1185b9518f9ff34ea93094e972a7ab08d0cfc955b7904ed61015479bc67a49b1

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

407caab59dadf3689e2bf96490f9d578_JaffaCakes118.html
Size

18KB
MD5

407caab59dadf3689e2bf96490f9d578
SHA1

6b31edd722cf213db9898daa3f4f5f813014fdb1
SHA256

1185b9518f9ff34ea93094e972a7ab08d0cfc955b7904ed61015479bc67a49b1
SHA512

bd89243f2f7b42f8f280f976f461d54a190a1e475a3830617a56aaf5ab76dc793bfb8125c1a234cb9d8d18095bf4b4c5b2286fe4a21e9b7f2e9ec32505210fe6
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIfq4wzUnjBhcm82qDB8:SIMd0I5nvHHsvclxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F803F361-1149-11EF-AA6D-D62CE60191A1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421781353"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2892	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2892	iexplore.exe
2892	iexplore.exe
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2992	2892	iexplore.exe	28
PID 2892 wrote to memory of 2992	2892	iexplore.exe	28
PID 2892 wrote to memory of 2992	2892	iexplore.exe	28
PID 2892 wrote to memory of 2992	2892	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\407caab59dadf3689e2bf96490f9d578_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2892 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6563f902e77c9f1e39ae34b093afc05

SHA1
9239aaf8e7d150d419090a9a73c42315b3eeb0d6

SHA256
8e219ec7f3f5c894802ed9d3bf17cd37222645312195eb23f44fcb866a433598

SHA512
a9ed0ede2f7e795e9743ab7459fdf9cd9e6612c49608d1aef35901df20983412c4a13a88337c84347dcdd73ef5815c5bbf935dbbf33bfde7a3597cdcfa6965cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9ffea46d4cb078486afe9c8c01e4904

SHA1
436885b433e161e9ccf6b0efe0b0e165e665173e

SHA256
458959cce6aff17b3d7d0e699e808a49558d875e11f32ad5bd68290a5d861131

SHA512
6e45b5e9d91b19f3882ba23f0c778640954f7f6eec159b1e6be5eb36b98cb1ff2bc65f4899bb26130cd7f1c0d39eb23e03dd4cf464c7143e4b6b33ff6e83ba15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dd1dd3f2ea9697ea4c3c582f301d4ed

SHA1
501e10528d406028b8474b4ea4577bc249d4825d

SHA256
483e4ce2716374f0f531c43040fc66efc348b51ee3f197a5f9a01d9ae3c5ea8e

SHA512
609dde0ac27aa7a0229465a7a9f6d9b5f8e0f334bc2c0c4e6797219937fe03573c7ee7403377bdaac79e70398a6e52bcf71c846f7020b16dc2ea99a8f092b17f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddc7ebd967cd5bbce2d34858b327d5ec

SHA1
4c8c51eb0b803a56fab7a9e4ead66c780cb04094

SHA256
13055643e2c0d703331b8fe8334d8c8cfcbe9aa68c6d92156be23037a662950d

SHA512
ce36524aba5307b951027194d2fde618b8193a4aa6a406788be98b66c7ec5ba46009148e733253ca9d60e4ef446d21ee64e398d92b4c383126bff784db06dc94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
508f5f5c439a8055f12c2319a018f2f2

SHA1
054b82a83ab7be5df7740046162d820be953373c

SHA256
2e3b14cff3c7123c05e1e38ff136a44b663c4be7f891b2bf452d45f012295e48

SHA512
193c8ab6cfbbfa0471e20d1b9f457e49120811ea1f237da03e63d06ba37f7cdef33d6b88847cbf2a5e9bc1eb7628b49862a0c56c61d5393a390a632c02e1e5e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
438881b5b735cc442ef3e3118fc5475c

SHA1
7a3d145a2af0b03f9da693acc572a2b878afe3d6

SHA256
6951395bda1b861ab354fdaa4abf35db561e04e69f9086ad588aa74e3d533243

SHA512
7ab02d28849062a6261b1cef8c9fda5757a43dc1adbe92c6e03dba55ad47190d57279a2ca4afaab7ec1fa95a2c9c492c31a1e0458c9bcab6565ef883131ef4d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ed58e6d9699247e87039db8f210db91

SHA1
c4b723c12f5f9239006e97a2526322100df658ab

SHA256
401e5f06f5c5d70c98bc3055acad64f99ca3ae971a601949a9f50e612a4b9732

SHA512
ffcfbd96f696eab2a7cc342933fcd74ee2da1712c4e1544dab4e1f9603b700ad468d323073ca3a714b833198cf114de7b72bf4fecd387fc70f2bdd338c4b1fe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd49ceba3589ad75fc98a3c262c22253

SHA1
8752b28f173f96d7ecf75d4ea93e9027b1bfa992

SHA256
dcd1812a31518cbe3eb4e2be37d622c99e4ae3e47f3a93401de01445702d9cd7

SHA512
31ecf4c6fc204642449ed086c2854a1f581f71f3e4becc345a1fa6ff2bb59c29c1526d8cd8e2576073e14bac638486a7f307bbf1fb09589095f584303e29fd01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f39d639c1edb6eaee8f5061cd7f66f7

SHA1
e5f0186a4aec56d8862ed287690ef6fae0733918

SHA256
8d3d64b7666fb4608ab61b08f6b2d70ab94dd735a058f8a9872f48826c7e728e

SHA512
4e859ff1b8c193aac9ee83718d2f886287f9e4d1104bc10e82c8fc57b78826ee03e093032e3638ea0fb4e17bd1438642cc1febff030e2de5df98fb1dfaad58d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab280C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar285D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit