eb04b018458a26d6064cd7aaf165c48ed24159c0277cc2cd6af57a8e47cd3148

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

204d76a1da90520d564a19e73dd98663_JaffaCakes118.html
Size

74KB
MD5

204d76a1da90520d564a19e73dd98663
SHA1

49256b79b33b1ab4e353214386176371dcb0d1c6
SHA256

eb04b018458a26d6064cd7aaf165c48ed24159c0277cc2cd6af57a8e47cd3148
SHA512

265c25350fd6d0c09ca3a489b17bf5681bbe4baf38e6f8945a934b32c69573a8b76dbb482531216287c6d2ef993b45b2cc435750557c48e5a08200aacd06d5a3
SSDEEP

1536:Qok9LFhFOo1aLj0Tqixb47kTuH+pPTujTunm8pcMKlPAM/ZEl/CClZRL+/I:ghFOo1o6RslPAM/ZENCClZRLCI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421239132"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82827E11-0C5B-11EF-972F-E61A8C993A67} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2384	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2384	iexplore.exe
2384	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2964	2384	iexplore.exe	28
PID 2384 wrote to memory of 2964	2384	iexplore.exe	28
PID 2384 wrote to memory of 2964	2384	iexplore.exe	28
PID 2384 wrote to memory of 2964	2384	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\204d76a1da90520d564a19e73dd98663_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0273fee88b94e558f5071caa78c298a2

SHA1
517b859d37b81d9fa7ce8a3a0404512cdc42ae82

SHA256
3a62724f0a71ce73e81eb286df6440bb44ec44511b6225575d663d569e471463

SHA512
5286c24ca80c7111ea39534fcfe958596e7dab72f80f081a43df5d0babee1e008905e228d432233dd157545d5d5091d9a667de18b9bf7a00c3534bee5b97d658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
484f12c4b825f19a4d31065325677120

SHA1
133985b37004a331daac7513e7a6d9da23bf037f

SHA256
9eae618e22b5924585b18ba5c61c77daa2e71f9ab83bf97dac91666be4829ea2

SHA512
db5464d74b8a216a8bf2f9ecae2ceaadb6de0088519c11c71a133d7f63c2d8fd05089f017a0d594784a0fcfb969f89f95b83ecb1e8bd7226b65aad7bbe1eba1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23cbd53afa3768e0ecf014bd33ffd155

SHA1
a71a7ff1980ed0ba36d89cc423da20952217c84c

SHA256
739a1f5cd0ffb261b6908ef9fd0de0740321d31c2faebf1bd6763a6658655c58

SHA512
92cff7bf06d89d8913e46730168283a6f5537d00433d1382787942d0c6a17f1a0cf155053f02c6233f5cac69483adbd42664da73dce9e9f1c4a418e6c504a47b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b47f4aab78824ea6429d1631c516c9d3

SHA1
caaaf622df75b4b5799fb0febb3d2e6003b40b42

SHA256
67b1c39c1b37c4594b68d331d40aceca961c16454ca6dedafe1fa9f46dbd1f10

SHA512
1f6749d0d63b7efc414057486ed6d094a6542bc33275a302df4573b4d37fe48eba11848501d8f87ce95c2b8bc1566e8cabe48d953128f512d2e374470fc30ee7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0674255077833d284e161313a66c43ca

SHA1
98f99e07962c95b729cb4f7eb78629dd1156ce9d

SHA256
80ed0e112f38c89325c4d43a6c824bfd21513687c9c384aad62352d054b52a74

SHA512
992cc9e3e45be9a2169d2b3a1d3f630e58d7c148bd7d6982798379db5c04e5540c4f4ee5dd7bbdd6016c09c17d5b36a55bbbe1444dae837bcf3cfaf68c643473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50a008872040267c57f2e05ebb28dffc

SHA1
8672b5976c8e512b91b933fee83dcc2ecbcfed9b

SHA256
7b46846f8e2e4043c852648d570aea686b1b5b38b8625e5418a60274d45d6022

SHA512
196bef3980f6dae7b35e52aecef4100be19642fcb211728080786688f21785496451b6cf32e63a73ad449e6e93d379e0209a821b6a0eb9dc5b39a9df2e70bfdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0818f88d539947b089abf89e740d21c4

SHA1
b345df6cacdfd7994ed56f4f6de873ddd48def65

SHA256
5ed72bc6fda44de05d4a7bd977c42b33fa50f8cfc94243c7843ce1194e1bb25c

SHA512
5097f1c55f0ddbee888fba488c75f5b09993d9b2184e6080c6cd6429d523e56d67a4e4012d00c75bd4f716a7a25385344f243c9099d31550981b30858e06d5ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42471ca1d56d2a5c8f27c9abc80e81ab

SHA1
99ba51bf4d0c0105ef703c2aebda5d5b78acbaeb

SHA256
89d4ea2d054905e035fdc2655b4d60fe5d1ca31d5bdda830958b132e5955add0

SHA512
65f7a3f5afe682cadede99c667a422269363c07dab21dd8c1dced4cd0636ca50e8c030736ab3523e3bc8c8b80e3f72b46d4a1fc68b6e44684565d0c946ee77a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
352976348153e65ee900363965b8110c

SHA1
b3b6c03ebf0d115d51966021617c01e400b8fc82

SHA256
ff32b090764a8ac964422b915a6528991cb2b6652a4d3b0119d413dbf84e8706

SHA512
d3400a157249c4ffd7b974c3d3edac2d8e50997a4fc274ce12f925e3819b754974a32a90e5412b46d2cc0aeecb24a77194ef8503ef25521d20101b24dcb0f790

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1161.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1233.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit