4555c8cd8a99b675eaff5ddc13d8373b3dd4a1b770c4fef45a309f6782582257

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6543008e6006bcd218cad6ec1c5387d8_JaffaCakes118.html
Size

105KB
MD5

6543008e6006bcd218cad6ec1c5387d8
SHA1

d0558d6a5629f838766f58bc85372e702a0d1860
SHA256

4555c8cd8a99b675eaff5ddc13d8373b3dd4a1b770c4fef45a309f6782582257
SHA512

127926e32890280410c3618fd0c23efddbe7f5f66e7f8ed8f91fb56305cb9ee8bf190c32f17e06dead2b524799ea903272715080f6a5054b4f3351044a02a69a
SSDEEP

1536:0li0gTbwq5nrhhTTIsONeVUYRExpu/Xyo2KGCSSbogsxn/2UJ9ERz:TTbzdaMHGjJ2z

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422497583"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91CB5091-17CD-11EF-B393-E64BF8A7A69F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2936	iexplore.exe
2936	iexplore.exe
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2028	2936	iexplore.exe	28
PID 2936 wrote to memory of 2028	2936	iexplore.exe	28
PID 2936 wrote to memory of 2028	2936	iexplore.exe	28
PID 2936 wrote to memory of 2028	2936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6543008e6006bcd218cad6ec1c5387d8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8334c5d933d1aafc1073826c151cdba4

SHA1
b595675ef9367621fe5be5fd360834b80f1fbd03

SHA256
e5d1a5b41b2c0850edc9d4dabf8c6785c136616d3f620ddd06ffee0ec9b85871

SHA512
19f2e4ea71a008a7c387a8af109eea14973d76a1f28cd1f3c2a522f02bb6fb7749954e561f396e5124df4838cb7e6e153f69a287d4db038dac255a69f99772ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2051e32b7996796715060a2968856dc7

SHA1
841067b7a36a37cff7766c7ca4b45548c8afcd48

SHA256
f38dd116b92e746eabb4972dab9895a0fe08c830793ac297c8e64e7575621a4f

SHA512
d302639235e9761c4df496818e2c388be44fdceeb31df4c0f4580677429424f7435f81eaa7872470b7965983d01300e65b2f7cbc4dfb5a2723bcb8a52acecc25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56e45dbed50fcfd5fdac9cb87e890853

SHA1
ce5054d6dfac36dc44559ee5d33e27cdfe315ac0

SHA256
8df21e71df5c68758a6924239c393e90ceb71585b45a68145feddbc3a6dd9d10

SHA512
1cda6c1e8b7cbc52a11ca3f4af75c079ac6fef5294ecc8caa29929108cfb167f2b0446c8e4d6c3af8cadb04b29ebc39e693ec31a8fd0389e2ece4b81c8d84a0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
053303a11931778d976534dffe534eec

SHA1
2406662c88a282cccfb047588814ef5368933f27

SHA256
955dcc7aae27b6a268b723fa68be12beed7d0345e5b08b79736986a4001c1de8

SHA512
7f88114d2c0686590a707a5be124e5299c0cdf2ce4b3a465410e7c76269fdb84d6eba962656d989b44e519e9956f6b10268192d2028f00d887678cec3d37d707

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0fbea0aa4a33893ce1277271b3189f1

SHA1
29a005c751dc973770b132352eb31c8fed1e7ff6

SHA256
671f1689b0b978bef514b7ee46b362390449e0a01c19d25393841289ea8b97e8

SHA512
12d5b27ea389d652ef64abc3311205ab09276c43bf9aa9436b6b48a3065f74f71f0e8b8af1ac66b137a631d2b24816685b2a4973d7e8e4e4b6ad4e1ade510739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8516ce9d14e6a39d17ed7b20b94c6eaf

SHA1
5cabe8d8cb53d37ba620b3ade2cb8f0296bacdbf

SHA256
d705f36b0d8f9daa838e1c99065bfc27287244cc8b1f0d620bcd0cc6cc4cab27

SHA512
44ad4214eec26659b5c7df06a1a2ed4d55f51c5ad748867bfe92a044984f7a56b2779956e5a84d3f39d1284980cce27193a6d72361e9108d5dfbe6aeb4f82484

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b2d83ca92871a36ff0e2908b5410d29

SHA1
79a4ccbf9870eacca562fc64c5fa0f1f4ccc335d

SHA256
a29d5dc23dbe0853ee18d23930a62a9f1efa82ef3a2165d78caf7e2fce76f1d8

SHA512
ffaf425d94893f6900568680e5dd68aaf3f546c7c117a38b1d491871de97bee8f5d42a2ff81bc49a6e5c9729662c150fa40d411ee21284103dead6c2c04ddd5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed8b99e4f46d461a39b329913796b2c3

SHA1
90dbbaeaa0ce6afecdfb33b4f5ad0247e6fefad0

SHA256
e3b2e486b961339495ade603b9f9c6b24f408ab51e68f77eee9c25656ed64c2e

SHA512
7acf1f135246af0a7826bbdc9f6a36d8c6c36f6f1eccfe776be48372659cec83a0a4303f51191382a1bbf934c6e3eff6ef8d2c567a111cdd6c9a54cf4230c6d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2148.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2199.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit