29ad014f0729695ece9cd076317b6bb778691fc3a644743198ef4af019b772f3

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61996a655bd52d35e26c4784f550fb43_JaffaCakes118.html
Size

19KB
MD5

61996a655bd52d35e26c4784f550fb43
SHA1

6c2ac1b69146455dc66de29aa570aa0187db42e3
SHA256

29ad014f0729695ece9cd076317b6bb778691fc3a644743198ef4af019b772f3
SHA512

c06fac4fbddd3fa60a1a088b6822075ac33ddeaf97192e905a9eff89b531d9de385667ac0f0d8d690d9817b7e7ccb839f978217fdf3df4632fa4bb94d4bdd087
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI64QzUnjBh8W82qDB8:SIMd0I5nvHbsv8VxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422416577"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F70719C1-1710-11EF-91AC-F2A35BA0AE8D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2600	2844	iexplore.exe	28
PID 2844 wrote to memory of 2600	2844	iexplore.exe	28
PID 2844 wrote to memory of 2600	2844	iexplore.exe	28
PID 2844 wrote to memory of 2600	2844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\61996a655bd52d35e26c4784f550fb43_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cae6bbfa0f3412fecfc0c80eed7b718

SHA1
03211bf0edb12d06c579af65eced761870e1ac80

SHA256
0bfd7a70c457a0bfdf4b94a7caa3544967770cc78274db4c19c4588218899c00

SHA512
09735a6a5fb5143223abba5bcb5b8cc74866dee26d3cd5170aa447902b13fa53777f0f870d86352623079e6af6c945d3e8fa0f2411fd31067f080af8ae625d9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06ec1929440ebf2eeb7dbf9d8cdf661b

SHA1
0a190d32a001f10494cbcb06462e00675f384796

SHA256
08382bd282d78b0d7430659da8207a95e141be17c2cb2cbd43eb93af2f8b9a8c

SHA512
8f12b258afce286f086a9fbfa397572ad7a002cf0a1b047819b7a1589af5dbea170a80d2d83abd665b6ea3844e4f5f0183743b65e7e3cf6ac9deab10139db2f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f117d1c3b5b8cb70ce2a4f672465681

SHA1
c55fb076ccfe6869eefcb4f6ac021ff5d6c0cde0

SHA256
e89e945780f2fee221147096ba63a9a5c2ce534a24a7ee259883027621d092e3

SHA512
b1b47c1c573b6505fa44733b65b8c3fa43bdeadbcfe1e8a8509ec39eba6653988121c80f4ceeca60df1440fd680e99141125abd6f5d778922fe4a8ff8a07d885

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97e186c65e28977a06f5152b4ce56bfc

SHA1
6dfeafa0d8c7b9ebe0f5a5ad6b658eed41d77c2a

SHA256
a6a7cf35221cfaf98d13dc231046f0066eb54ea33f00d37c2ea6749385ce3607

SHA512
3dff6c6e79cf87527443cf55377da09ca41f29d04300177f73440a4edac051ecd317ef7f116f04d0c6af92921e76cacc9c335758d3c5b4b552900c7b50b3512e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b80af997d156bf00c617a624a4fdf37e

SHA1
abd924a8de5f795e9b1e94dd84d7782b321483bc

SHA256
d56e4f65facf15aeb7303524021de5406087d3833f3b718b36a05740a20db063

SHA512
694e86f41d117667e9167d9ae329b04fab99a7e1eb8c441653f3b91854625d2b09fb10883df367c6a7deb040e2f02e95b98de8556623a64ec77ef996305a10c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6963d1f51c78d2d04ef316c71eb5a9b4

SHA1
3b50983a339a486892068718067c743d834c7827

SHA256
498b30acffc543082cea843be8db9f30ecc7b40fe5962c5d25968123dda4becd

SHA512
3313719bc4662438a301604d8caa0b72a3673d4cbd43de2c6ad89e9cac4f0ea511b5bff4c14a992e0eab7c921c25a114ed6ff7b5d53ed5496b9ccc98c433f7cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34dea0643464ee52f9a65a70d6cc39fd

SHA1
c0730b9696c7a0be283215f80e50bb2522698b33

SHA256
1f21cac627dd9fa56f6d219f55a5ebfcf2c15df05d711d22d09beb48938a6d7f

SHA512
c38c6af19183750b127c41251e482fd9fa4ea73dd315dd35c1757217744de425a6d46292c1689e511ddfdae037baa6b39b2604dd78d510e4ece9d4da0061e75f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
319617e97548b621121bc53f72ea77dd

SHA1
e4d58683980d0467d9847fdb1b056f66906e1a26

SHA256
314e631520f356ce58c3d3940b53b61f09c9079ae0720ac7a261183ce6dc967a

SHA512
652b6a870d150b9130e90e4f0da9b1e3e3a5942af2d53075b9c6b082aaf1a810fcbdad527ce108d0f4b61e2347c8bbd1cf04bbcddf75debfc91419da9b5f0807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74deae2cdb6b47565e5b1f5df195da70

SHA1
265a0ee98f712617b88e77a49b9f3c4507f22da1

SHA256
65a9125095632fba9ce59cce9cf0714b26e7427385fb9de0635493e88f7c6d02

SHA512
f5bea2ea4cba27f38f0d24a6775201ae5b10f9ea0213060f98b7e6f46b38016c4f4b036a48bbcf1214205d102adf5efe2d91e6b725fa8de6702da8604970f708

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1AD3.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B24.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit