28bf08798eb9e6113a98bdd4d500368b68f6fa1fadb402ccac3133420bae2079

Analysis

max time kernel
151s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1441ad8546d45d7254862de15cf024d4_JaffaCakes118.html
Size

214KB
MD5

1441ad8546d45d7254862de15cf024d4
SHA1

f5ca3bedd478181c89aee9257b4b150dd3e020bb
SHA256

28bf08798eb9e6113a98bdd4d500368b68f6fa1fadb402ccac3133420bae2079
SHA512

335d5323ae41822fb3179336ecdd290b80752454cdd6d1ce997aec6d7ac3cef6d8041f889436fd37c30280c8dfaf87d7443a4143cf7d80d14f10a1369f8abe98
SSDEEP

3072:NrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJG:xz9VxLY7iAVLTBQJlG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0B64F31-0A50-11EF-AC06-EEF45767FDFF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421014583"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2716	2240	iexplore.exe	28
PID 2240 wrote to memory of 2716	2240	iexplore.exe	28
PID 2240 wrote to memory of 2716	2240	iexplore.exe	28
PID 2240 wrote to memory of 2716	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1441ad8546d45d7254862de15cf024d4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30daf8cce6947aac889e5bf639597821

SHA1
8f976e528009d085974ee24ab7fac6615f1894b5

SHA256
00aacb362435ad0a3b07fe528850646eedbfa21cad076d985679226f2b9ac786

SHA512
7e885338f0c3dea56a1a49c5f178245c025278c4ff5ad8b0b968cdeb6f8e1a35b7ea3b774fd967aa0d47c993a2e7aaf04d1ee98f26b179d51fdae7f763e63953

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7101f9e89d50730b14dfbaebb6393be3

SHA1
cf7595e0ef2b433938e3544d746c45a518e2b5db

SHA256
4d933a568995f2eb9c91723e642cd2441014a34a4af34da8cba96f0aee4bd8af

SHA512
43943d5ef2eda52118933f6643573a51aa43d6bc9ac1fa2ccc903527ec0e4ce218e454808e73acfbcbc5997e2455a855cf673a6975729994a12c30c464cdc196

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b59350301be90ffff39f1b76d5b90cc

SHA1
457730244b039bd49a2b14af4afcc59b83e075fd

SHA256
c0ba90ba5d53bf0f98b1acc255029c3c11741bb033dc23f5b2d0ac022ec97e0d

SHA512
bed3d7c3da24bf84a232ad783ac39e9b3535c1135c0a1c970c6981b1b3b555619b7e4883c70f136e292f215262f07fffa5d34065fbe0d16221bc0df9ea256c9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38b6c7c1449f51cb4d3a90c84bf7be52

SHA1
e89c32d55c48092fabb26c23f45edbad7768226c

SHA256
95667bdeffcef8d9b7f5cfcbecde7c5f650d92f0f99d9ea5205f0614bfd9a5a5

SHA512
5d2cda7c81ff2f8119934edbf7ebe5a813e2d9dfaebc4062aedcda35cd9ab5d525991251fed3ae3ebd4f37768df61b9be5dca0d1c7b2100e4d1a107bca12a092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd7da120785588efc22ff609bdbd1760

SHA1
6289c71862de8d3be7bbe8a7ffe57c1eaf0f76cd

SHA256
45dd5dc3d727b2102e5f1d07d67af53525d35828110fcfa69b51e096a7c69287

SHA512
a790879305908080136e3ec8bd43cdf443745ccdf379a980d44048a19bacce5ac5ecc825c7bfab88dcd63a23cdd586003303eb0b10aef4058b6d26dc920dddef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c1021e485f9ef457500782bfa6020ea

SHA1
67059b49aedad367fb054c087b681ebc86d952a7

SHA256
c4fb1f32b47f60c67e6d264247630c00c1c42079dcde67273e6899e067d1408a

SHA512
0b9b8d013f034e8d740210ff69e7f1d57772efe11c787ff5cafbae3ff6822a2b5e4dd00e4a84b00e18482d1791a597ca1edf83d2faf9d7ca9e342f9f2060edef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c33fd71d7fe1a6eda9183f34249c54e5

SHA1
d71b00c686f0d7842a432e63ed385dfa2ba964ae

SHA256
a080d21c0cd71273b07624789fb2c0890f2574fb9a08ce9ac09bc0ee0590563a

SHA512
419deb375298d9d235f2c8b6b54e230f032b0811e7be919e40a0e48697d79949b2596a70cb564f1ec10cd0262ed41af08a832595b280e2496e6995ea73f5a3c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48cacfa8ea56e0b619aafac13d8dbc40

SHA1
c685be1fa0da667d9f288105d2bb02f5d4fa29e4

SHA256
15e10f7c4ff4be85e4b38eaa094bad80d86a5f2ea1eaf336e22fe87748499050

SHA512
d3e3ede5c141e9c8ba464b981cc33f99242ad83bbf78ea642c682428f512dd377c368ad77981e23efa01552787409085cfa97f5dff98723560a01d8f83bc816b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2699d9e5e4bc3ab0f9554c832f5c5857

SHA1
adf9b3c90a31185aa08e9863d515b67dc97397d1

SHA256
1f49552e7c4c5a27c331d4a7df341006bf1d939d8db16a6d8cbc024b9b6d8c58

SHA512
2623322cbcaf5ab91053780f36ef327dfb9cde9e9119ed792067849e2836e17be46217b1c7998151f482d56a649f4ecd85b72406d2f398b1a45734e1c29ecbeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA0E1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA1E4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit