19dbe33a9b4ba807a6824788bed8b5e2d3c22ee9ad93abdb07d6738b6bad7457

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 18:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c8f7c19350e6c52de90e524dd027aeb_JaffaCakes118.html
Size

55KB
MD5

4c8f7c19350e6c52de90e524dd027aeb
SHA1

fe0e93be2feb9197d024ed4c3e241ed9f60fa8c0
SHA256

19dbe33a9b4ba807a6824788bed8b5e2d3c22ee9ad93abdb07d6738b6bad7457
SHA512

d95091cf0087de673ec4475189d44cf04cfc5bb4bf38482b47d77f626d4c8e231cd9f1e1347c6caa701242505886f40ed3163c561a3ebeaa5c51f6803d2d1bd9
SSDEEP

1536:Cpp62MSmzA4B2glKnPhLqfoVkBOlM42Z/ooKs:ZSmzA4B2glKnP0foSBOlM42RooKs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7A8D471-13B5-11EF-A3F8-62949D229D16} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422047534"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1976	iexplore.exe
1976	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2888	1976	iexplore.exe	28
PID 1976 wrote to memory of 2888	1976	iexplore.exe	28
PID 1976 wrote to memory of 2888	1976	iexplore.exe	28
PID 1976 wrote to memory of 2888	1976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c8f7c19350e6c52de90e524dd027aeb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3af497cfe6c27284e4249bcadfa058b2

SHA1
eff89d3ef136a314678421a5d012ff35ae26ddbc

SHA256
845b049f56e184d5ca7f25b9ce40ddf6af2a00566cea13ce221be83ebcce8153

SHA512
8e73580193cbada5836c85ab403cd09ac9f35096868f8eab6f216e0e03e222b6ec7a6166627b159126877f7d60e2ae9b5dc5cc64a1ddab04e8f0cdfcbd32d6b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7e5793a8f04bb0588404423d7425903

SHA1
6612ab0742901e7ef7441b413ece76a5858dcc9f

SHA256
45ffdfdd705f2ec6aafa22aab7b65fee438f772fad3ca5b7e28aac4c8220c967

SHA512
96382ad2ba548b672dc70148ed0504d368c708d165fb85df4372aad99353209c105a19d221d71f608eb487adc311d74455ec19970c99b3e5ceb15bd1376da69b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c2a2ec99ca60d9bc514febc79185fd4

SHA1
61567237df2bc85d6d33ecca5801ad266f41d821

SHA256
ec84249b10fbe1cca18bec0bafcd434e9e7ea510405abce58d2f10b6772b4a17

SHA512
af187425c1f0427c560f43f3150e38623521b283193894a3060f0bf843a95aab262c4bbacc6c8a5a9dc882a6effc7d33b75f41b0f648b805d397936fd6d4d2e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46bf96b9ed4138267fa5f08f93841d97

SHA1
2a36454911183ce2302e075850c07e985e2564e3

SHA256
5c9a803b6246f3412f1d12a5334741cd620ab14e2262cee238986078712e5044

SHA512
6ecf1b190610bf8794ac61071309641857983af3af9b24a7292c2a1da0a125d5316f6b009a28e9a456976deb9cd4aeab7c47ccc26536c83209aedfc14955143d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8ac10f3a910408031a1cc173f86ea71

SHA1
212ccf8e4c5265ad5d781f5fdac12d19cf5c0ea4

SHA256
2854e3d2213bd0ee9d8a4b96d8647fce5d7d403df4f961a72898add9b90c9e09

SHA512
69566891b03372cda35138fb76886aa19fa22c1edbf1486e82a21f500438a7bd4c5009fcc0e680ea3e58a9ac37ab7e04e45ae8518181ee498a461b41c95085e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e05e4c2779216d737f9710b121efbfc6

SHA1
0c99567e97a423b81f4510308b0d8c1e7807c8d4

SHA256
8a90d222c79a2ed4158a813c4047ead6675115fdfa286ac25b6204b69ad3254e

SHA512
99c9e3ef9d8dcd5845a4acf2ea9a72d259fd9a59bcbabd72b553a1c1afa74e254c8cada7a3bc4ef95af1ce5f6b00f4b14b8b049e8addbb3bb709901d9c0151d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7baaba1e48e0de8746c6831346324a1

SHA1
6e3c49bfbbc4f31da05e6273d0429070be116856

SHA256
546fa8f1b9bf3bbb39844a4a75c30ae39b93676d3dcca1060d542bdd9e1312b3

SHA512
0acee25e45f0e6b05d2e66815ba8bb9800c9263d21d62f66c4f9e641c2c5cc933e2b15439fa363398595dd25c521d4be8d0228a55f96b174cda12ea6d8dc4d2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da73157b872eb36a4a158b9ea36ce029

SHA1
10b6dee6d0c5b49c90a1f9c6805660b723e568bc

SHA256
f52a7eb3f35e333f79c8f2ab05fa17c00bb6ea2c72788c8e8545df46e00e1828

SHA512
6cf2707d5d46b278745f69a0d8c91818a2e78566fcbc05fcb207ace7a193b9c07ddda21ec1903fa2c2a91859aec4e21bbd52ef0fa1594133954ad20dc677050d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ea59364fa7951a59282df0a245787ca

SHA1
198bf24710b257ac1a369cef0617b3946cafbd76

SHA256
1df6be6a67c2052faa89f7ff4aa97d38e39c91fe031c0acf09a6b3f62f3373b6

SHA512
db38a347932f3f3584aa72d7abbaefd7aea536bb426c45f72d8f7ba1550a30b0f7592fb92d48ab37a0e79128002d52f32588e77d0fb91ee01f0fd43d7f4c3d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFFF3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit