6efb4a0db55c466bb725a5b1175adc006b42c6229aeef285fabf0648a267889c

Analysis

max time kernel
148s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

366d3d3ec6f70c37277b47d12712404b_JaffaCakes118.html
Size

26KB
MD5

366d3d3ec6f70c37277b47d12712404b
SHA1

c2bc32699fe05fcc2741c57ce247216989f10c56
SHA256

6efb4a0db55c466bb725a5b1175adc006b42c6229aeef285fabf0648a267889c
SHA512

6fd10a67010e7db2e52aa8f00f446c849a5d8678ff39232d7f8e1f58bec57d3f076b99da90a5ec9434b0cc462404026346d5adbb428d2e3ed3792fabffc07a07
SSDEEP

768:bO9RqAEL8F4V2S2jH6PX2D2tIHXRvxcLJH7RpR4ReRori2vDedTSz9:bO9RqAEL8FZx7CcvxcLJH1vkWoriMDeU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8A32F9F1-0FD5-11EF-BEEC-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421621397"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2476	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2476	iexplore.exe
2476	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 3012	2476	iexplore.exe	28
PID 2476 wrote to memory of 3012	2476	iexplore.exe	28
PID 2476 wrote to memory of 3012	2476	iexplore.exe	28
PID 2476 wrote to memory of 3012	2476	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\366d3d3ec6f70c37277b47d12712404b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d3103c56c88ee17a5addd5edf93a118

SHA1
09033b2a4d3179933a7005ad7dfda6f4fc53d7ca

SHA256
20d6318e1bec2e74471c6554e2d8abe0927f7a794d8748ab33a75d2dd0f746a5

SHA512
7d354d05086d67ee5ce31e313d144bc6506c2f0ae7cbc4802a8cd47b826764c8ea53d32901701abe16e4050a7ffd3454c081630b4a6da4f6e35953f171ebee29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
888e1cc7f4049241cfae145cef4967a7

SHA1
92fa404eb604e4952141280a3092c53e70c02e9d

SHA256
f29d342f9f892418c0bb97051f416df0e670fc544882accd3fc8a708bed4c92f

SHA512
f4f86685d17cca4e4c6189e95998c521a1dd5bd01951a44a411dd043e7be66bd01bb968ebfe4c5126fe02e3c10bb11b181c68a8fb02d09f233946074850105cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c76879a9648a2a4d9c37828d814badf1

SHA1
8a3bd9c23192166883e8ed5cd7100fbbc921c10a

SHA256
6b77c918d01cd856fafadd72fc41d23ae2baccc9dd80a0ef5809f774a18e054e

SHA512
66b0685257033da271683d4da371314626385b02da24e36a29b914674835ece6d620b2015c5baad7097b6a04f98ab2cf8841112512fc62365c4cf9644d5893fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad10539bbe3e4edc272f148afaf0b40a

SHA1
a10421aac4a727a49bc62ea4794e982d4defe246

SHA256
ac48e08ecfb39860ef30d4184da4ed1cfc7a582d291e3bcc1791531fab473ff1

SHA512
25381d81d762b12185bd08f9a190404e49748025869218f16387654e41fee8b6b48eea146b5e1a4f09981af59e6c982b0913b7e9abcbba7ac210066df3e02096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4853e8936248ad6c1894b3069a1aee78

SHA1
c910c3d6f9dc7e0b084d5b9a53acbde34105557d

SHA256
fd2daced024ae2555b1fa2ebccbf217566163fc5cb94728e61aa5a2d8a3c886e

SHA512
5a0bc9705dec6775d55b2d019994178918f617c9c459ec54fe6e0127b5809395c60db0f3e21da27abfdfc6a5d0e694125244bb3d438d3ccdeabc25b6518d1a85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f6662255e10190a824185af541a8ed3

SHA1
62956ccd896e0800e0dd2d0ba769a51bf791e68b

SHA256
2a3da4d248b828dbc4759157f4971c06e5db108106b3d23c566facd54c09a54e

SHA512
2c3bbf7f2aca7144590541f03b346564e5243079d6bcee05be647ebd4cc1a31425a7f14959fc33a4833b2565b17b91c30e7353ad2eac99edbcff94a188fa179b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adc9b1aa9c1deb0132cd05776542d36e

SHA1
d0906d3526aec557cff89cc59994fbd2bcb99b5b

SHA256
fd644cf0bc7cb0dea261962fca1da4beb0e264bd06a0f2ac7c8646e446f0f0b2

SHA512
5a41044bd479e561f555b537ae8878643f55106ed1b8abafec169464f75f1a1b352001f8f3fc01487eb9b3209b585c04eae60da0b9629a1017aa829633ca45b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a4744debeb2f5d9e268e703f6dcf2b8

SHA1
0b2a89137dce1f6d49533120b3d7a395df5a4625

SHA256
350b65b2bf5bdcb559f6fb4c377e4cd00d6b3d5f06c21eeb81bb959399133aff

SHA512
4130c018e0dfc17faeabaf33a679ff18d95ccb0c26fd00b1ed6116a6c80786d48b34fdf38e03c4dad542006ee34dd25c735557885f741ea7ca1471e0195c42ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f8abbb14ab7d0bd5e977d8437bd0805

SHA1
ec88b216e557b7335c3d0b84bc42ed03fa3b0eb2

SHA256
530ba37ee4e4343d6c724aa9f0b7f31f9a6a7de2c017fdc4bce66aa574f2cf6e

SHA512
bb5809801cc82133d55bf8f8307cab2286545eb5c841379e1a89685e6d785d3a9d85589753c95d272c80e9103e494f4a210b57d97f24d52ac286f7af199006ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab146B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab153C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar153F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit