b6e1bdca38ec17010471a2d40d99241146ae995a90cbdd8ee28e9590e2d2b3ed

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46d305333cbeced0385848e41c36b3c4_JaffaCakes118.html
Size

17KB
MD5

46d305333cbeced0385848e41c36b3c4
SHA1

50e47089d2bd230153ef3a21000ccc5e37594bf2
SHA256

b6e1bdca38ec17010471a2d40d99241146ae995a90cbdd8ee28e9590e2d2b3ed
SHA512

86d532c546eed48ceb96bc63c3122e280c7538d7846a9cb077aa65202eb66b4d6d9fabb3a558eb2ff8824f2ef8906bec493792d45de3833b98c216949d41c6e8
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI84wzUnjBhQ682qDB8:SIMd0I5nvHhsvQ5xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421949145"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A16DF451-12D0-11EF-A3F8-62949D229D16} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2948	1992	iexplore.exe	28
PID 1992 wrote to memory of 2948	1992	iexplore.exe	28
PID 1992 wrote to memory of 2948	1992	iexplore.exe	28
PID 1992 wrote to memory of 2948	1992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46d305333cbeced0385848e41c36b3c4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
591ffb51c3cba97f527afd8d29656e6b

SHA1
83bf28ff17a3523512e15c1fa0be72c600c8cd46

SHA256
89a41488c63871f53ef47eb73b70306b40b9983cb4ff90552f058aa5dfbe7755

SHA512
4d20824de4ac2f719efbf77c0d21c82de611c3839f7c7128ce679ef5207d59e173f2ae1d3097fc2665e4f77f904d110a20731c89a4237a3f91decbf54336a8fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f63ab36dfe1f70a07fb0ac6dd1be6cbe

SHA1
0b1b6ac1141755260fdf207683941a56ca7f0786

SHA256
46a55d2db79e2c4b222c1fbc835638c0b1fa4804cadafda737f314ecd0507591

SHA512
7e64818eb57c27129066df57162c0476cc56b43c1d459e65cfe94dae2b2f37ea1ae7bb807d3d76e4ca7a0b4571219ca46d065876a13a4116930c5be71caa3396

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27cdda10c618514062c3e35618a7fb62

SHA1
33d71d7ee127b5614e1d3255119588fc2400ae6b

SHA256
2724ca0da91c15c60faccf678e355f3c522a26ba41d0e1e5da3027217c6090a3

SHA512
ccfbdcafac2414b311dfeefcc2f81fd0d6b53e94b9d888ff97895b7642e3792fc0daf4dac0489d4521a9befc3acbbdbc2babfd59c876a26075323fca4f8e4afc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2810e42c4d35ad9c00e949e579ae5ad

SHA1
c067d2fc81ba5cc89ccfffc093b8cb6178387b03

SHA256
e0f6d8dd4524adf454a8e4f8be54857081cb44d826617cd142419b23ff39996d

SHA512
ebe628f1bf5d9d044a48816de9d31accb84c23380a07c996b82eb51f2d6a4309ead53bc3a6f87c941c86a7bb8ecc8c42754ba5b44494fd12b2364a2fd94d4307

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67f1a1b50272e169f66d330d86fcde59

SHA1
14f5219e63b13efcb625ac0431969637e5cea9e5

SHA256
a9ab40472e82542a260d17665ab83b93f94671c66e636a41b709a4ee33612adc

SHA512
479ac624f2e3c69ceab6b3124464105a20b547392b33edf755d817524c4acfd996187ca1f879376d7e337a1f37bc0e3c398f54e6cb9136cd90ae5d140c849ada

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecb8222017c4c5e1f98255a40b397b3f

SHA1
d5e7f524a928be540e4085e70e9fb2aa5ed99adf

SHA256
203e4409faec8b20c8c5cef14abe0cabb64c2cd41e933f754566e0ec3df2a5c8

SHA512
6358fccc86ac59570ee7120e2c03d2fa1ade9c9e93a460d3eaf76c2e1380b4700fa2a57d94dd1078a4d54391d1af917acd5584f8de1d2348e8d22ac19d62665c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2cf61034071a04b163f0f462cd5f922

SHA1
fb47567b19e7bc57f9f8a2e2891dd2e3da603650

SHA256
3db35128582c84f9152692d289a255713c370c228393a85216b07d595a861fda

SHA512
fb0248b2d7980b8fe274f975b059613d893f9364dd0eed9d490364bbd160c1c83a6de9c0a6d92a6e2886da252995ca4bd0c65a0434e044166e917741fafe515c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5112917721c12a278d6e35dd3e2b655a

SHA1
d0e45862ff70407c2386383531be7bc6e61a43f1

SHA256
637d3ca63c11e4a048cb4086f9ef1c433c1b7a510edef859e87e0b1cd6576603

SHA512
2d7ce8f61b941dba15bcdd426c2f7de034f63e35301ef1cabb9081a71c713664eaeda88bd02a93275e484cc760e741b358f49763ac04721d4c6d5b6efd9fdf6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63b2b584e66549e9849886ff4eeda04d

SHA1
e5f9ad986f6ecb03360652e6aca6f412e7c17cbf

SHA256
e384226604fdca17b3a4eedc77be3e54c31206eb7c659176538ffd925fec8530

SHA512
9faf4c9a0b4f449ee5dde829167388431c049b8ffa30392adcc1df8e1f48031cbb46cba000f15669872a5a5625b0bae20c09811985c31c90f0d6cff058ce5d14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab531.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar651.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit