e7733dd80193ab273e1388aaa9907e8571d64e9dbdf35a11f11e6d340f666b61

Analysis

max time kernel
149s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0413e446de965b3137fa5b126a5685eb_JaffaCakes118.html
Size

19KB
MD5

0413e446de965b3137fa5b126a5685eb
SHA1

1adc3c8adaeb1a2b7c85e75eefed9d6da347fb86
SHA256

e7733dd80193ab273e1388aaa9907e8571d64e9dbdf35a11f11e6d340f666b61
SHA512

68a99792602e8e817929c0557d6a4fa25fee419885e8dceb3b2eafb54a8030c535639faec23af890f7f5a7f33569c1d111ac48fb74eb5a6d965b59e6883900dd
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI14bzUnjBhdn82qDB8:SIMd0I5nO9Hdsvd8xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420429787"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B52A7A1-04FF-11EF-B2C4-6A55B5C6A64E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 3052	1952	iexplore.exe	28
PID 1952 wrote to memory of 3052	1952	iexplore.exe	28
PID 1952 wrote to memory of 3052	1952	iexplore.exe	28
PID 1952 wrote to memory of 3052	1952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0413e446de965b3137fa5b126a5685eb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b95300e172fbb9e00acd26fcd457980

SHA1
caee32783cc009e7ae1cd7562f21ef49bc6f0d62

SHA256
cfe8f056b23a2941885ebee5a435d709ba350a2834e271ea82c8a66b22b75e06

SHA512
d417cfc4698d86e6c968c4320b3ef81e8f1ea831218e1cebb263f36ce05b1e079c40e6a8cb0359af544af2640f6999517c0b7586772cf300065b2236d45f8d2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41b44eb8e60c2713c5dbacce04e6f44e

SHA1
7bf41121d76479d27a4818ea07d467cf28f51e1c

SHA256
4d7c88e2ca043cc83349fa3c58c84751e16b500fa5ea56b0647a3005bf3e32e1

SHA512
8f157e2922c3130c86ecbaeb5143a8286a50c676ae4c46c7c94d4f1c77381fb0358585b05b9ce08343e0806037bba90e771c9b87960ca94138f3b87a5b7c1140

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1420b893b27a631657153619a500fea

SHA1
4ffd6886d8a296b9f1f0a3000b0f659bae2ab479

SHA256
14731eabfa997cca4aa696c24116b34a0fcccdb8d62c667dd5fa280841923a0f

SHA512
798f1b0038c3489a3397b26cd49e54ea3a3f5fb19e2d1bda98c563c937a5c19f27af27f58d0d64c3f6bad3ebd5b82d70d028a02146b9585125b915cf3ad84436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
767de48497dfc9062e536885716677e3

SHA1
364e6626d504d4cf4aa4efbf78795f8e199511fe

SHA256
aced2076da212a6ac9aedf7d0d1a31e6cea9175fed1b8e403ca620f1418ec969

SHA512
099c886cf877e65fa759d4fe2d01c3853ff3325e7c1cf56d57e9eabcdb6a69d3239b8042439a9e10a4a70605fcf8c86435a869fee978ca56bfc568847cc3c448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbeebef8c4b342cc57fc88b4336c89b1

SHA1
2ec2c8ff2a3ac2d4a634b4596441a7c9ac1d446e

SHA256
3a3be67b57d502ba908537bdd7a82b183336ed664ab3e1b71c113882c517914b

SHA512
798208777c4b01c6052ac3d4666408ce0159bdc66ce1adde4f79a0663c1827377bb5608a7e0e999c0cab845710406ad3c0a1398f24222c4fc6eb79e3af12851d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bd2a31b36e788255f945a51436db7a0

SHA1
f65fac4facb0169b14d8907b40515ce0128ba6ad

SHA256
fc6ffc8e5290c277e8ede8f516990e6cc4b14b30c670d54936bd7d226b71c2d8

SHA512
6362fafd3f52c28f6931ebb76b91c796c7ab9abc6b7c76a114659cea34f5040ebf01d9c1fb8d1e6b8d8ac864625a60123e0c17a15a1fc70b9559090cabdd261e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d82d463f166297e0f7aaa5d496d27201

SHA1
636e18bf83cceeb9b015a52c1f8b7c036a1f3b3e

SHA256
c0d0ae149771da4e49a273c6d1fc6219d695a8e7b325c10517ba9c14945bd2de

SHA512
cf557baeed43f21080e694d48be08e40ae58a139147f30629a2e142a62b77c08f99550e627394075bf6c7877984f500413b8b592d9dc8b024a0fd43e82816662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c85bf8c18fdea6e49a2efa2d7d218cc8

SHA1
75b219583c4a4ff377a66aea493a1afcdd12de1b

SHA256
51a7f965331a35592f921b5063bbe1d85571aac08706f6a9ce8435b56ac6f7c9

SHA512
d51022d20917d6cb786b42b504f07f8aaf3e83ee359545ea5895fa2152655518c1613d429627da9d99fa54ae35b2895f7178cda3fd98fd7225dc76b3a8d5fa3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d972bf86682e027548abdb04246db7ca

SHA1
b6e1911646561a55b558702867cfe1576eb7b508

SHA256
5c5b707208496dac4fcd3da7011395fad95327a780a03f0a019168cdeab9d8a7

SHA512
122a2ab53ff140838b4c8cab1bffaf29377a40a6d5d520ed29e2f01ee396a55e19525044bcb9cfb399a8db3c5cfd4108cb49c41a175feb4352e91060edca6eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2858.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar293B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit