f41c66cfa86421546ff194e76e623d127b1d5840cd20a2a025450a71932fe40c

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06d3328d3352d9388a6bb711a2795087_JaffaCakes118.html
Size

19KB
MD5

06d3328d3352d9388a6bb711a2795087
SHA1

46d948a8c4c2f608b925be16ccd001d6c55ce00a
SHA256

f41c66cfa86421546ff194e76e623d127b1d5840cd20a2a025450a71932fe40c
SHA512

5a16bc7007c245f0689b3aac646ebcdb0f193ef89b18c7ab68d3616d9b042e38816415ea900e55f572ebe7239d2c1453f1f03c7e1ebb5fc63d323e6408114b59
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIE4azUnjBhGY82qDB8:SIMd0I5nO9HjsvGrxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420527049"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9000B281-05E1-11EF-8A7C-66DD11CD6629} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1912	iexplore.exe
1912	iexplore.exe
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2504	1912	iexplore.exe	28
PID 1912 wrote to memory of 2504	1912	iexplore.exe	28
PID 1912 wrote to memory of 2504	1912	iexplore.exe	28
PID 1912 wrote to memory of 2504	1912	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06d3328d3352d9388a6bb711a2795087_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
455b4d47bde0f03efc16a59f429e22e4

SHA1
6ccddadcd6c3d03b0d82c253ba31937fc8106488

SHA256
c064a62d55d0590278d3c5ac8c293e5671a724f80a8b339e652739e22c9362f5

SHA512
644b0a58d04d0bcc54c2ea6adc6d56b124a948e5f8cba262ecbf67f944c16f428541b2eab2dca606c90da28a6a6944d6357413dcadfe82af05a977a6431a1867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfa8ca68121ae82ef66fbedb0e1a7e4b

SHA1
8e58c52bde72ece46bfbb3dce5444717d4e48f8e

SHA256
4ce7bd18c6b164fa03e44a7f5a30ebb8beb0dd0adbeab241b40445e072230c24

SHA512
e5ee36815ec22b82aa73d4cc30e2e3e4dbdab3b15c0053d1ebacba4b95a83ebff0ae3d2614ba6549e204a756a3aa8fbb649f7584d988836a4c504b501ca7b0dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
992bb548dbdcaacf1089f61e7c3a3a77

SHA1
5a14cbfa38f08547dc0a3ecacae6b57c838d1f99

SHA256
fa46198efda0035cc33ad2152d85359028e07b79c710ad460889a944c8cf31b9

SHA512
7db4a79c54288f604fd0083ee2312818aac7384101cf7078ddbf2a583470fc7cbafdc114e3fb0ab27ca39356301efee3f2e8fe7c46559919923ee4ae6dbbbc54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08b7d59ad01d2578bb3757aadbee8d4c

SHA1
29d20d0b276dc1f459c00146ffbb98d7a7379b74

SHA256
ef7f4ee7c4f75e15a3e0e73f071dcd033fda4d682f15cd700d4c645c8c2719e6

SHA512
fd5274ae66e80cc0838ca798d59e05169e946c665ac612f9b8ff186a8b7142de4af0adc77bb54416016acb00f41a51fb15241e1c6c6cbadd38584f2e1028d89f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84749197dd3e84c5cb2d7f6294a84a27

SHA1
2f4fe59c1aa4e3d88464bd573ad4c15623bdd40f

SHA256
2a629d8adecdc2ceb21f3938a73c2a75b05a28f66d83153fa5a194d4245ff785

SHA512
7eda5507fd95c5f855c497e52e4aba97db3c7a37ed6dc337712702305f8db16c4f2bfc131c8dfc3ee7796bcbe2fd8f0007ec8cea3d6421efc18bbd27297eb6a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0014671baaf369bd73b83fa7c25516cb

SHA1
370ed47ea4ba37a5c2d3f46eb041ad8bf1623e5e

SHA256
5711178ce7cc38eb01ad76fbe2520592bd5e8efbcd944e82330c536826dcaa6c

SHA512
4ecbb4d87b07ecba34a904236b3571ad6be03565466c0c2d9d5c491efc8f4aaf8fd02d029fadae0a3e9a3381eaa82c34840a47a3c73f5528d0ae6dafd921718d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
495ada36697234ccecae10edae7cea33

SHA1
b9bc1987aea97afcfe074ecaa4562fe0bc1db591

SHA256
76c974201be09befff28d9348ee27edf14bd323a3bcb65cbcca9a7dfb12fab35

SHA512
386767027710f1fd5008393d471db153b8f9ece35d2dbe39db9601c7bdf563f75087df77c1f176f19ca27571cd5ea1a85ae7ca9e7d1732f66b66de689be62e13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8ec8d627796e698b4403c0e9eae1758

SHA1
b4758f6ff06264e8b0e942c6256de0f3e293e583

SHA256
ab1239e219d2f3b41c949fb52c7e2cb665f9e10454e30ef12ec4d534bfee64e6

SHA512
6c1874e4aa18b2fed0f2716c973ac832a424415ea96de291dd5ddf77362b843cd40de6bd3ea7f6d8d7b1fb16f897d9ae2cf35c8ad088393451f0305492f28a4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4557a4923d2196c3677e70d24b2ded66

SHA1
c5fd595216007d0af27a47b66138c9ccd21317a9

SHA256
56d4fd1099e71dda26942fd3e6b16f730049c1320c2b7973fa1e0af254a29154

SHA512
69e32918054cc9341c6e65393f622f716062f27ce03263972e72980a91224f542fabe8f93d10e199c912061991e2cd63abe093dd8f75392376293cc40e0039d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB28.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC0B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit