ea87942b26f09d7420247712f574f3308721ed44507a75fccda27bfb69586308

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06742dff208eed6738f4402ccb3fb170_JaffaCakes118.html
Size

359KB
MD5

06742dff208eed6738f4402ccb3fb170
SHA1

e98429efd713f5f3084d677949a9e6e0649a8ad1
SHA256

ea87942b26f09d7420247712f574f3308721ed44507a75fccda27bfb69586308
SHA512

4ae6ceaacf4f822b5321b801c94fdb8b91edf0841c4a2bf82934ce1cfab6eeb6026b9cb59c3ed1c29c0c76363d6fcb3175bd8e734b1ad9706e297ba72a782e00
SSDEEP

6144:WDsMYod+X3oI+YvsMYod+X3oI+YjsMYod+X3oI+Yg:k5d+X3t5d+X3V5d+X36

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A8A3D431-05C2-11EF-922B-6E6327E9C5D7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420513776"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2380	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2380	iexplore.exe
2380	iexplore.exe
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2320	2380	iexplore.exe	28
PID 2380 wrote to memory of 2320	2380	iexplore.exe	28
PID 2380 wrote to memory of 2320	2380	iexplore.exe	28
PID 2380 wrote to memory of 2320	2380	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06742dff208eed6738f4402ccb3fb170_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bfb68129509db050ed6eb858f2a4fe6

SHA1
37373fab46670b16470115d6da7698e0cd4cf3fc

SHA256
9e33ecec95324249f3959a695637fc6969f7262ac67bc6ddcff3ef73f8ba0db2

SHA512
ed5f96582a3b9f19415ce0705a6fc931a001b535a11693970cbaec9556f26136df10e745e962d9ad379767bcd7e448288aa455380fc3df6093e720b21f920a4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b313b0958a3d14821dbe5f5d59761dd5

SHA1
2cb275bb87c7550f02af033d07109b37dec33d91

SHA256
06308a9e1d402333a85d523f994a6674c8e95cfddcc0d213c741aa702bd3d5fd

SHA512
f6d8811213d19823198c6cb3ca51c44fbf2368d78b25a79d8e660b44d0e1f86cbdadbf828b3af680256d9a837f13809392532a44a361f6e7b924579a42be3b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b2a6f4ab48a187b1cbfc19646952f12

SHA1
c9c08a9ce53d69c4ebc94bcbca07f18fe41f5161

SHA256
57e0fba4bf0f88a75ab66670ae0d982d9871a3784f80abaab779e3f131c4b094

SHA512
0afab65dd4c6d89459f2e233d10ed501b8f39c5f0d35e494697b0c47ad00eddb04957ae13e7def2a797bf6620ae3b4ebba47132ae9cb41e9c0e829c967c04789

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4e31b2e827b868919b02a8fa4943e85

SHA1
2df75557bda82f4662208a5e9d846aa1d02e2d29

SHA256
cadf8ba13d3f7bfa61484fad7ed4a444c7654aa6b07b89b3e61b1d1bb870692a

SHA512
dd32c9cbbb1a86c91e51cd555dad6c09103fcd5368faa692da0849f279180eae6c04f08f1b3cb5ef0ef24137cb19c340e25d42245ab9cdef540475a6ebd9c45f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf40d5523deb49d5107a14ab5254df24

SHA1
719d09291b91f696ebb56222738fc15fbd02f031

SHA256
1f7bee481eb11554ee44a1e9bbc6871d7d693439b45d89a8bb1fcf01ed927328

SHA512
5010de8c049c679b0b1b095955c32859bbef5665db8dd14d413211df682b82b61a16b9baa05dec826917e4f531b1bd60346369236b30f043ae40751801dcffaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe5bb117f17f4813c06ecd05ac12ab3d

SHA1
47773c24cc818cdcbb19e681e1c6f4f9006e7528

SHA256
7c4331193680fa4d8e7f58ec43c4d2ad476b36a1f9a9ecac5a97e133fb6419a8

SHA512
7f62ef90355a84219129cd71209f952601fa0acb101e3a91f0da47bf1931011cf578686bcf6c2eed4a04f8fd878cc4254fa69e219494c8c6efd7fa1d520b805b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24a11b55f126fea90c474bd6e0558c78

SHA1
6d02ab2ffc2c7ea5ad74385144fe669314916f94

SHA256
165f8af8795764dfe193855ec3b3a59010a5c02e97ecb1b29cf48462f6b8464f

SHA512
d0a1f1d77f940bc9e1b22563bf052c26fe4653f7d8f195c5fcdfe49d0847c61596019c1ba07ae6d0894f76f25cd0e4680ab02f17777e1dcc6fa957a1e0e92237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ced6d52dadba67806bb9bd7c62fe23f4

SHA1
7febb51e4fd1f2a72f24bb01c6c8fbee2d5c6552

SHA256
a69d276253e906fa44931ebce9629c37f1dd2c5c751221922a0041ea7e7bb9f8

SHA512
c60db1f095b96507565e0dc806b515767126ce00990e7a351908a9dcc9b6023d442f464d0bf3385bfd7549b86f73cd2254f982fde2938d27e342008845b013bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ef2a44cd9fcddcd63f3dc1fa9d0f469

SHA1
f9c542e5dac8c2cf1860351585d5499233ec7d9b

SHA256
c6aeb98d502884636890e3d252e72f415019d8465be595273b39d102e0b2ab40

SHA512
b153285c6e58287871aa91fb305180210ea5dc3e48bf58c19ff6566e4716548031eaf59566afb6fddccfa34458dc9f1120808fa240a90e253331dd9753aeb188

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab10C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit