0bdfb12bd95de190076d4e81e2e529875fc4bde08fdbcccaf9c14ca33b538b47

Analysis

max time kernel
148s
max time network
140s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

034833d5ce0f6cf892f8996c99ba2b08_JaffaCakes118.html
Size

19KB
MD5

034833d5ce0f6cf892f8996c99ba2b08
SHA1

8be002d497003398a521311cc718a3e4efce50ed
SHA256

0bdfb12bd95de190076d4e81e2e529875fc4bde08fdbcccaf9c14ca33b538b47
SHA512

cf344a40a290315ac6b347394322b82153041f4fef307b5a7d2eedf6700c2c25a5e94bdd94962a0679f04c8f00c24ddca9dc28e77c6f85a7d5636257619fe65f
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI+46zUnjBhqM82qDB8:SIMd0I5nvHRsvqfxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F378BF1-0494-11EF-9DE9-520ACD40185F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420383918"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2944	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2944	iexplore.exe
2944	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2616	2944	iexplore.exe	28
PID 2944 wrote to memory of 2616	2944	iexplore.exe	28
PID 2944 wrote to memory of 2616	2944	iexplore.exe	28
PID 2944 wrote to memory of 2616	2944	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\034833d5ce0f6cf892f8996c99ba2b08_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e130cc7570354ff2251c14030cb45328

SHA1
34bccb8bf3ab42c79d2d73aebff3b14826e44413

SHA256
08085e8803eeada7bee621525a9f43f9839ee94a37e55ffe961015f46fecd025

SHA512
8ba80afcb9dbfa5202b5144bbf4f44c4523ec6089262432b41d49c8d2818d5a5a46f11f68984fdff3b62c4fd19f0c921ded221754a5e072be32f3279c35ce7b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31614a4cd58fc12e4b974928348103b8

SHA1
d1ef0a4cf5b053d3be6b49327e04e9bb901b7d3a

SHA256
98da09bf6afb8c5ad33bb780a0ec21c0610bfc6ec422b69acb91d416a3d338cc

SHA512
c679d1ec9ee15d72decbc8ecb282bc370c65d67dd68f99f4e8f48573cb8bc74aff72c8622e951c41ce84a57b2a655ea5102d3e501bad9320893996dc83c4adab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9dcf339b51cb23ec4b47f01333b4e48

SHA1
9abb72609c8097c32ebc5ec8b9d18aeafec651fb

SHA256
ffd2ec25f6296f0bc9da051d59f408b28a1cf6596e60d2ffea88f6d7da467a85

SHA512
906f0c5c847cc2fdba49f66f1f668816acca7efa0448f5b5c738f318fb884c3b623c9396514657054ecb6cc599d44c7aa256c9bdc70157aa207ccbcf4c4aa567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c10d28ad289a7a6f5ca3ecf86bad622b

SHA1
7400ed51d6a5bdc1ac5d5eea197ea5624df848a7

SHA256
35f8072b7e1cbf59e4523b28a84938d81a6276e23a3f7125a83a2c0606f1a90d

SHA512
9d9c1520951ef7f5969c95954591fe702ca5ab89e886647364b4d8420aa78a6b5fd6d88279bf6bca291e5fc7524fb22350591515f5589095e02fe2e288b5c166

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a3f6b45e862559d3e210ead1c13a75a

SHA1
6c6add2db7e847199b46666fd0f44a6374e5d1c0

SHA256
3a8843cd8bc1ac024093dc81903df4931156a697a205bfa7d30a0522533ead93

SHA512
25ace90beaebad958f1ccc1cb2e9bfa38e12dd88588de790bfaef56dd4295d4f1a39b62963581dc1aabdc39c1983663ae36df5946158fb2cd5b070fd3e13d4d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cab713b4a0f15a1999b7d47a280f3b82

SHA1
6ba019a2864be409f21223da05a3146e6c82df5e

SHA256
43015345ee1c6b17e9b52834b5f53c3ffbe93fbaf9a5b8f0d2bb4b569fd04c71

SHA512
4bfbe7162827d8577ceca89caf6d4947b131e81d43f57097c87900908b404b13bf38e57ef1213342c7b542d13ca3388e0c1af1b573bb73a00ecc2bdb4c89ea42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baf327883b7b039982fe9906491a6368

SHA1
accfb80b457482748c1779da70da415df5e217a4

SHA256
1e49ae9e0363f1ae074cee4b19d708402896937d0b78a07fdd9f6922f81e3ba5

SHA512
01f2900836c4eefa4398cb1ff4fd002e9dce2793752ffe1a9be5a4cd096c8d4a7727bf9d3d0ba842679b601847f1af3a1d60f4740574950037062f31a337e1b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64fd2b73eeb2dddcc0fab9a138fab89b

SHA1
e84fec21abf8ebd947ab7a5d7cb362a5e93369e1

SHA256
4d30e80e6418f13970a3f596791a80c922df45168402e3d4b2e82b0ee5f48d87

SHA512
0e78dafbdb5dce18ca5bbf8d7332a49898a7ea36694afd0210a6f804423c5eca107010e1694d9e34d578fb37a33f4c02334d559a9d084f406c6e53386cded7cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c3806b73835bb53b097f972fced1213

SHA1
e32006a6adfcbce9ffea2026d2c7b905a939269f

SHA256
4f145ba843eb0e03faa66128b6f39904c7946389f97ec8d35f82a7210a5b05ac

SHA512
625732ea6c81b83cf4ce467cab4869a02c8e18126f10552c93da0ddd5cc0c6494fac033189410d51e5691f037a65d8fb97e0e93405e419593d611de5de381824

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE24.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEE3.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEF8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit