4e170140cd1d254ead2b32a6ed6541c2c90b4c3054450d670bb810907d16c819

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d6b81ab7de3337681e8c5a5d25e9186_JaffaCakes118.html
Size

83KB
MD5

2d6b81ab7de3337681e8c5a5d25e9186
SHA1

4aadd67a476b5994e96c85a90369a4a4d1dd63e8
SHA256

4e170140cd1d254ead2b32a6ed6541c2c90b4c3054450d670bb810907d16c819
SHA512

4b0b93ce0f24e64b491b215547d57390b4da068382e86c7aa6cd9a61639ae6191ec8b59b1bda0ec0038850a875f0f07018583de5f51cd5496a962fc934d6687d
SSDEEP

1536:OUvQjIEjrECErEoEPEIEi4dQc5E2IVyqFE0EpE4I269eE1SPEXCBEXdEY5EgEpqF:fvQhL4dQcN42bF+ExUtE1csdVFE1J

Score

4^/10

phishing

Malware Config

Signatures

Detected phishing page
phishing

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421478301"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F076CF1-0E88-11EF-91AA-4EB079F7C2BA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 3052	3016	iexplore.exe	28
PID 3016 wrote to memory of 3052	3016	iexplore.exe	28
PID 3016 wrote to memory of 3052	3016	iexplore.exe	28
PID 3016 wrote to memory of 3052	3016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d6b81ab7de3337681e8c5a5d25e9186_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
4677e2ca86b12f23256042f866172180

SHA1
2205103cf88178f880a9be5046fbb71b27d92d18

SHA256
ad176675450bf932539471183709719223cc4a779a6a105f425c7f7607f55877

SHA512
a312290606bbbd2759564c4055ab4422383593e47c60a049c5dfd95a169065c7cedba9da6bb8621815c1a05bcb50098e1da9b0398b9188b990c5b23013a549ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8e49b6c3c3d953a36b4b0b2c97e1c43

SHA1
6f1f664fca0f7d480fabbdfeeec7b3d655fd0782

SHA256
e991248a63b36f53f51223fd0cdbdf07a35ff775d1c9a68ef90980798714824e

SHA512
3e45f4adf690f6433e486d8cf22744c1c7847bd013ddd64a6a94dbed99ef62313063089e3600adf59aedb4e785474f08dde14a0208a7d143d5f5681dff5da526

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52012a6687cb4342e8d27030d38d1d5d

SHA1
040ac4437b66c1121a67c603b6a4e79a16bb56f4

SHA256
eafc400c73c1759aef5a56c54a4a8d4f1e3869b879349c4f419fbf86289f5a72

SHA512
53a5c18b68bf3a77ad9ed0aab472cabfb9f582aeeb5b61dbbe7faf3c6675fea15994e94e27800130b232b08b7874120cb5d8de71827893bc6a22bbb4c7eeab49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfb32cd5d377a5c5d4c10ea33abcaf83

SHA1
9a9aa519d9861246a046a8fad1bd71aa1519957b

SHA256
ebfcd7a05db851c9e94a9ba8a12650c53822f66944541512213c949517d3f215

SHA512
7e229753be6789cf8cbfdd99edfd6652521281a8cccaea5c862198e9a1c7c2450bcbbe3a66600dc6d6ad66e707c1cdcbb92f3bdd2a673b5072caa5fd219beae9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de18db8be623bea5203178a7b6055717

SHA1
dd7135a322ef9e795c59c663015a024886a02855

SHA256
6a0e457e471e363a5f195e4282dddc10fc516caaff97f0b6cfc92adf4bd766c4

SHA512
d480c1161bc66c1dd05151b649d97f06018339d17990fcfb68b27fa2e611627f97b797883c9de55dc444f994e5b9726c992e86d69fe19ae78d682c530e3f7c24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bd60756bd8d89f9276f5e96109a9e27

SHA1
e9b4ac839737c0ae75168b5d2ca6a79777322333

SHA256
db36295d7db78bb724c993c20da75ccb2f3cb935238b8d097b0546e2172911df

SHA512
76e48ec2b8ab988ed311bec05a6b02439341a4d628b3b7388916421c231d11ad35d44d95e99e84ba337ddbf265cec9882316a8c21528958093f7d062890c76e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c39ce2ed2ef8e7b9f55dea08fff86e01

SHA1
e30c33a087960503b46a18190dc397b0554a0d1c

SHA256
151c596d45005c8a61998e2221e5c32d7260401664de66b12a73883461c3e340

SHA512
8d1ba3e2cdb91541afdc1c851c350dcd16b22b8f6f372d67d8bc18baf11f1e1180e1425072b4db868abacd917d740b886b80d4d90fb8781dab88e36a1087c4f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fded6e6f0dbb8b2e21f03dca6bba3d43

SHA1
95f4f36f3dc5cc550a97b707878316b4ce7b37bc

SHA256
770a9b280d1dd347ad520b08dff54d62d5ac074f1251c140b03459a114fc958f

SHA512
1d10e32b678ff8dc5c5c7d2c7d76c5a0f829dd5f4976821e25a8791fcfa636b96d09748610a032782284da286f40f2a04faa5d68448cd455b781fb1c483999eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0f826517829edc99a11d07a545bdb57

SHA1
64bf8ab431f277c96b0485a977ef1566e56b6770

SHA256
f8cc6bee7906ab8095aa6c464430d19403d455d6ace0260958bfe84e8f83661c

SHA512
6a3af03f9bd59b37ae8402111810a5abc64aa69e7d939ef477f528eedb692ca799405e1cff1132425f94f63e2e4bb3b732228697e63fc4dc37098c48c73c3f5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fba1b212198e26da6d01592b1331a111

SHA1
baf1667c3add6eae239d7b02a32fb9a401f781fa

SHA256
105e38168576eb23e627f6f59ef914039e719f78ee1e39896aa8e272395a741e

SHA512
313afb9cccb24e1661c8215cdabc2c9a929cf1a6b4b3bd6eeb6898fe36926dba197ee7e1d194170c1e7bc1f87d7f77109dfff38206dc302a0f9a47e840fd810f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a49a0ee537c715faf0651c24793794a

SHA1
3a139acda145975c978efc6de6dac4068efabaef

SHA256
1f7694c8d65f03246c9c0657e6673ca6dca77144dd452f5ea556566a5a23f737

SHA512
b53d93e4a7391d38f487dcb43a565a23930a228d0927f69d9d689a5d0ba15e77a83565b8c195efe1ccaa7865db1169b4d0d40ba5d5732ee237d52aa93d5b4bdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2168.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar21C8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit