c67b67de182b0461c0d71460db5afa6575f8afcd6795c4662773ddc57f1b9e5f

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61983466f88b46180a25e720098ebbf8_JaffaCakes118.html
Size

19KB
MD5

61983466f88b46180a25e720098ebbf8
SHA1

54e227eabc221048cab71359c1bf20babdc4f9f9
SHA256

c67b67de182b0461c0d71460db5afa6575f8afcd6795c4662773ddc57f1b9e5f
SHA512

2757b7dedcef0ac19cd93e3eaa3c9bb87c3181ef5e887122c046767c7fe8b7ed30cb30bf060a32bb08b8db19466ec61cbd9a486d6a8a09b26fee01b26c2fa022
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIV43zUnjBhh782qDB8:SIMd0I5nO9HZsvhgxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B911F4A1-1710-11EF-8A46-EA263619F6CB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422416474"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2184	2336	iexplore.exe	28
PID 2336 wrote to memory of 2184	2336	iexplore.exe	28
PID 2336 wrote to memory of 2184	2336	iexplore.exe	28
PID 2336 wrote to memory of 2184	2336	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\61983466f88b46180a25e720098ebbf8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef722ba9dcc97354e3a608ed877e7925

SHA1
0c9bb97f4c74272d7c44a0b2df52c2626694f77c

SHA256
24d8f3062a359183523d62205c227820f46f9f388c8c30c760e0ab3019b575f3

SHA512
418331d3d6c05cc5f93db7620fb66658f903c177260b8105d0b6c119b8fd0430ccff22ad18a9bff0f624fcb6e757bff028cef034f921384ba3221e4ff5ca880b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a600c6a0d9321d16d14510c9f6627c1f

SHA1
1163b19dba188ea08fd5db8ced1c3708b994571d

SHA256
124c04d8e8312450392deb990e28c9ac657d8bf3972757fa056b4fa564744d6a

SHA512
0a8afab4d294f35913451380c97e5ba1f16613271499e571a88d1e96e74e6241f9d1e134586e3759c42d088b831b3d0dda3371c14cbffb3474108d9d66cde9d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48a9f319eeda2b7e7652deb0f4af3f54

SHA1
de9cd39238b187f09958428f870d8df4d92d1223

SHA256
5ec84b78ebd37ea271464429f9c5b9f7403102e87df6f08208a6c3605037fccc

SHA512
7edbe0aa7c505903460055defa25da1dfba3f2d5ca510ac859b03c7e29631e5c70fc2954ffafdd72239a25d2b7ba5352a768cc740a6c4828c513224ad9d40630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e134a9b3c034b4028211017314f059f

SHA1
915f709a8a4bcd103d626fb4c9169afb7025d421

SHA256
7b8c32c7e8a5c901f17ab98f22ed53d923e88bcb6d9e8068cae7250cf5c599ad

SHA512
0332a60fc71811908a7854a88c67009c2e124fd537124dd7a36de171674557c979c149e1491d49368612605387117c0b4fcdac3b7369a12f8d8f7bfe914b5cfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b690e0cec219619c0336efa4997f7788

SHA1
f67edcfda096439328630d095b656f3c513c9393

SHA256
ffbdb8b8cb10a908c788715b50e0f78680829aa4928ebf892fdb2d233da6df62

SHA512
fef45b9cbf71fdf9b72e62faf492751cf66d7cdd8d0f7985467008d4caaf9bc836055959a25e1a71d26532de1d7d87d451ae8e509ef0fbc99f27c6ed1c988a40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bda57a6e6fd04da8f0815fc5b9f972a

SHA1
7a54e59ccf92d1064a1435762a13883414b5cda5

SHA256
265fef003db9c52801c4687d3a4d0ae0bd3359ad650f2baab24dddf86eac00bc

SHA512
640db44ffed565f37f2b8f89876e8889144000488b4a659ee8da486cb64333a110ee1c029dc41fbb2572ef79ffe9ffdf812842ce61d2619623616b687d31dcfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
132865b3b0a39750b97f10a4e58ba3e7

SHA1
1ac9ffe9a6b717e16d3c0323d013bb03bcec8aa2

SHA256
175f95c9ab3d7303363039d1a41ea56dfb72c92dec311ec02fab891b61e54388

SHA512
69e77819584ff316cbfdb79e9299d7be88a15540ee5c10a8f2e64d42e12d05bff6d405ee11ff3b7ec24e223c56a9dd7655374e393f60cbaf1b11976f5a5a145d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee9c75547d8c033f52e0d208b061ff01

SHA1
4ad5956847285d16474ea08041fa89870d31ad72

SHA256
59ddb729237dbde5ec67066a63339b40a76c29cbc686205dba2b2ef554911d71

SHA512
858e6f14a69967bd215a3d6827ca9bfafab725b707fc8dfb477150aa00932aaaa9f17186ad700ce28d95d8a06f1756b4a4853d7a01e12604b080b126b32853d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18e8c3ad0cf77934edf4e7394faa5b1f

SHA1
cfc8cefdb70b9a232fa3cb8c7fe1cb3fa9889432

SHA256
0393321937b6b762d97de03571c7f01bccc34ddff1e5b68c1b62a6d43a2e5f14

SHA512
eb0a544ae41540f36116e20cc4833cf1f03146b846abf34a7f395410c398ff8e7eef6ec511f903fd104c4a3478d8c47d581220259391a008b3712aabd069a573

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E5C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F28.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F3D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit