7f6f7e0a6204918befd336b8f80c9493b3925ae2ba67ebeaf01c571b4d28

SHA512
0ca15266c8ae95ecd9a38be48e9316f1c599c7c474006f83e31ab9d984ce70f59154a945187344ffab6b6bef8d6441a96ca8f5e54593984573db4c5896d2b760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7808a96a6a1112cb89017ba4bbdc9a36

SHA1
ed60d25c5d3fad58d7e20cd9e6a31ebe9a4c2c26

SHA256
0e50bd14fb6e9da634e5d4495bb0879589d4abe88df1604ef75f27d94743f31a

SHA512
ed6387ea7e4638177c799ddf93f4dd63db3077d8191e853b05b44b48c7ea41a6f86fdd4ecb774036e2c143bddc2beda45048452cbba916318d764a82b48adc2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b368cf5db605697d1f05548ee82f0db7

SHA1
e0cfa8f7131a18ed9a7c1d0aa6448b0a3646db3d

SHA256
535662c4a8c832bbeccca811f5cd6c47868ca032787b8bb6734489b751d97d9e

SHA512
03affbc7782eb286fe742919fa84c29ae96520d698ab9b8d4cb240955e15d63c1cae42879d175a17e9f0218c1ba2eb42e6a23b03b6cb1205d72e5402385ad014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf039cf4161ac05aac45e6f9fd7c8ac5

SHA1
6845dc5e5990090ae67cbd78780bacd1962541ad

SHA256
d5f6397df916ac72c8a944c3c4b8d25cb50f1993108be17a0d5809474be595c8

SHA512
0fba30b3a09c0de0f0824abdf14785e6654a49acd42ab9af16629eaf755f30a76aa5a41c81b666854126c0e13e0cb7f565e06d020908340f266bdd36ae7a936e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65e79abc6dc287d179b8b7866e8512fe

SHA1
1724854b9027122a2e9c8726a44a91899d1b9eaf

SHA256
01a1e93df932d83129108fc158e21482839cc316168db03d41032f6b076b90d1

SHA512
451afefbf7f49503633bf516bc0787c02ee5ecd4fd2b21674754b5c7d079d08871c6631cca6c1416e12dd626e7a8abb127ea701df91005e3c642a08ee965c88d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e56f31b94a96423bc9b7c2c3eebe3095

SHA1
930f36e878bad4e7bd59eb74e28b64ea2339f605

SHA256
ea421351716bbcdde9f934b3f780dd1219f62d2c3462c0649f8027763f7c150b

SHA512
8f831f8cce269dc6be1f1d41f2053ddd32b47cdf08af8ab45da28fb1c349a755fdad91bd1f2a61c7f8a8027d6fd36a87ad52d1c9154bd14bef791023c4f2e118

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB7EC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB84C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit