45c99799d1d1185e7c16603b555d3094bf2bdf7312e79156b8b8cd93b13a3de1

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39d956ce089d2c64aa532e3111457e73_JaffaCakes118.html
Size

18KB
MD5

39d956ce089d2c64aa532e3111457e73
SHA1

c360632e4db899e74c577c5d58342d9b5e1cbfe2
SHA256

45c99799d1d1185e7c16603b555d3094bf2bdf7312e79156b8b8cd93b13a3de1
SHA512

6fb659cd4769630061331082408d1b868bc45e00cf2c57a27b6a488f0dd10354da527a8cdde4fc820b1987e58335b3aef38e9253e7c08442f7e13e614915ed8f
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIF4xzUnjBhPR82qDB8:SIMd0I5nvHpsvPaxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421674985"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F269CE1-1052-11EF-85B9-4A8427BA3DB8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2356	iexplore.exe
2356	iexplore.exe
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2396	2356	iexplore.exe	28
PID 2356 wrote to memory of 2396	2356	iexplore.exe	28
PID 2356 wrote to memory of 2396	2356	iexplore.exe	28
PID 2356 wrote to memory of 2396	2356	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39d956ce089d2c64aa532e3111457e73_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71f2483f7f60ae360e02172d01cda30c

SHA1
b7279cb266ec0d26025d299a7c648a69d7c019ff

SHA256
44d16cef972e1f0871b3a2b9bb439701d7f16239a163b0c82db5409f610541f8

SHA512
0c54b87610a0a71e0e12dc4dbe970f082820a23440424d65a0f7f2b9f53888f9624ed03abf561b9246920857e1d96181a0767b1031ce25bcdd4e594e161db3c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d8589a90e770a9d63a298fca4f8b8fe

SHA1
46f5f2929fdf1c8f11d052569fca257f81c7ef22

SHA256
b3371768c5cdb8f8e8e7adc56deebac475d832d61c43f8d1d721f193dc9c2662

SHA512
f0021dfd59381ded876dff2eb77b73455bdcf612e9120a99aabacfba2873bf1f0d1dd66b3d296455617f9077dd1feceea5b3746d5ea3cd785389a550969160f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1737ab9e9709d60681bb8c0ebce93b9

SHA1
a2e8fe2ae2d0ae00ca56b2da2d1e034e8e02cf31

SHA256
2674a414426d4bf71888668ba453a7c69cb3912da13fe15e4ade429d8778545d

SHA512
9cb97e994d215c717577edf6277c283bc7e7717325a34f08fdec5958a2e038c7b440550ddd606eacf42cedfccb1bca6d6a016db25440c2423bc41847bf284223

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bdd4410dca3a010fc65c609fb06152b

SHA1
cdbb963792b9cc149fb0deda9c88fe69fc5e1154

SHA256
29cdb43d1dd7c7e32109d2565bc8bf82f966997887ab89019177dc2cdb17a4fb

SHA512
8bdaf3577d9c874830e5a13680500da79a46f692eddf9f2331633fe410d3a210a0a10756861c8fb547d2ca673801104709246c1a72af7a1708d1fd08e9edfa22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fdbe488e95da0a4d8087fe56e079619

SHA1
004b1a955d644b9c963ead22d4f11a014ba23dec

SHA256
413126530420260955016a08c6271afbb0498048e11c0dc4258cafc2c0f007db

SHA512
8ba95f9374d25d0ad058c0d0fd66aaaefa6fcff54839f710587e957fbae3008ad720ecb18dbd34cddd288bd29848a0dd0518c6d2402169fff993ebd8996bf2bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b07434b07e70d9c9ff19c01483c20ed9

SHA1
44b1be82ab187866c803e62c8821e896536e264e

SHA256
41571c7712a8fb0b78f59dba429356af2fcf7196294cf75f36dc02e36b8e5ab3

SHA512
2e3423bef0b46bf57b8d68344572d6da673d70cd94bc99c672b7667f7a0bea9014035a502fe34c3b565273317f1a8c6f6e4f438d8d2bc872f69738f3bc4e3c85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a294e4b5ff9c3c7c0bf910f1c6c7fbf

SHA1
c5e3b5da9f7cde82f92263242b6115f4275b4899

SHA256
590fec578e9ce40d589268681368941d1e2ec9d891f3abbedb69d0abf5dfc241

SHA512
e9457e9f4ba4ccc2c1fdd0eab3e4f52dd733f6998ca0845f7bc6e07872fac1a83b6740953435655dbbb37964ca4da3bff1e8d969480beda6dd6117baf2e6d81e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4edfcd37f056c48b1ae43b24c18d6b7

SHA1
84081c89f1da0ad160abba7a0881a28c20fb6afc

SHA256
df0a5665faee8e301a4a6c419055f513317899f598effd49eef20dda69940e76

SHA512
ce83278f96b2556bc78dec57c6335a31039e070de3a88e694db7419badc8351a71d1b7f8aafa951308b1623fa5157727380ac11801c5090b3204edb248dd02d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a9ea87d2b089ba28d92202e2eb998b5

SHA1
7e91e75919c9a3677861badefdd49a2b1cdc6cfd

SHA256
dca36fc02b500a5284a950303f64db3e14159a982041b6971335847804c16f05

SHA512
8d21633b7c7b7cc28845b3b24e864c6739a92bd8222c7b97b4be378539554f6a782c41ff81d8e7e7c25af317cc228565bd66222a5d8c75b1ea37bd3ce6c640f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab145D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab151A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar153F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit