d268d70ef46d9d1208e937c5cc8f30948808b308063832b968a6251dfb36b40c

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

084bc3963a61307d91f59339050bab0c_JaffaCakes118.html
Size

19KB
MD5

084bc3963a61307d91f59339050bab0c
SHA1

c4e4aeeb63c5181e94eb55e077b19ede31690e75
SHA256

d268d70ef46d9d1208e937c5cc8f30948808b308063832b968a6251dfb36b40c
SHA512

8af297f657aa7729a47c36bc1c6d0502f369385f0fcb8c34af947692898dcaa9318a58843b300f2e6cfe84f1ef34ff950ffb3d43991bda805fa9c205eec9d647
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI44YzUnjBhoi82qDB8:SIMd0I5nO9HNsvoxxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78F17121-0653-11EF-8FD2-F6A6C85E5F4F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420575973"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2920	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2920	iexplore.exe
2920	iexplore.exe
1032	IEXPLORE.EXE
1032	IEXPLORE.EXE
1032	IEXPLORE.EXE
1032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 1032	2920	iexplore.exe	28
PID 2920 wrote to memory of 1032	2920	iexplore.exe	28
PID 2920 wrote to memory of 1032	2920	iexplore.exe	28
PID 2920 wrote to memory of 1032	2920	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\084bc3963a61307d91f59339050bab0c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2920 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae386d9573a11bc291d1e7008c6f44ad

SHA1
a4a8a0f54ac935078037c60dff99d84ebe592a2d

SHA256
d13b23f19f7da71ae96e1df3cb31be1875f0932d47461f4dd1aebc17556df554

SHA512
3a2c4104a936073422b38265473e7bdf48a471a5923404a15f35e0e65ad270dd90303ef2fe2fc7c4f35cbf3dc9b81a2894a9304dda88a8fcf8323580483290ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ee5c582c991ecfb25c5eb58bb024b83

SHA1
e9d11dbbd9f1779812e35965cc364d4e79a9a87d

SHA256
2535c017a65096586eefdd493733c2fde5f22d21888f1b59aa7f37c3cb59dc36

SHA512
e40640fd71f6867fb98441244279f7df08f42ed525b91c7be719ad3ca62c14aa4f8bc9f7159acbcc8aacb140ff4fca1672370208cbc4c6eddea85204acfbefb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cc5db6325c92e1939571d944f27c40d

SHA1
1223d7b60b0f6a7f554635db76b701aea9f726b1

SHA256
685775f9adbd7cc5229f3e9114357cb0672c3e9ef9bb80e03bed3e0246d1f0b3

SHA512
bf9752f097394c53b2d5e723cd082318b219705ade75aba569e81acfe217030568d18dd00571ed5a778c37dfcee63db02b834b0463fb4bb112a37a5e92ed5be6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c85b19f78d4ddfb0121949e74b03043a

SHA1
775bd0c175794d9b5e244576bad7ef252da739e8

SHA256
1a354955e4d1736f3818df826245d3f07938bcc78f76466fdea84da5866079a2

SHA512
257b4c74f1f28bf157e04fa6cb56648c3cd740bd5c6736a8908666a6453cb4fc18bfa8ce0f11bb3d48c797977d60ac5cb3435cbe13106079a81a9d84418b0def

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
912e1c764601ce355f92275c1d95d0cd

SHA1
a8ec96eaa8bfdfdd02c514ba09995dff0b22c7c2

SHA256
27057059862d8138354d4356b449d0bbe31f04387e75801c35aae8afd4f667f7

SHA512
dbecde49788bd4006ca16ca9e446d45ff82e246365d2dd337c52372cac3a098259d0ec4f00eb1a695cbc1518e2ed095e13abf2e38979b21366362c927e65d574

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31428109596fc288ce775cbbfee50085

SHA1
99e2f3f3b765105acfa23d497e0abe8ad084c48f

SHA256
01b5886dbb5d3a796049afb9564424ea0675f3672412a4b79fef3bd4b1e3b748

SHA512
8a6a394b90137f5e4b340dda1b1ba4c57555fc3785e479b94bbad84249a10266294085af1b8368df19388abb85d56031d3e92ea3f3cba7e9d8b1a4a7f49aad71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51e076accebbe23beb54284aeec196f3

SHA1
b53b0a10fdee5b86b64591828ab5ecbaa14290ca

SHA256
2c9cd4dc0bd2255b49e4aa21b3dbeaee33cbc2d0d5a9f2638db40d409312e9b0

SHA512
1d8b16e7eae8945c3136acae5076931b3708b7e97487fbf4617b6b169c1af8cfcd4f6329caac95c02c6100bdb50ba4311dc05c02ee07fe27f9f69194a380842f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5920001af861565506db9385d8b9d42a

SHA1
a5cb27b11a8f3ab2a032a42b5ee5779ee681b5ee

SHA256
5a65fcef3ee5280504244fe17403cdb8362261912843676b7be500588521ec7f

SHA512
0ac5de325881d374ddeb90bf8e6a1bc86c9e03dc940df51ae3d65194d44d8b2372b2472ce0c753cacab0009dc598263567887df8dc6a5d885bb347ba0471ea4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff37b8a986b803bd45bedd52a38d0e8f

SHA1
b13169eb8aec9a52be6e0f852938095378bdd578

SHA256
f7c97e0a36629e721cd7bb4bd554e3d7aa91a81d9226b46bd025d19bf4d50328

SHA512
b59914d5fd7afdd48a0e7bbd30e231e08df13ad94c141aee6c04f309f9131d1a8dd5266a7f8a6df9e81f656d2640590f3c21f3c7014fa10f73d80194fe92ab43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7e730eb3b654d46d903289830edbda4

SHA1
8f58fa8238df3f270c4774c810db726fca2dc325

SHA256
efd6edbcd55f50bc3bee1a1114e32c2167e18afa4f74e5d0f04bf35be73018f5

SHA512
8cc7de5d33edabd77ba9a23f3c33dcd94f3f67cc2456ab1f857c5db591dd87208c9b57cd82e2e4e383cf1b03f010c91ec595fa50af3184f9ec434a924c0aa1c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91090863a43cf39d86dcc20250c47c12

SHA1
aff56c01be9cee3d22013981ab323c8e3314b8ea

SHA256
76aabb65b2179671c9b9259453bc83206b5148e0d4aae87a2e308b5f7bd09a02

SHA512
a0064b369aeef8694e89527f6aafb850d71dfb80ee8342a3c0c9ccf4e16f5562b2c29519bccc04d9c02c3930e478fdfa266400d4554c23bed8ed5a5ec424a5b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab168F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1770.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit