2d6ad72aeb8d89bfb6c4279017d02dda130d8bffc8034ae8a47b212c936a547c

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

174a0af4ed23268a8cd95307c7292815_JaffaCakes118.html
Size

18KB
MD5

174a0af4ed23268a8cd95307c7292815
SHA1

9b10edf6f898eed646d4f0197d524bc8cbaa4f27
SHA256

2d6ad72aeb8d89bfb6c4279017d02dda130d8bffc8034ae8a47b212c936a547c
SHA512

7b0b38ad00c25db29314e1b423badae4283ab0c85962030e31c0221d1a2a341ad702e340ffb4fe3987a54edc92e463625b3198b10e0170045e0430bb46bafc01
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIN4ZzUnjBh7N82qDB8:SIMd0I5nvHlsv72xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421067309"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73FDB3A1-0ACB-11EF-B012-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2716	2020	iexplore.exe	28
PID 2020 wrote to memory of 2716	2020	iexplore.exe	28
PID 2020 wrote to memory of 2716	2020	iexplore.exe	28
PID 2020 wrote to memory of 2716	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\174a0af4ed23268a8cd95307c7292815_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aafa290b8b81c85df53b68f51c72d027

SHA1
bf95120030fa5ba1f9624f6d6930971e41ddf2cc

SHA256
8aae85e675804870826867e294bcd751f48a04cc074127f11b96ed53a7624ffc

SHA512
3e20b14fd8eb764e688c0e47c2a90bed9df8aaf050f74cd5ea3d5b79cba5f613f1940912797c0c282d4e00fa00cfe35004e19fb73deaf629a9f71d6cb58fcba4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
687f6457f629a24035de6f07275945a4

SHA1
0f5891f96d7a21ba34612ddc038ca01c777886c3

SHA256
c08852a0e90a3f3e9e93a454279e7e73e665b46b76902f46057707fb2c0017ad

SHA512
ca3043cbdfd65383ff609b82b4a9acf1fde0b1484f1bf1dd378d1f45b7fa9348596c548b3e2536fc743bd7095228070d5ac859245caae7cb975e43944bd6aba7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
485de634ce1333e1a98f90457a745d41

SHA1
d657753c8438ffbdde16e9e99dff11c2980fc7b5

SHA256
506a7902aa86b386fa7aa8adc44ecc6120a0d7e21ed5d1f84d94ba186445faa4

SHA512
d29f8c29471bd3f80ff89f6bfda6e91f20352f3951e57d3fe9219c7a2c97c0e34fcad791ac3c064caaa514e34b3eb20973d7869e760e5f2dc9dba1616ac98f0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5a7f882943dff61f0cc11a78db6496c

SHA1
c53a4256e04d65d1c5e18060a3ff7d09006ca39a

SHA256
0acf858f9169dc7937859793289668d88ab06a1bfb37b3fc2c1a3a45f062a514

SHA512
e35c6a4e184a931161ed9b13ae2daf4e4de20d559d75a6dcb92ea9e0e7aa17b13364823b0fd117c7b2bbbe6e37d0c708d8af212137fb7e546e1cda6bca732f8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99a0be5b9c288eb78ae4060baba57b72

SHA1
d8021671ca03b953409faa33f01488434123e5c0

SHA256
5a07d547963ba8788c368872c256446d611e73895a420d0a888f243834a4c272

SHA512
531ac457c95a84124c0ce18babc450ba94ac71700cb083062c26a167866cd34eb7bb2687fb3fdd0206f58c89445f1adb835bd45da5c8b459e23acc6f007d98fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
089f829e2f12a86432b1bc810fa00f08

SHA1
27b0c3650272cffcbe60f8023dcbfb8c3d7f0e81

SHA256
cbdc54e05eda91427768643cceb2a4444609ef0cebd0982293605650ac4fc1b8

SHA512
6dce9628e14ce4debe2d8cb25e749369e4d0de564be0ca809ffeef1115e047c52c4158e7ab9231b634e694a0d1fa72097a432893eccc318bb5bce6fbc686113f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d695b02135909b90b872f7ed17ef8bd

SHA1
c9b73481c096406c3786ae9e1b1a6bb00ea1c134

SHA256
e8fc4ce5491609718fce464e0251f8541894d718d06063162a5e7e605b67ad28

SHA512
41dccfe61fc2cea6916a2a45e6647936683069b93934c6121bc118ac20d51156ff66bd7b51d7ae814504bd9a64e907c74b582542cf14cbfeb15ba40b6c09e882

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b069f43ec57647d7794283713ddc04d

SHA1
9a2f4a0a114c30b168c04d156d5631188666faa8

SHA256
a054927382ce13c477ff126f03eadc76745848865f5e12322a5ed71a3e5362a3

SHA512
394ad757cca0d3217e33ac07e6456cdf213785e5d8b6bb92d08a8a4c6f792009af87d1bab56a1d1aa3ef55bfed654ca3aa18ebc719d5dfcd916547fabfb5ab82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bab82d005d3baebaf7f0d79f7767d18c

SHA1
bbbc67032c544f7a9290e9d067e0b09e9b743ad4

SHA256
24dca8ff784155c704c266f5aba974c05610883523b874052c5325409efec4b5

SHA512
cacd78f6dd9fef4092aa79ebffc967ebfb15d7fb371d9319090e25135a4a5e3cbfe13405a64c94110d79956bba38a67ca15e43a0add02a4a606c78440c0f1b36

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB39.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBFB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit