5011ed4b41c8866ccdd0f5e89e6e34b253f4af55c156518f5822c6857fa2c9e5

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22d6db881c5325fd3dc7ebecb52a0763_JaffaCakes118.html
Size

19KB
MD5

22d6db881c5325fd3dc7ebecb52a0763
SHA1

d536bd4d054e98ecbb34861441d3a1452d068170
SHA256

5011ed4b41c8866ccdd0f5e89e6e34b253f4af55c156518f5822c6857fa2c9e5
SHA512

915c2eaa2b52bdc99e2be425de6cc7473bbdf28146fd936df6270919c9d52c47b55ba33ed21ad9c5854d960c79c5d440d2a9221274a8ae184d7df365e5bfe45d
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIK4qzUnjBh+w82qDB8:SIMd0I5nO9Htsv+zxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10A8A011-0CE4-11EF-9F3E-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421297782"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2856	1688	iexplore.exe	28
PID 1688 wrote to memory of 2856	1688	iexplore.exe	28
PID 1688 wrote to memory of 2856	1688	iexplore.exe	28
PID 1688 wrote to memory of 2856	1688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\22d6db881c5325fd3dc7ebecb52a0763_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6fa497612553650778e042006219f48

SHA1
a0b6f8c1f52eb1cf801c1f60d8d106c9ea97aae1

SHA256
4c4e031c09aee54b838b5b0672bf6a18e52c58f6b0a2452b202522dd241f8e8f

SHA512
044893bf71b6628eeb994ae1654517f3b3f02b9025e2074fd4767f638ad9785a798703c979b5972fe2783613e863914bdd63329e28114195cf12056585d44938

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2680d2b5859170f498fc3a56ebaf37f3

SHA1
c0eb4c4854f5ea0a8b1271068f9e9d957dcff147

SHA256
22c41bdb39bbcd9dd778ae26dc8541f9fc026cbb207e0c0462ba6d82acdd0b59

SHA512
26461f7be53e082704cefff8f8aff37c4f80f8d69036361f13dc259d57b1aac86c22ee665b619c5ddf61aff49755a5690b0e3d61c3fdc07aa3bf1dca38189210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d0ad45360a691afd12c5025bd517897

SHA1
b9522b59617dd7d54d55eabd17aa1cdbcb5afe50

SHA256
fff1bb37edc1caff616bd8154650ac55d052d86430ea2d353347891b68de68d4

SHA512
12ca15ecaf196728a736a811f9cf7abb75c6215a4012c4a50e7f2ff322b51ed5c6f2a3479c125436691ef5e2f2f4c19fb1e65ddef3727abde12e68aac8d04af8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1980921ccfdf5e73185850065e4e5ef5

SHA1
d3778fefff0ba8da2672ea1398651a480267264e

SHA256
51c98ca24f49a08c81808da10ef4c11795b9a8386819e9b157635131dcb99261

SHA512
f842fadd00fe14f2d8d810eed2055ce8b5b85d7f7d3c7a0d4f4e46882af546d8451176974b470481f5d8cd14bca2ce03bae53e0b94de4087583183d1af47874a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf065e8615dd15c2ded806bbcebe81f0

SHA1
3eda50cacba9b8306698bd313dba1cd8390d4bd4

SHA256
55603a2aaff087dfd033da29465bb3e8b00e4ed421237f535a495a17d844eac1

SHA512
2d2a906af45849454a968da7329b933cc76d47479f5eae4fb654ddf1d4dc08efe9a648a4f701bb323accc06ef64e54adf56e8302fdd873bbbe97afd9ecb1b1f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dd7996fd2955b5ce33c7508f7b05040

SHA1
49531762724c4701cedcb08222380e6d02c01b5b

SHA256
ca433deaa8a45eb25d9e24e8ecb431719df616a26c1cd3bd5efef88b83dd0c7e

SHA512
8302c0895404d9c2878f55be62d59c1d912a9378d63e4282492e318350316f67d95c825442f33ef5771c7a2871e0869fdb32961f112d14c945822ee650521e15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e543fe631e3e17ee15df1e8fbbbbd9d1

SHA1
b294eb5f141dec185044854027e18bb2eb73cb4d

SHA256
cf9b258ab11ae43fed79a45413aea5ef3b50cf99149155d1a7fc2a272efa7eea

SHA512
6c7a50b488076527831a696fb32ac681de800fb7a88a09dee24de2f12d323f56918204dde9c5b65115639e77d818a7039b8b754aee828b6816b5fe78f86c15fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d131c5c72a9fc4bf1c0986be0f8380aa

SHA1
68b9158d7a2b7b9ad0e9bd0786de5117d322398e

SHA256
b9595477556635a131264fbd214e63678a83a23e6359b47204e837c8a1072dce

SHA512
7aea99c6a67341f7041fa4ffe0f85929a0694518086f9f64d8c306e174762c7d57acf6841d1a3a77fe3dbf6a1a47d10e5050aec43b002b5d5cb36767d1b50e41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6984e7f724a18a99c496914d8de881f3

SHA1
405d218e1106fb4115d220dcedde5bbd37585cee

SHA256
c33c69cfbf51af665e2dcad65be44c9fd28aa5c998bf037cef3fc10c0ec665ce

SHA512
0b20e0249dce79f59ed846c6a0eb22766513cea847e0f6dc6e3a3aeb83d7c23c2da562df52d5bc05b24e549f7b1b60da5c3cc565a7cc7b2cadc83149c12dc3d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1544f2af994e56f7906219084fb6195

SHA1
d6138822fb67bd74bcb540ff2679233fe5985aa1

SHA256
3c961dc1fb58d8ca8564d4f4d12435b6653867d79f0ee2267f243359d83fbcee

SHA512
5e9a7910b9d9f55d53b453c4cadba2dd83a5cce2536aa62d6a37e73c95ebcb4b6cecac631770e69e3bd660bb4ef2ee47e7e432aae0756c5e9cf79399d8f10757

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab89BB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8A69.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A8D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit