d9da80f03f9bac26c73d783c45f9694bffdb52dcd183e91ec3194cad4e4ce0fb

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4056cead6d64f368c1776684448e4f94_JaffaCakes118.html
Size

4KB
MD5

4056cead6d64f368c1776684448e4f94
SHA1

1dbdab16b8c0e4f01ba200465469dec84bcac9e8
SHA256

d9da80f03f9bac26c73d783c45f9694bffdb52dcd183e91ec3194cad4e4ce0fb
SHA512

cab9bac20a6d24ce7b3d550b407902a2085902ab990855f6a428b352a50954ecfcd3356a4089d791175894c41bb9948d9e0efad9afc42177f4e5f60abc15d187
SSDEEP

96:Di0v4oD4iJ9ag/gqCKi0v4oD4iJ9ag/uTAOkPKi0v4oD4iJ9ag/0qPZ7YvUUm1pe:DiJoDZJ9FgGiJoDZJ9FuTADPKiJoDZJy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421778938"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57F04091-1144-11EF-8A04-E6AC171B5DA5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2736	2364	iexplore.exe	28
PID 2364 wrote to memory of 2736	2364	iexplore.exe	28
PID 2364 wrote to memory of 2736	2364	iexplore.exe	28
PID 2364 wrote to memory of 2736	2364	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4056cead6d64f368c1776684448e4f94_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f3ee465837326dd86313d4389cd32cc

SHA1
8209e316385cd82cc4b17753d743c1d2b0ceced5

SHA256
73abb1c71b72ee252b08a68dc4d60a65a32708903ec670abd10e636ce7f1aa29

SHA512
989d0e317d89a50b8551f9e000860ad0419aa3d00739a5eefe29aabc2685caff904b3a6ccb2ba73fa37486ae1087359868d3dec0c224f15f96ce61069f91011e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
436dfdc0881e6eb7f236596d7d854800

SHA1
f82422a72b7db9c76ed1ce03d7473ff4526bd0cb

SHA256
46c4061a76fb1ecabb227822ff429addd21d7cb9b3328d2fe8f29366df6114ed

SHA512
18392ad7d6fa8e75bad4369b8f354be9c4e333fad5ca3eac38add5d66281fd2d4d6fac6c7534af11dfc0a22c7c509d7ed54323bfc9b50d1a9b55cb6ecff46aac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17435e18173a1debc9cc7a29cbd41c16

SHA1
ffd54042c45ec1496d63b6f840303ab43e23d300

SHA256
4b97b5afc9fe374ce722c2286e2bb3a42a90dfdc12f7be89b3ea5d4bd305c25a

SHA512
8ff61c3c3d2f7aac1aceb9342b43d8694c18c19499d1b04dff848ece68aa88c8019114ada7caa47cd48c11759a6bef1ec778b5fc9ca0ba4e617ae862b496f2e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a69aeda8cf9ca1e17eac438cfca020ce

SHA1
c2d12614d5929d87227d8e7381f91574971ef115

SHA256
c88f06b179f3ba5abf338438760f9681c802405663f401bf439540f387183e86

SHA512
d74f782fc46b33610641dcd34945fa922153c04fb3371c989394db4a95af7ee7b5b2f77b29203124da4d1aeb4fd72d37a58cec40f9c5cb300edf9a73167caeed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aae42f0c7069bf03b61033d58e607362

SHA1
5d5fd8f5e12ba8a66bebba4570ce5680e2438104

SHA256
7df9cfea8d6613dd7eb6008d940e9129e992624f034e3c13d92bac95479ed4db

SHA512
704916a225b6ff973a3c954e750de28426239be2803d0a744f9a6c777f11733d6060488c012da320a266d722da678c48a5169d4e08b12d923a14516224aae572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9223210c319e4430d1afff9d2b380b0f

SHA1
3da2de47e7a0ff5c76f830e9f4c62191d8a34c84

SHA256
13072983793b8bd460ce06add982ddb39091017e9139b79274d7e27e54dfdbd8

SHA512
bf86d4de4b9f7f644f59a1793ae9b89c6f529301f742df683e1494cf43d3db708b0a9cd2e4e4cd1a15813ba742e1bb576a609358fa8f7914de7086a1220e1e0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b1288cec03875341439459d2406d8e0

SHA1
0653693028b7a3d920f2f81d21b9fb5efb89a8a5

SHA256
00c69ce9987b14c01ab3d68688c4278948d5aa0ad605395d75fedcae4b9d7f48

SHA512
c0b1bdffb1375ad6de7fc927a9251e0a210a6352f71465da263a561ba1ab93b13c4a214ccda9eecb3106772f3b383f241f337157d439f9bd2067dd6b68fa7969

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ded8d8048880aeecd6b9ec5f94d588a1

SHA1
c4778cce5b12bcf486f087350b5a316c728bf76f

SHA256
fa154dd4e4053cd9e58f02346da0ffd42ffe443111f1e88ff43dfc80c17402da

SHA512
d579dc3b66f2afd3f99553ca0e125a6709368909610e2f4a3de46359a7a92add8ab4196d844314d2e888334775dfec61090a5aa34ecc7e84f92fc34674319f6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9B3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA70.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA85.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit