aef4325fd6a1780f4af367ee7ef2a549bf289b2e8b626ea5d9d4623f00cad501

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 06:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

44d283e617ceee1af19dc548d455e16c_JaffaCakes118.html
Size

2KB
MD5

44d283e617ceee1af19dc548d455e16c
SHA1

3332f973eca9e6764f04b2fe5d9d05390baa8809
SHA256

aef4325fd6a1780f4af367ee7ef2a549bf289b2e8b626ea5d9d4623f00cad501
SHA512

682b0b7ff7f186d6245f31486a40f4e46eef4e60ed68c90d1ee4db43e01870908f6c145d722182f7c76d9ca0e9b797675e0c2b9bb506b39c8d066f19113f9a88

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6EF09B31-1281-11EF-9A67-52FD63057C4C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421915127"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2912	1680	iexplore.exe	28
PID 1680 wrote to memory of 2912	1680	iexplore.exe	28
PID 1680 wrote to memory of 2912	1680	iexplore.exe	28
PID 1680 wrote to memory of 2912	1680	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44d283e617ceee1af19dc548d455e16c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6e87cc85a6779f10c6bcb0785e13d2f

SHA1
63b79efe3ddbdf8fa7ef35c741456f78ae9a0e94

SHA256
34bca4cc85fb8c602a8abf30de5f898a00b982d402a9ae847fe1840a3c71abb1

SHA512
6a39b2bda4289022da17be3f1ff8241735df7424416c500fe0b65b3b4ac710979a49f51d37045e91edb0f4ff1acba2a8bc30617fc498a103c717583549b1d146

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e2abee2d66366d681e759b14e7ebcbf

SHA1
ac6adfc0e850a4ca7d95afa9a42752d934dd03f4

SHA256
12474a6d3d03fc6e3d4bdefe0bddef502a46934a95a52bb7e654e12ad74e1852

SHA512
fbbd85171a671066e4a486815b4655f3785bea5ead37f9b6b9724deb8e89cc37be830e04cd30d0056b377aa0a7322c46d785312c6b43be620ca58225a67a3ee6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf458f808c8be294c5c8afe5067b478f

SHA1
7a14ead8c5c48c36cc51f832e213fa2cb2a11861

SHA256
df608a0a9f7b3a8e8925c6d813d3e748b9bb3873740ec22b5ee04f254ee83ee3

SHA512
21fbaf27f989361e192460200e147da4e706861bcc0805f781ac9cae1e66a6592729ad8fcd6802282adb312adb2cbfc05c60f739cfc46a2aedc6297df9f30d79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
571883fdddbc25534803185dde045fe9

SHA1
abbcffe58d76bca005a484195e28d8da027d6ecc

SHA256
82ec4d89e732856432cd89ada0c67baebcce7d55badcb4798ccde31c73eb3daf

SHA512
92f133ab457b60af0f66d7fcd657b2d2718b9cf28edafeaf2c06b5268e5a17b8a2b4e3ba96dfa2af8148b09c139fc71c5326723f80a82aaa5e0d01e86a595b60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f2eafc526e6b382291172308de4fcea

SHA1
df72c8849ba890d736b6e304f07da5be78de3fb4

SHA256
88400e00da1b85cec141ca0fde944799f7e86c210f0b32a922401d69c6e3a717

SHA512
856bb5727fbf16f09e16aacef2fd4f6e0d1ed6c2e69ab4bb704a6a51334a331d814a9e9d28a40e43c3d8144f3adaae2bc7771fb437001b1a4321083beeb61c19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1e268a891e84c468ac716f39d5e354d

SHA1
a4ef02f7d29f629c00d95dc70ea0ce9ce94ecec9

SHA256
8c81f2830403cb6aa96fdd472990bfacd4ba04fa0d96a4f8c7b4daf8f59ffc2c

SHA512
4a39f61224c44f1396e46b74a94f2478353fa2876e510ed37117dc06e7a71c342835e0206aa869e3c7582495747ed70be248a46989c0ed7d1fed172853378d13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0016b8573cec02f4ce0fb756b909528e

SHA1
c54a8ecef415e152fb02c7b535c5f1db3ac2c4ef

SHA256
f47a8f8d3b550d4bc1fec197bd42fff9ba2f80d7b62cac61bfe532a418afee1c

SHA512
124cca67cf5a5972b6e559d6fe1a4a0b506ed9cabb696066639db3926314d62bf93ed946bb08a255fb28fd062f452385514a70e6f8dccc507030c58565ead2a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99a1bf578998a0ff49cdea55dafa4add

SHA1
e642c3d124090309d80f116b10953c8da2782fae

SHA256
f4b2e2aaef554c051880c3391367bdcbee148423641436a4482e739cb6e75713

SHA512
cd61934e82c45d81af22b9efdf16432c0c56f61d8b79f0fe9bd1564a892c77b4a26ed8fec36a57be583ceb5be026d014cb55e28520dbca1f2a1cf6516fd210ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d35d3102c15dc28d3faab730f18241b0

SHA1
e641859245368902f22cba49628e8848fbb9d30f

SHA256
4e38facf96e187bf2dadf8942c21dc9bcce17d9ef55b0874d02e2ce0e309ef26

SHA512
bc01a89c6d0ddb2b5bf829b448e39df450221861c0ab1f39149d213bd057ca0f3822fde49bc072aa85b42609fa52d03f0ef3c03126ebfa2e18ce0fa75e9b8aaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab454.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit