51ea998afa84260f30b7d9b30116dfc29ffefd9d77a9e9e761dd31f2d1f51c55

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0e006a081f02fcc1949793d0644b45d5_JaffaCakes118.html
Size

18KB
MD5

0e006a081f02fcc1949793d0644b45d5
SHA1

67d519aff13470465b0321f8992b7ebe0c2fcf23
SHA256

51ea998afa84260f30b7d9b30116dfc29ffefd9d77a9e9e761dd31f2d1f51c55
SHA512

1b7a4d746f730feca009f731c9c5a6f008133a469a725caba7d431a44c2c6df74d96193ad5ffcda74b21624e47abe9e7ed0505204ea3e8db78c27f5f9dcb162a
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIx4FzUnjBh7d82qDB8:SIMd0I5nvHhsv7GxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B60A2D1-085E-11EF-B781-461900256DFE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420800576"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3020	iexplore.exe
3020	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2556	3020	iexplore.exe	28
PID 3020 wrote to memory of 2556	3020	iexplore.exe	28
PID 3020 wrote to memory of 2556	3020	iexplore.exe	28
PID 3020 wrote to memory of 2556	3020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0e006a081f02fcc1949793d0644b45d5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
318bfdcb41fb747660dff773db1fc2f4

SHA1
8556d81642369f15c77220e31f09c879231a9616

SHA256
5e4d2926a4261e6d9983aefe3001c9936cee8fcf284c2b45032a514e5a07d43e

SHA512
41bdb6ac9c7ada14db57382fcc0f3a75e05498fccac9bbce06bb34418d8b65ab7a15bd3c561e4a7898acf03026bffd04bfa24b8ca251a904dad4566242d9e391

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e140434efe0bbaf243a389809944dd8

SHA1
b5526c806e4f1e09cbcc6904c94c503d71438441

SHA256
f08bf759b90975cbfd8c45f8de34a4f9437cefcaf00f2bc320aae568e5ee939d

SHA512
c50d3921d6ae214b3a928d61ff66ea97432b837af5397c74449776e7b557cac059340633764edce818d5712fb7fc5fbe84be31429db8917a56ec3a090c8cacd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b432921c5f42da293c687d8c98aa40d2

SHA1
39f50912a697978e3a4e339e58227f260e867674

SHA256
5759a5b446209212c3c199cb90568d3869535fe98d1e4ccb97ece5e536698cce

SHA512
349fd9ec8069473f8a78e7cd012f49991f0413e11079cd0530af878a5a6cff221b5d82e4e8c304d481e174be52375d27e2b9adab4b106e859b74746f546e8bb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbbb58561fc9d38cc224ce9af6eaeea2

SHA1
ba35285b2000f601c90cb97f78dda028d92105c0

SHA256
449488dc51804411aa3b792c9fdfd253f9c2aed353eac886964eb4b479cada8b

SHA512
4a6f5043ede1a92d75875f524a7f4e4d388d058d8942e5be00600e5963e2b18cd31bcae2d9b56f1a77915ada5bda4a4daf0db1e65089e205758810fd84c04539

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e8c777e64ad0763026769bf065682f7

SHA1
3a926417ed5c00a3221aa0279f31fca85affceb2

SHA256
8c3792d71aeb3e28bef718542519fa5d9a220340192860deea700b5ecefab340

SHA512
845f8aa503f30fbac8802438d7234e9a00f2db27df9ea487f59ab1ee233653a106fa89c9a8a5b2c96007640f9eb9c95c794337c376c7b7b011c61ff256895a2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05c43af043cc6f15e4c7450aa420e452

SHA1
599035cb22562832623065d50fb0979315154afa

SHA256
7ddc23795b8fc6fbad08ac1a9cbddc71778f8691cbca6511338f84a5365a4eab

SHA512
7d6477aeb30fb1f2adf9825036c4365ec7d80b77ffde8080e63d97d2670862aaf77ad0333fd7d50d291ce5e0a968b76ee4474dab560b3ddc3dadd991db76ba21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fcb107f2f6881c978bd73f3089b3def

SHA1
b703e05aefc1553824a585e333405edd0842bba1

SHA256
1cbb04f6cde5c17dc3bfd967eae140681a7bbcba291379e8fbcd0ca1a8f4e6bc

SHA512
3954b49cbf4bfc55ca6426a5f3ff631b7bed2ca91157d2213a3670a77f85c2dd657170f8707e46f53d4e5bf291c6c0c29c514949d9e8c32e19bb6bd9bc285691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61a5373eb0e15bcf4f9e44257cb89072

SHA1
5d7837cbfb57ba1239bc13a404d87901436a2642

SHA256
7515c82009d090b4af7163d38a6ead69fa07b9fe4ea5e7b65d9d382417fc566a

SHA512
cf14cafc9a351a3886fb90c95efe97686ea67dae8ab6efb5fe9d7d58d2c029996a14e6f33717cb3fef22317a356151f6ea72a016846eceb48d4195a6c1bef8bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1eb5795d8d27a1f0d3bd37eab12286d5

SHA1
220e9b9b41935e55b218e34455263c69ba67ee4b

SHA256
096da9f6aadbc5886ec2dc1bfeaa7b8ec8c99d49dab16e1a4dd961da9a2c8fc2

SHA512
98d5ec3f907ea7d49bff744b74961e708c373dd9ecfaf07be78dff0380e912a1ed7b578697e871d28660c88131f4da138934dc3751e09f68457747d2b0b71acf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1288.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12EA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit