4ee979881a5900890d286a42b94ca01c6424280ab52ad21d87638baf6b72d45f

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e01bef6cea367d52247d468e8139f91_JaffaCakes118.html
Size

19KB
MD5

3e01bef6cea367d52247d468e8139f91
SHA1

2b3534e5799a140407a72153c28fbe6753328cea
SHA256

4ee979881a5900890d286a42b94ca01c6424280ab52ad21d87638baf6b72d45f
SHA512

cda90c2722fedfdf17e860fe649aed81fe154e797215bc61bb605a80b5f9e347eeec8935c77dfe01cb88db0208329b4e6eddadfb1f402c10621358c197683a25
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIj47zUnjBhx782qDB8:SIMd0I5nvHpsvxgxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421825671"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{270D8DD1-11B1-11EF-B44D-5A451966104F} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
1144	IEXPLORE.EXE
1144	IEXPLORE.EXE
1144	IEXPLORE.EXE
1144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1144	1712	iexplore.exe	28
PID 1712 wrote to memory of 1144	1712	iexplore.exe	28
PID 1712 wrote to memory of 1144	1712	iexplore.exe	28
PID 1712 wrote to memory of 1144	1712	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e01bef6cea367d52247d468e8139f91_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fabb95b799ba0a8dede3716eca58a32

SHA1
904030cb337a27488cdff6e74b88458132124217

SHA256
32645f5ee87b1f0f0aec41fcacaf2e6832121d47ecfa13f20beb0e48107736f3

SHA512
18213a47651f65d9317fc590c3e25d1151f59248d80c9d05368d790076d86581d6bc37f344d6b07ebcd6e5d88a5fa8d7926f5cf270408f0fe5d1ed09b434c0f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b184e540fa08469ddff17212decf0de0

SHA1
fac590ab37c5a976c8ec6dac1ce7ade065155019

SHA256
18fb1740deddd8a5ff316d572393734a5e481c539ce81accb3e53f0f4bc82bea

SHA512
4020538c872d5d4ca55d0bc28bd9b4d294a61b68caccfb999a9a49698577e4a1802d81b51409e6f4786bf75503a436c0d5ef7ac8ae72d699a35c10b1c9604129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82cb31bf1f7f143a8358499fe50e3f8d

SHA1
e119e9680fafc8b689be07e714a80d662f3c05f2

SHA256
6fd2e41381a968b7334e2ee4337fb50c55d9807a2732e4949e510522f82eba40

SHA512
fc964431c2f7fcea0e2da943be7bed3edd016b84a3e402719ee1a88910b748d7fcc6415b53553ccb82d05358e5efeea8001a81533703bb1c9922f72f9553a640

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b65d2e8994dedcdd5320ecf8322014ae

SHA1
88b48b17cdddb91286a414811eaccd9f7c9ba269

SHA256
9e290e42dc2dcbeee6be0d7e7e838de46574ceb28a1a12fc51b955f4f3d456d6

SHA512
ea73f63b500ac599973a64229496ca9fa5dedd44152832c6f28833715677b425744d5fd704526a2279928465728b166b8db6a5a976a30991fb4699c39fa29fa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
921c8885107d5935efa912cd5d26aa7a

SHA1
bf39744591fb91ba393b233c01678309b4422225

SHA256
01e55b8c62aee6647d5358b456c863c190b5888a8a47041028910a7062b855a0

SHA512
265914895e8c96b3e79666711ecf74cbdea5aed4e064f149f8d58d550f6b8004122523b1fdb8f99a34f44d61ab3ee8f3d8cab0f1dfaeb4a1066961cea0a74592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c8f1dff065b835ff984681f818a9f91

SHA1
0cd625dcb955e12b5473b0db3cb5040323cb2dca

SHA256
b88f61ad557c33c7673693e74a25bfe7e8328fd76f85d1f972bf0520d51f1902

SHA512
19e69fb681ae9cec7b9968758833c335abfffe905578259ecfdd6300f7980f30c144a95ccc40bef1ef74f9439c3a61cce31360353252eed5101a16f119a48c0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56fb84e6419d90188fe2a84ac7013e4a

SHA1
40d61592f756d9a2333ea1a7a1d4487fb26bb734

SHA256
00ece48d51356d3f53154a577e5fcfe6195ca871eaea98c0831ffd3b6a67575d

SHA512
a31c7cc1842ce0a832ead857f3edba0e8aca77d269eedd7588f0d95b5180ba0498b158cdb36ca9e581d0584e7e6654c4be1ccc7c244357ac0e5bc60ea098ad11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7201559c1f215d23f004a0942595d2b

SHA1
26891adcf027dcef7a63b7dfbefb57ded322c6c9

SHA256
3221d583e4ff64024c23ec3fcd30ee84bdb194776dd4885af10f2576547e264c

SHA512
48acabf7cfbf18f0ee7110f10fbe5a1d896b1295e42fe87445b85aa17642c91635b3dd256825be3ca0cf6766393edbe1413cbc9cbe79f98e2522846972ea9315

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae90aaf3c67e0fb4386b53ee5eeb4a11

SHA1
a8a59f7620122da730baa6cfcb1bbc3a23b07565

SHA256
38e949fa40345ab7db0b1b9858386510f307e1796c81bb7b598157d71a78ea69

SHA512
05d385ba9520529abba7da30270059c2e3f8ab2a49312611f2331f6393c693bfc99eea0c90f56be980c19cacb330c1c79bdc7780db6f78213cad299b95ab7c7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab20EB.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar215B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit