66b3698f0927576d8447cac5adac31ecc163b7e777a3194cf01a96f04f593732

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6203fb1f219276b1dfe861dcb24a8119_JaffaCakes118.html
Size

19KB
MD5

6203fb1f219276b1dfe861dcb24a8119
SHA1

a60bfd8b733d5dfc08791eb4593c05f1ed030949
SHA256

66b3698f0927576d8447cac5adac31ecc163b7e777a3194cf01a96f04f593732
SHA512

b51c5cff958ed140797a17ceee92eddd1e439c55985412b181389bd4ae81726893ee569f3f801dff4acb29e79adc0894fa1dae4a308a511baab0be74d77cc096
SSDEEP

384:ABc6zf+8i8oXsuEuW0/ezdb+gfe7eEQeSV:bsf+XfXsuEV02p+gfe7aeSV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422427241"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB402F71-1729-11EF-AF55-CE46FB5C4681} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1772	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1772	iexplore.exe
1772	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2660	1772	iexplore.exe	28
PID 1772 wrote to memory of 2660	1772	iexplore.exe	28
PID 1772 wrote to memory of 2660	1772	iexplore.exe	28
PID 1772 wrote to memory of 2660	1772	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6203fb1f219276b1dfe861dcb24a8119_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1772 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34f662154b65ad4478952237a4f36298

SHA1
c3671b3657e2c8be9cc0c6ded11785045a33804c

SHA256
8a7377b03fbd3841fdc22dde3f13904f149ceaec98de87e091d70858eb1183d8

SHA512
eb5685f3a06de21c92ba2d7bfbad24f47659e386d725bb7e8a4ace786e4628204547cf7dd3a0cb3a161d24e6b8c528c6c5daf92393b7bb22a4bbd679663660b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f428e9e1423119a31e7d313bdb5e805

SHA1
811dd984b361dfc8514f8830dacedbc4eab421cb

SHA256
4fb2a55662def8ab5aeb5ee741a48c95803510100194dfaec9a1bebb81ac0ad6

SHA512
e29700a3ecfe45bb61f6156f3f370f55fb2323830082138a15aaf705dc1b133eb4d0da04bfceb1ed337937612998beb4d3c79aaedee4800fa00fc45fed1e6dba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f5c202aa44825a70d4695dedf8990d9

SHA1
17d282b0cec1a11135fe54937da2146c9cbece0f

SHA256
f729ecc35c3093f66e32c54b0fb998961c39784963ecc1e6c9f465f37798e7dc

SHA512
76c21f09ac7a5a6279942d9cf7993ed1bfa7b6ffd2a61cb18d4308bd0601a0e25fc229852584574f85576b49f9485bc7e60e9f2fa534005f5bc264c31220d48e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4b8d178440d39d6763a0fba5c9121a8

SHA1
253906204e43d5c607587d2c022b951e0e319faa

SHA256
1351e48db6efcddcb5887f66ccf46ae82568227aafceb3dc702cda7faf621f08

SHA512
cc73ce9ee048163c1b3c472064b71a8e720fd5f340f1a75623538ac5f52d9adacd8848a5d55d58413ec0dc5ca8fe4bf615fe2b5bf950b7d859be3ee39d801e1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9152dbc10e2f4b2d31dcaad56c3acf9e

SHA1
d21636897155c1eca00c20920eb4700d2b581d6d

SHA256
ad315278cb9f90f3bfb32f7d0fc450cd171b8db0f0838aca2456d201b0e65855

SHA512
d08fbb79d0e20d946c2f13b48f0feb3c62be1f596413835b892047206234f7eb8333eeff5a8c78d1ad4fb6b6c970ab899a367cd0ac27b52b10b401e7331de721

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
983fecc3244acf03f9f0b87931bf266f

SHA1
b8be3a691236a85e46f45b662c6789a703d97ab6

SHA256
ebd866fb762153e3dd86f7fd33ac310375eaad6d708f147fb7d9d15b91f785a2

SHA512
a5b4482099ce7f45700c34d72e62d5688b2a3425fcb4b526303069279898183bc8c6efcf1b4d71873c04a1fba78c4c5b6bb0cd66fddc8e663037a7756f26f8c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
787bd7d87a7371531c52143ab6e94e64

SHA1
c154f5a619e2af8b219281bfcfe650cdd1fafa22

SHA256
7cd8bbeda1751b2c3f35c56616a37c758d53e404e4e4bd82415fb6d90febcedb

SHA512
db4583c284fd5dec849d6061aef8c16ad4dd50a1f5214784c79b0a60ff4b23d6c7c6126284b372a30c25033699483ccf1c7c7f67972fb918cb872a46a669e139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c06e8a78c86f2ee900370b14bcdd1466

SHA1
2e1e036664f67d4a2120c2081a535a1598e36e22

SHA256
e6db01375c94a4d73573dbfa364089b10ab8d43d1aebab047b04d404e9f07f0b

SHA512
4c762bd481b94ed123aaba17855e1d1ec6ec99941c40002a3752f58ac2898595aed55250bf74d226495fb9b2623b61495b015955aa95aca888168fddae0c8ee4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81330b95ceff2c19d93d99cd07f4a63e

SHA1
e7225ce6a4fefe08617df6a7ffece8eec9921847

SHA256
c3ebfe56365b348a0ef84e73a7a0db0c3535f3097f2846b6f25b674ecc238e7b

SHA512
8dea90b4f1a9411fe27cec058bcf56c9dce377ed2e1abdff458199a50a88ef571a3ea9835c8527260225642fdff6c4b2ef14583137e22688550e9fbaf94e7d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA40.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB0C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB21.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit