dd1058699a6ce66329ce1c05e7032eeb299914535e672ad6fbe8ea16a5e4d008

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49369c439b603c87a552f1c40aa65a18_JaffaCakes118.html
Size

18KB
MD5

49369c439b603c87a552f1c40aa65a18
SHA1

10b2d2c623bc5cdf3e5f2f7004354d470bb5509a
SHA256

dd1058699a6ce66329ce1c05e7032eeb299914535e672ad6fbe8ea16a5e4d008
SHA512

74a43a9723317346b0f3138fd32a231a7f573f7f5acd9e62a831faa40700029bf18b1b9dfaf29e1512c5eb95cb3a3fc4ed0201d3e18f764770ac66e28b36704f
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIG4QzUnjBh0O82qDB8:SIMd0I5nvHLsv09xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95FF71F1-1331-11EF-B0F4-569FD5A164C1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421990785"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2144	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2144	iexplore.exe
2144	iexplore.exe
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 1672	2144	iexplore.exe	28
PID 2144 wrote to memory of 1672	2144	iexplore.exe	28
PID 2144 wrote to memory of 1672	2144	iexplore.exe	28
PID 2144 wrote to memory of 1672	2144	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\49369c439b603c87a552f1c40aa65a18_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb363d03c8c206f550ad5114f4387ba8

SHA1
a315d37e47ec8d0844471809b9b81640ed1a3981

SHA256
c4151815a3b6bb92564cd5574c8c9c5466cc0aec2e659b2fd3ced428324c4a33

SHA512
177c6ecb641389ac4265f6118b5b5af4c52750e0c837c577541424765c0b41e2c31a94d3ee439791246f024c65ca40d23acd622b8882fa6f5039a7261321169a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e631c2240e05d3418807e3baf5a899e5

SHA1
8b4faac69ad0cd2274c4f0a67537f15643ca2b6b

SHA256
fb000bf5578457c30e08c81b04e0309add220279de933f52a6545abf59842060

SHA512
ecea4823b8a9b178b596f69bfa88650c2922fad93773c3a385f59596e12356f8652d54c6f459ba74a672e32fe28f59e6b2f352953c336d2eacb9e20bccb5d227

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
767dc092a911468647741465dabc7f33

SHA1
94d15c11b78d9fb9b8840d2a402a5b71ccbc4670

SHA256
daea2f9cfb7c3d8d174adffc2a434feaaa08af4acd8193e92c5dda1974bcd35c

SHA512
fceb60b530c486b793819105f0250e83f3b79cf17503c41913080140ed6557149bc8eb84d63b3530394636d3fc43b6c7b9293e7be5e86651a26d13fd6d5eb623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66bec23dedacbe3d094effdc1bd4661b

SHA1
80aa3c7bb5f3d796aba86fbb5bf750f686eaa536

SHA256
f2e54b1ca79d92220fb614e66171367f00664ea4250de4fb076859284421fe23

SHA512
f4c4fb450cfc9d0e8017d54ee939b4562bf59f70123eaddbbc93ec9bcbb1a493648fdcb10811ba5bdf4dad008812298497fd2c7db5d16697e00a9643c72912c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
180710064fac251bab6a995cac6e0335

SHA1
46655bde561f21aadab762989abe8161c6eb0bf0

SHA256
f51f6e946dc9f4594c048ea0de381fe086baf510ddaae0b40d25cf9032b7f449

SHA512
9e012d72d8f6d8fd8c0fb80f0c1df2a879bcd7091ef61ce0b79022696726d4b747de35a18bdbc12748f60b199bd468fbc42367862ad148f25dcc9d1683bb33e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1219ac16d8a41ec06a7feff601356a8

SHA1
761f46cbe37f6e8a43109ac295dc9e2d0cd7c4df

SHA256
edb869564ac4ad45b2413a2d24ec2f1c36fa7f7418ae6ac824f55a68ce7c814c

SHA512
ab0f1986d12e45ce19566fe35f143d5330428bc8bd99fcb9529398ebc5e4bf49d43ba707fe551defdcfb1375883ce2edc15f6bc6ecfea060e52e337ca47fcd7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
802e38abf4c307cfbbe191447b802a45

SHA1
2da17d8223474bd7a87759a967c72f202027d31f

SHA256
25f8e77cd3f3349ff3c047fa77c95b79ef9150f361eacbdf06b1067a64349f02

SHA512
1c8c216e190d036ca1de10921370b52432bfdc957394d80698de4cc0ea94fb80b749dee4e1762fd2f44b9516fafdd36f1d5fa449a4437b35b4013b2cf5c70565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af192e207c342d3f34b040baa9baeefa

SHA1
48acba556f85e127ea584df20e482efa85cd1f7e

SHA256
50f2afa8fc01b491afd39b1905dbe3289ab2672f335fbe46002b62054dec6fc0

SHA512
34a40d7828def6e5856d984fd13f1956167524766b5997bfa4f6707228b123a2d9b91d736fa735c63ed338a186d077de7bd54d56358e91e9c3a80ee9e4efaec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab16CD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab17B9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar17CE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit