fdb4692947083541ccf3d81a24eefdaad1a26e1ddb22982d51fc71a8fa84ad87

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 03:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

22f3bbc267512e4639e94b41a72cc338_JaffaCakes118.html
Size

24KB
MD5

22f3bbc267512e4639e94b41a72cc338
SHA1

9b40990d4a5c9b75dfb5576c18a110c0e9a4c346
SHA256

fdb4692947083541ccf3d81a24eefdaad1a26e1ddb22982d51fc71a8fa84ad87
SHA512

890b0d8c19d0e9c5d705edeb7682b791f25d9d4e3805c17e92c8c5b92e42fec9f0c0f62bdd9863248d655f2e4777f701cadafb7279caa7760f444b741ca203b8
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIX43zUnjBhhb82qDB8:SIMd0I5nvHpsvhAxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDE48A71-0CE8-11EF-932B-4E2C21FEB07B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421299899"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2844	2220	iexplore.exe	28
PID 2220 wrote to memory of 2844	2220	iexplore.exe	28
PID 2220 wrote to memory of 2844	2220	iexplore.exe	28
PID 2220 wrote to memory of 2844	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\22f3bbc267512e4639e94b41a72cc338_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
271401d048b6c04c280d9020cc1f19eb

SHA1
f3919f0abd448d23e02d396d408e39c57b1adc53

SHA256
0e8f7d1020c271353c5ccea674cc30b81282f87003645f3779185baba8b7710e

SHA512
cd36cfc1cc330b089efb7475da819b25b0dbe037d6e487c5b2c092fa40b18d2e6954496f3eae99ea07102484449cb8aea96bfbd72454368e0c021686530d0f93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ae5be452c073e8c461eada396d4eb57

SHA1
84519eaeef91e1bced6d2f8587bfc48d2694b59f

SHA256
e7416ed5e724db26e4e03664add78490612ba706b0f76736223a5d1d9f537c02

SHA512
acc4d3ffa279bb1018c847a1726188ea4b72bce47a22ef971a857ae1c740f615cfa07c2dbceaa343b0efc6f7ab552370a18b0b182d8b58708eed441f925a1f7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
326252e1b86faaaa348a49c3e4f2a2db

SHA1
37c928027a5093a0a8b242167f22b6aa00da167e

SHA256
4dc8cd2b845499887502fe44f7da250844ce9300ea2540cac0dab37340f379a8

SHA512
a6b462963fa363d4ebe281feeff8ff1853cc42b4fba5e237386e16b772d8e2a99a779adea187da85c6d151c684a41de5db359a0d213e57dfc68944df1e60015d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
120fd7fc96ccada57a95da98b24c5a8c

SHA1
cfca27f29c63ae2fba4d9b5c2e06f58907f6fd1e

SHA256
743e244908c415cbee1b858af2d077637256daec214359c68d069f5ce599aefc

SHA512
fbbaedbef29b40af000e20628b249c5f90ea35fba426e49161a37aec21570f35cb55bc53d2aa7946f7a8e4fe2fb05022084768909c51d8eb4e8590b2168e3fb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a95031785a1d252e68339d0f75622d7

SHA1
0b564cdc7cbf2e92e31df4c8a063e2e87f405a7f

SHA256
ae596464061209767fb328d5fa32fccbf0864f1e0baac9446e9789fec4c6627d

SHA512
5562e7c770423dfdc657148024bb47c9310ae394cd5d95a328c9f64d62a45b8129f658e2c1d57b2d8c304d5ecc5a75d023eb8ca7ed44cb6ab8bd8899ab14fec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39dafa3c769d78b36f8887236ce3ab59

SHA1
66626a73bc9ff58a79ab3325da089f54e15855ef

SHA256
4fe389534577fe0da47c8df2765583479f1f1edb5c8a90fa03bc6f34f319f613

SHA512
1b819cd68e822d7af6163cf1e7be4c3073bb73a183bd9c62c897f7544afcedff721dcf6f9c90150655f961748bd8ed31d1cd73e762480bf74092830356884518

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ca7350cd93253c67d379f36d6beacd3

SHA1
620b97da4d36abac8fe7fabf959914fdc62a4236

SHA256
c54088795751caa73bf2399b9a95dad9ff7f596563215972d01c30d53c63ef24

SHA512
3bb8ada906a6f8b20cc3283c1672537eb7bea5343a989d26d8327146b596394f0bc19b28f5bd453f2627fd19a1b6d4af41837591e101ff3ead1092609828dfe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb3d8ac6013dc3bd32b9bc6f7146ce0d

SHA1
6367163708ffde877554afe1f51856233345bb22

SHA256
7c0e8e9b7b2710d807f2631c1f4bca42a982c6b9dd62fb66fe0d18047413c7dc

SHA512
20d256bd3ee221fd30761161525837e505011cc8cd36de7b76a14e237fc35f4dbbe4f2019b2e659a174ad01e5ad46336b3503424b79bcd796dd817cbcbac7de1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9313bcf86aa9015b62565861c75fc4be

SHA1
c53b055c43499fb598ba622d713004da679cd18e

SHA256
7427f09869b729d204e4f78e0dfbbca6191b99fc0e85519d22e428f7a641109a

SHA512
eb3dcf9dad143a69e6d47056f38c46c8faccaa5995fff6856c36abc3dee25827cd00544a015185ca1ada9ce61aed776aaeb402d7d5e688dd415fbe3f0a2051e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
0699550a332e13db7d670fb3bda4aed5

SHA1
700bf784d97de6e411f99282fdba16a55f6c9049

SHA256
ce19dcef5779b62022f76b23fa5e0933c203bcce9bf5eff08424482e4e744977

SHA512
2d9418e2bd205555ce5d4daa5e6af14c26ec4e97d85618c5222957081945e1945a6d67616f5470a4b702f31ecf673e07400ad442b82f6c6692977a8d371fb63a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1125.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit