95da277dcdbe3b79734395a1696a63a0d04de7fac27e88685c108a65a03b0190

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f330b44d9b18447a2affcea618b6ad4_JaffaCakes118.html
Size

350KB
MD5

3f330b44d9b18447a2affcea618b6ad4
SHA1

3d6ac567c234388f338144bb19ff93a69188a709
SHA256

95da277dcdbe3b79734395a1696a63a0d04de7fac27e88685c108a65a03b0190
SHA512

0a7c6185be194d8b24205592bda6c31e875de7c7fb630d66b1086743a593fea714981fc559696fcaa5e15d64e86ca53ce7eba930f0e503eda80d206e6ab91c79
SSDEEP

6144:SCsMYod+X3oI+YDsMYod+X3oI+YnjsMYod+X3oI+YQ:R5d+X3t5d+X3135d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB0922E1-1119-11EF-88AC-F2AB90EC9A26} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421760608"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 3048	2248	iexplore.exe	28
PID 2248 wrote to memory of 3048	2248	iexplore.exe	28
PID 2248 wrote to memory of 3048	2248	iexplore.exe	28
PID 2248 wrote to memory of 3048	2248	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f330b44d9b18447a2affcea618b6ad4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9a01a6d285187cb17f77ed10ec77ce0

SHA1
aac29af8206c7f1200f42a0d1de647bb2d743d9d

SHA256
35d5e8cf01adbe44642f15df8f04bc2582cfc9b99c4b90dffdd085abcba185da

SHA512
026578eb579ed50157e24fb99a193bd83e0a580c63689ef15964dfa39c25f48bd7dd874476cf5e01eec4359e67624128fef3392617c0c0d93b1977a48e7785fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58ae366b6c554f7ded7d0b8feb3b39dd

SHA1
f17c436777036c36c73dbd5afc1f5fe9e29c7579

SHA256
bedb4b2dfed813711052ca391c47b998af5eaa478f76168baf3c67fdf577cd73

SHA512
cabb6aca6a446fc96f326207443770249cf63ee98ae4a0d13f0352a90fabad7f19be05fd97ec67c86482adb242ac083ee7163c6a44e3c84928db4a345aaf3cfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4ae3cb6e4df71a2f674688383b208be

SHA1
4c6492e599bedd51115d6d66b677ac1891693cc9

SHA256
abdda330802ec43344816f9afb06ad86c405ea5714fe7186aaecdb0429300d3e

SHA512
24eb070be2e3610ed0b7b40f65090b3bc0bfd4e6b8574de13c757939f20032ef9fcaa488faad5ca314e39849afaf1c657f90786f164254dbd5e2ed64129b1bce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
499d25c0a685e15d036d5f290e637a02

SHA1
70bc62b3093c611703d5db127adc33437d095b84

SHA256
59ec672d6164521b1b72f6e8c318c5a3e426a1230c6728e2faee7fc3331ef6a4

SHA512
4c1a3afc805706c5f512d8b510143a94a1f6dd16853e3ca758ae34170296c74c772b13e38ee6f4e80f1886ed00f1ea276822718650cf7becc69aa56586e0d85c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
866f367f4a0d7fc426ab987bff0662e6

SHA1
9b2439826dd909f510d425a6d57ceebd207bb27a

SHA256
e9735f6a16a660e6716d02f377f1fc86609530421fa7691e9a8287824e142a66

SHA512
98b8d7e97140be99e4e0f2983348c4000ff35a296d7dc755a236c94e4196a6c4c287369c75489c063dfb6e80ff42fe413e526eefe2b38eeda6813056374b0208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e64ec74be646f75a3076588b1fcffe7a

SHA1
2d7c07247b6bd06274a2b91655346b9594dc75eb

SHA256
3b2b1a041cc671ca523aaf37e5d5c61f20205c934de44e3d0c54a45e35c2316b

SHA512
6ac0fd3f1970d4ee73b4f71661c51a49a2d6e677c9c0938a9664b6596f7ab467f81e67e95a9aee5e6233a33bc70ad1400f4b5dce4ab5b6e131445ad5282b07e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
542545aa6fed66523632bfecbea6a40f

SHA1
a655265ba23635e20ac27cd28c0c6464fdee1f25

SHA256
296706a8851e66dcc8943ec7d45ba01f5f60a9242375f9b1e4f87de2c5dbe72e

SHA512
e39b3737dae0ff8e5c3da078ca825cea0631f4717d1acf117619da4e6a4fc8b53923a1ba8d3caee97adcf49533886b35982b5c0bd383b8fc894e451a27feaf70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5931071e6ac8f8deffc02940cf522b23

SHA1
85af14d73f16b6d068ac77186a759cf9ccc6a1ea

SHA256
66e9b360fe52d07f73eff346888d2c522cdd43a06572751347910d5e5acb44a3

SHA512
8309e6b8cfe8f0bb076d4e2af45d6276c99d1edb574e641a02ade9f95fb79b6e1576e927b639e40673ba97f924c38b7230230385493d98ca3578c87cb4dca101

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf11b41665f29fb1512810888b948ec8

SHA1
a7b49c8a9c5ae7899e98e730b39543d450b15845

SHA256
dfe8e95b1f0d978f7ee16f3e47f3a10f5b4db34d4cac1301d7dd07ea2aeab002

SHA512
5f6d8f4070e1eca73b12b08d196c6232e0ee4c0e04fae260976b54e9f52905f6aeaa42a5ae180280455fff92f11ecff585d65d77e2a97e22a6b040f6426fe864

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab52F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5B1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit