a4cf41f53ac31625863b51aa0b3bb952d3fe280f2271d828a8662128d2c469fa

Analysis

max time kernel
148s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22a10147f6ebee9a8af39eb04282b1aa_JaffaCakes118.html
Size

20KB
MD5

22a10147f6ebee9a8af39eb04282b1aa
SHA1

e5f1aa86bc2a150211fa602665e8f07642bb59ea
SHA256

a4cf41f53ac31625863b51aa0b3bb952d3fe280f2271d828a8662128d2c469fa
SHA512

aea96993e67a651ff53b083b1390a49c96f7451697893b3b81200f520e659c8430e04aa851363c3d70fab3b48e7b8d062b1224cdc61ea82291c6e62d2866d5da
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIw4szUnjBhQq82qDB8:SIMd0I5nvHtsvQpxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421294082"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73DB74E1-0CDB-11EF-B4B5-5E73522EB9B5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2912	iexplore.exe
2912	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2704	2912	iexplore.exe	28
PID 2912 wrote to memory of 2704	2912	iexplore.exe	28
PID 2912 wrote to memory of 2704	2912	iexplore.exe	28
PID 2912 wrote to memory of 2704	2912	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\22a10147f6ebee9a8af39eb04282b1aa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4d686641d0e7684b7b920f8da5546c7

SHA1
0d40e98db11941ef1ad548e2b35ca785fb7cbfec

SHA256
0f0356cb430bebcbb696310e8caf6eb47522c29ff8fc1205fb5807739fb5ab76

SHA512
865b56db91aea6648a98fee6d0224c2d38d96a5c92bd4e90aa14c5e755436cf0897c1738e72e5a499847d3b89837c19935d5e8c87aa9866360181d41075e9276

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d158b399a916dd0d6ec7395b8e192083

SHA1
51ff642ca216185d34ab46234ea3fa8259ffc536

SHA256
70ee25e282ee0b1380abc6f063978c14585df9b130a75deba887cc773793f3d0

SHA512
50555a8a82220a31f4c3bd5329076a109228deacc65f74850031cfa25edb2e5254ef08fce054a78bd8d832a9ced59c034d5bf142d68dca18795ba252ca7a5e14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd23d59f47f136ac477fe583d50adcbe

SHA1
27e762062e26ffc2d9961070d0ffa29ac0f58fc0

SHA256
da12a0c24a5947128a4aad9690780914ba62a9f0934b232da8c1bdecb232e754

SHA512
7909a5da59e3a193a242cc50ee3cf84ccd70bbf51f867675e2ff782148b84d82efbaa43c310efebf69a2fb2cfb1f739f792b130270de36565b7293fdaa677e4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4537c0e68a6aa6d7983bc1a77da91aa7

SHA1
2d94d5f5f89501856893053becbb73779a52e349

SHA256
58ba1e90854c7807c96ef6e7191b52f58aa55312bfb447d52e7d09165e759b1e

SHA512
f1b3eee9d9196f31b135f07eaf8a1862812b57ce4d39adec9dce1dd3c9f3f8cf325b6898ab76f37eb4eb968c1dd5ba2bda43ad03aea21171d0dfa8786157bf7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44089d414b38fea33c028e9bd363f7db

SHA1
f350f3237ad4dc4cff12876e4035adf0d7dbfa64

SHA256
2ee34a14a1afd3441adf973ab674f793a1127495d6e32afe48300bfc77bed87d

SHA512
8baf426bdb56a71139093a5c759819f4d587adb0e3e5e2c37c3ad681d37326584aae7c216554e27e6f08a06a068a3848176fb14831a5ce09efe8dc03dec40488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15fd07cf8afaeb8754bc9b755f188d4b

SHA1
829562c2d6c3f21e8aae49bf5021970791e619d9

SHA256
d6695729f5d674769ee1e318136ea6eede1397e6d7d2e1eeda524c8c1ea5b444

SHA512
db0902a9d2ce03e372f5498831fe6428614be72dfc665d8785d496fdc61cdeae6482ec849df21dbf296c37854a65072c59a79ba716b0c9358127881703242ee5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76a3d7947b4bd83ce63a6176e27a90de

SHA1
a6ce8205847c54cc38ff0ffa0c3ae4110f2715c6

SHA256
3b032b2b3fe9ed2006fdd0e95fb1cc147928dd7e370d2e8b883a28b281f4408b

SHA512
2be7c5af1fb011c5c597b22bb8d24542f713f70b647a4eee539a3609b85c7c2106d176140ab2e37ab21c62b87281a5fc7af556eb655060863fb179a650f5ee6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f842a3a7e07c39be0cbc9d89e275461

SHA1
7a310b56a29259048a1fd4267b33535d0abee03e

SHA256
505b618e091908c1d4a42cd52724981eafcd589b72be7f73c15b3cad8de80131

SHA512
a91f272cb6cdee6d401acbf68b056dda18770baaf0d9893fc53e4c8b54d7fd45518a9f834ef1f2ac1be16f7b5264b75fcbec087a7caffd6f74579139bd47285d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0106c624d5927d08f83087af8b360e58

SHA1
ff53fa34242feafddc45151b0c688aa28010ee99

SHA256
d7f7451d5289f421b9e65eb06b695e0bf25a9193ccb4abe63f050fcd8d89db97

SHA512
83c7b9b4e5f44e216c2b2283ada25edba2adf996e90db77db2e6e6bd0827aa2f2d2613377ad0107352d43c5f5ef095a681f74fa81112678b3e77a38e281659cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab20EB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar21BD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit