159a247a3483ddf95aeea1687b4f511b54c2a8da47a2442715df0ebeabe1ee26

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45f5364facc1f77f02ea923be3419cb6_JaffaCakes118.html
Size

213KB
MD5

45f5364facc1f77f02ea923be3419cb6
SHA1

a18a6519b90bff42e7a91614c21c1277d7d8598d
SHA256

159a247a3483ddf95aeea1687b4f511b54c2a8da47a2442715df0ebeabe1ee26
SHA512

f3956ab79b0f755086417cb871a7ee4596e4849fb137acf8cc6a6eb79e5592fd7c88b2921a5c0ee128245471f18c97bc853283bb39b536f62d5b1c1cfa6f811b
SSDEEP

3072:Soo3mbzbKnSyfkMY+BES09JXAnyrZalI+YQ:SoxYXsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A30FDF1-12AE-11EF-AD38-76E827BE66E5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421934340"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1860	iexplore.exe
1860	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2548	1860	iexplore.exe	28
PID 1860 wrote to memory of 2548	1860	iexplore.exe	28
PID 1860 wrote to memory of 2548	1860	iexplore.exe	28
PID 1860 wrote to memory of 2548	1860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45f5364facc1f77f02ea923be3419cb6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bc62e61be6d6f179483ec8a147d7c63

SHA1
b7c13e2753ab759b31add9bc6c9c07c237d6b5e5

SHA256
932f03200363415ed06e0283b49eab7f326ad34f974acd4c815b41351ea4fcfd

SHA512
44a4fac1dbaff84536df4bf32d61a33b592d6eb6bcfb891c3cde96c41286339e6f5ee05566ce621293b48094a1bae6a56f31e30e59350cd14eb77ead35721194

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23d0dc4f0ee80853823ded1d0f88df08

SHA1
9d2a5485170f30f3e3b58329e1094427ee410002

SHA256
91176428bcb833f923aafa799e0ebc0ea559a2993f79ddeecedf3510edd8b54a

SHA512
f1793919afa572d278acf2e1b49fb4d35da0b286d8e40ecc6dd565c47980fc8602be988a619118dbffc8ec95e8a4380d26e3ec6cbf9c690b04c58f03a51fa3fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fb4129cba69f1480c0294805660b2d3

SHA1
9f171702ed43a904ee6866e60c91d6eddf193392

SHA256
44668ecdd7ba102fe28408a79e1225fbefe8a9e3e78548d8d5895ffb080962e6

SHA512
af1cc905563b4fd0f167821db61040c2c6001e948302214f654153e9114436c6dde7dedc4e5e0f3f0b276ec4bd6db3ab6561ee6c56269f77117db0b72b0f867b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c89e64fc26782a3fc5ff89d009abd5eb

SHA1
52a164b6e33bfc196547262bed9ee3784a82ac55

SHA256
6e5ef87f80c9a2297a9d300dbe40e55f8da88582bafe9349b14642dfbf326c75

SHA512
5fc376179e313be8cf3cab568938e37b6d69412c88e0f14056977bfcb6ee916826c41d865dd4a0c13eead0f38f54c21b747a02eef77dbd4ac62a24037fb9f8a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b96c61d9a670d4e48c5e8a7e51dad45

SHA1
96dbba178b7224f7c29d87d6d6e66bbe0b528f3c

SHA256
1b939d0dd6b048cd414252d29989b0a57e6f8b492721213193485d5d001acb8a

SHA512
115259431a4756147da6a4c695612bd907c648d43bd737c1199d0abce60c061188fdf1ee60689b75cc889bcba8040d0ccf0edbca38fe7e906ec87b120e5b74bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4f252d579f3bc5f90c5a3c17c07942e

SHA1
08abb96b72857a90b207a30db130be8a7f3dd892

SHA256
230b2ffded608888eb12ec9cd184dddcb2fc9ffc15a1af95190bcb7d4f04ef45

SHA512
8139f694eed25611543b0412d6d78ec4e4fbdbc90da33588d971c7328cd36c720acf9076d866149b319e2e5b0a66ee695ecf91a11f4c9cf3e1a411807f5d67b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
865c158e4acfa9f04d617660b88b2019

SHA1
a50ac82e58b99dc8efc5ff2119ce6ede3facafb5

SHA256
9cf00b0037797dfa7c207732c96562f2e8549c122c54c81700970088a4a9f229

SHA512
682df5fd1c418c135bf53614d6939a21121c3ccd4e8562049842e33130cc57c4900796e2b0cee4d59abc7c3507760e032e795f45b4661e04421a4266b05e46fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e53de4de48b9fe8557ae93e99f707abe

SHA1
9df3305092124999601a525dc29a663ab940df04

SHA256
f9732e487f2be64713dbef358e56cd92e7cd89dd50bce7581b48906972df8d36

SHA512
559b94ee199b1fd1b145d5099ba3772c33d59a24d4b63e35b6541c8429a30cdb291a244490e26b442968623119a15001027bc2dfe3477d2db70593c6162b7895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75c9f5c9bcf527c7e9fdd95dc5ce8d7c

SHA1
4bac17dfd27ce52e4ae3b5116dc59cb1215a9a6e

SHA256
cda39d04aceedc42ba9726a7e5a2804a00cad24f4c3bb063c1dca0e24fca9b68

SHA512
35d01dfe1bb4f7dc8e26968bcc05cdc631b513a681cc36ba26d2b4e08832823d0390a4a3d4711d7ba02eeb93490ccb537427d0c01d1c1d1f244514c9446be03e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85695b151a9b72b04e48a5d1a3df452a

SHA1
72b944163ba295748714de69426a570bc82cdb17

SHA256
703cd59d704201c4fee5624cd57d5195b03a1f968c6926daaca6f58a0c889047

SHA512
1722a533b7fad00f3c2009d137de90dd475dfb8d5e21fb24ce168822ca0d557c7ffb7d08066303a3e3c44fc6d8893aa2a065af0a0c324ec7a58402378ecd48c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b00d17e1f417dab9a4c9ace21e10371e

SHA1
0745135c26f42656c0df04bd9e8a958087c507fa

SHA256
15f5c0a1a471eea38f76a604a2085bb957a0f287e327f3ec21406d0f351d3043

SHA512
46e0426318f6b04144dcdc54d1fc3066b7e1577fa8b1315073c99eaca39cf401ee1664d5c11c018b41bfcab41ff88173c76a8874cb2da13ea110788d861dd4f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5BD.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar62D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit