495fa79dfa41e92f9c5fd4d0027091a6de5806df6b5208af69b11b16fa420249

Analysis

max time kernel
148s
max time network
138s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4842ec9c545fcad9660d2617e5e25a21_JaffaCakes118.html
Size

32KB
MD5

4842ec9c545fcad9660d2617e5e25a21
SHA1

d80cbf05001ba267c6ec6192773d62c0111dd2c9
SHA256

495fa79dfa41e92f9c5fd4d0027091a6de5806df6b5208af69b11b16fa420249
SHA512

04826e3419a36ff959c228aaa75f626bc85ed674e11fe52252f41d2160c3770e1f75ec5de459f1dab81dbea0122f80fee74eddcacdfdff7baf2875d754ddd06b
SSDEEP

768:SCvktujBt/pFx9hRs9QbsStzJfcTOQA1DpQ48wpkaiTjp:SCJpFx9h7HrQEpQv7ai3p

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6E69061-1307-11EF-80DF-F60046394256} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421972854"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2836	iexplore.exe
2836	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2908	2836	iexplore.exe	28
PID 2836 wrote to memory of 2908	2836	iexplore.exe	28
PID 2836 wrote to memory of 2908	2836	iexplore.exe	28
PID 2836 wrote to memory of 2908	2836	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4842ec9c545fcad9660d2617e5e25a21_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
562e676076ea63d0425d95038c2a5bde

SHA1
7acc47e0994a739d1e05498586fa750b5daf2029

SHA256
b4b18e0fa2aba9ff0fde45fbbe400375b7caa80bd651472ebfb202e42fccfb05

SHA512
c42682980dd1275f1fbcf3bada4d3f9458d4187bfc29bc5a0cb8b8e1f8008d373927a5f5dd57b0262bf9ba8fdc76731e294497c194667a13fb98b30f41f2c70c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c8d1db92b0fc8bfc5c47e74140250c9

SHA1
11518fd1eac987b0ea2320486a698ae45a6ae6e7

SHA256
4986c14c7aa716b387e64692e54bf5d483115f4997dee98d4d85b97b706a8ad8

SHA512
354f56fb0ea58f9f3cbcda90ce2bec0855bc56d8bd95e90ef0ed7d5ac86603981a9de8c71e78a42e91d354a2799e5bfdf15e418e307e4185d680a8fe6de49d03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c09c43390e9a4992a85369f9453d8e3

SHA1
7f52e11669d0372bef629e50950483241885b072

SHA256
75cc8a87785b5a8d9faacab0d1fc17c4f297b35c9391615d89128333df266d9f

SHA512
2bc148de5a75f4aa1e85c52cbf54daa212ada00ed510d9f203698a4a5b033bdd79950ad799885cc79c8c2a1f179e096d7a073970fbb9d319ada0d49b753ec3b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dc6c9d39d9e9f3b78750f497a435ff7

SHA1
cceb11ee265867f5b57a319deedb6029fc316b0f

SHA256
17a02347c1746ca4086f9273a4383785b5dd89e6b66bbb9b50684b6eefd57267

SHA512
8a06fa21349847baa855d923af551d4604ae7313d7572dbe70bb18c01cb328939401ca4ad4501630bbaa361a686b84baaba2320325340a19e1bbe2edb5789c03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d535cf708dca63b7aaab146f2751114

SHA1
021f6f07e8b3bbdd08ea16f1e49bc84c85b17244

SHA256
7a577aecf1f0a1043f6caa513988f5623d7b6bbcf5795e4b69a4936585a1fe28

SHA512
e08c4e18a8237f5d43f22bf22868d4e90504cd1e9ae550eb92808ac5a21be1f1f319befb84fd7789ff59216d2abc561dff1e4492002c07b07e14aa883c9cc8eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad52e35251f62ad39e291a03e54d4149

SHA1
4dd5758d06dcab2646650695e1f66a9fa38750d4

SHA256
04b7e11fae94cfe37a3b5a28cbe927a944b85a5d8dd2886210b4291640807264

SHA512
e2c0d3d4384645446164ec762b50e85107f2f27cbc133e94dd04567c1c2a7d7e67e8f67926ca78588b06863f20cf25a2618a7286804928ca084a929d89768db1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73016b6f5c88322ee526d2a3052c0047

SHA1
97233141dfc9faca150827729ec27fa83ec76aae

SHA256
da9e62da701534c2455a1b2f4e17dbde129deee194bc115a3f9e27c8cd6b824f

SHA512
20be71dc1a6e43ac539ce4e09c13f4b511ae71734567357c4762c10bab5bab8a01e9c1266cad8dd21e84a2eaa09c938b7099f4360d4c823fd7c637cf64de3200

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00158665c2db379a30cdc50b66d9d95f

SHA1
db955f772e55933371bc3210469a9f0cb56e877b

SHA256
bf58f00e6158a25260f6b9d31a36e354406a943ad0a96e70e68c137de5a28d8d

SHA512
75044fc1868ab548ed74357cf911e14999cae5276e9ec6655ce84bfa7f02e80a0065a6c9bb0f320582b65e92e215f5a29363a0d69f687e5d5a6c09f65edfe123

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75fb8af6a275c691a5e8051c449bf6ff

SHA1
823fb13c58371f0f17ec693f1a1c3cf9f16a81bc

SHA256
63b4938187604986d65a47b677140e0d052329065e0a5f62c941a82fd8330268

SHA512
5bc32e1f55471dc3933b26f99c5faa61fbc1e8a77c90a5c10b3ba47ed624687882f2003fffc2629dade38c2d07949442bb019f05f630643daf8b762a87511a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A46.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1AF5.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B09.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit