2c458b6a5cb362406bc40ec2b4086e62fde23c9cc2113b4e90334907c8c1ce6a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4281c419b4108d4593000a51d9827983_JaffaCakes118.html
Size

19KB
MD5

4281c419b4108d4593000a51d9827983
SHA1

a2ecdddfd1c8813eb77f8f22c7910ccdf3e86cf7
SHA256

2c458b6a5cb362406bc40ec2b4086e62fde23c9cc2113b4e90334907c8c1ce6a
SHA512

7e1e7f4fad9441073a6448e43443d99843acdb32fb3e3b83b77f5f1b059982fb4bc8efea97c86e502c4e79abe0e389bbce558a83fcbba668822df24244e64b03
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIh4zzUnjBhtn82qDB8:SIMd0I5nvHFsvt8xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F48B411-1220-11EF-9988-CEEE273A2359} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421873359"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
996	iexplore.exe
996	iexplore.exe
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 2532	996	iexplore.exe	28
PID 996 wrote to memory of 2532	996	iexplore.exe	28
PID 996 wrote to memory of 2532	996	iexplore.exe	28
PID 996 wrote to memory of 2532	996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4281c419b4108d4593000a51d9827983_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a1e71f9e2402a5cbf0e9e6d67c3b679

SHA1
bd8b96e4134a2cd38b92249b61f054191d9c7ea5

SHA256
ccefb314d3c4ba24d09fe36d53174bdc2ad8d721807ebb16bfaf468e84b4f465

SHA512
1b7eb4e3df8a3d7ac9794645ae8a0bf5b018acd0513672a64c6fecfc6d74a00de986ea6e9087906eb526e56235b73ea5043d190aba8e9f919e4b890124ca9051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b615bbd2f39feb37fb0ae972af4c1a8

SHA1
7a15517d263d63074a946c9205461b41980c78b7

SHA256
926beb3b64f523d80b3557582720e2f59c7e9674202944ab993fdf67b076074f

SHA512
f9021647878170eb4c8f7246b83706fdcee22527471837ba5a4e996f204529870ae3514e86b0af7a084eca5d55a883cce13207ff18f843491dff002942ff0b32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d14929f4e9d9fc1e9792b78ca512144f

SHA1
7dfb3ad597d445df094ae8a982ee2e2a56a6cbfa

SHA256
c12246d41d5bce04de208bd7c480d5d85e1b677df86ffb2cedadcf44d4fc365a

SHA512
1c1d4514e40e34de29abe4879aefd50067c106e9bbff0bfe99b24337816f1cb0d0cb58898c6e20e32cde51379bae0078d7f5ec5dc87e5d72b3edd24684b0cc9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad7680392f33fc32561b5a90485d058c

SHA1
dbfb30efc0c57f9342072733385b3576d823e9f1

SHA256
0c92f2eb6c4c5a94bd33ab3c0a2271ca7148db9b4df03e5a90e882e431b83675

SHA512
bf2c04ab5f613e28f39a3abbeaa2c00ecc5ff8d94c1a60e02ed9f8f7b5901bd80966c52c41ca5f2b7b60aedc039f5146553ee94f6079415cfd2fadeba014e882

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa9e6a2aa3b421a45478ba2cca5e20e2

SHA1
3138598f0a0cad346ad04205d30dbdb35d6a72ad

SHA256
14e96d05b8e01bdacc0e75119e9caf55e5f5b3f218b8b45ff96917d8b16a4617

SHA512
1dca9e6dab2115c237ea6b0df1b0392fffccbe9a3a002dbd41dbc85911339d30b270b9256711bd43186b7585a369b2cc354d5fa8a9e28741e837943eb62770bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e375205ce4b49a6ba5da0f70b8b0b5e

SHA1
f23f59d888b0a9c8a1e1ecafa961939fee2beba7

SHA256
05237a6f0a2434a3b0874fc8df2232c7fab6994050126e2b10ddbb959811bb49

SHA512
d19e669c74e6e1a8bcab080646cdf2826672b33bacb68b39575af1d108cdab90bf8cf42ed07d6925ccf37f386f1010e59c0a4a8af859bf049dcdc2f8ea59bfeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ec46b51d3e81622feb5fe0e58a2cf2e

SHA1
16d7d858d3c0a5cae041bc8ca2f336bbd8846d51

SHA256
578c33cb4e5d515a1c89f0a0b3f8e0be919af5c19bd513ec5efd9ecf34a6db96

SHA512
44364ed531f722b3aa40ca23f25e68b8600193f3c61ff7a447587a222a264309c85bdcc012d300575f6bf51533e34ea8ceef6a28df5395550eac17982d1cd194

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4431d2c1bdb182acfb042d1530a76c71

SHA1
ed2433ac595191780f418cf8f4258e3f147636a1

SHA256
766cbbf24726f7165a4ab3088bd32e45fd2d19d51dc425805a9a3e5fcc296905

SHA512
35a1449ae37c69594855ed604edf1d832a79dc346bf78fd0c3912dfa88b49aeed0f392685fc786271adcc056e3f1dc6876e0090f810afc58c83faa6c61313685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37ed86c01a20d67159ff1c690c076b15

SHA1
a38403e275b2cd53e195db19f5e89fea845eaefc

SHA256
53256c65858589f28c90b6ced5158fbfad259c96c5c5b1775aab97da388ce0df

SHA512
9085d83f7a1b668abcc905954af739413e35ff0374273778f6c28467f21d011ae31e693073656189217a60402bb6f6b86b84fd105bd14edb9c9690a79dc489a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2829.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar294B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit