4d6239d84d99d984768b06819d3e39fe8088cc013d77f107d94f59509119be30

Analysis

max time kernel
148s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 07:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6275e8b0f1e73eddd47637269624b6d7_JaffaCakes118.html
Size

17KB
MD5

6275e8b0f1e73eddd47637269624b6d7
SHA1

b34482d89ba48611f5d3a9b9ff9452f0c02d4404
SHA256

4d6239d84d99d984768b06819d3e39fe8088cc013d77f107d94f59509119be30
SHA512

4fe5aaca0dc13240c3784130cddc288c3581d93061ef59ca889509509a8c4de0c08789fc33ed47348f68b13296a3a7dcb3a3f43dae9faf86acbb0b37f90dd7a0
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIa40zUnjBhwq82qDB8:SIMd0I5nvH3svwpxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B76420D1-174A-11EF-82E1-DE62917EBCA6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422441382"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
1612	IEXPLORE.EXE
1612	IEXPLORE.EXE
1612	IEXPLORE.EXE
1612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1612	2188	iexplore.exe	28
PID 2188 wrote to memory of 1612	2188	iexplore.exe	28
PID 2188 wrote to memory of 1612	2188	iexplore.exe	28
PID 2188 wrote to memory of 1612	2188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6275e8b0f1e73eddd47637269624b6d7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bba54d2d9238c2fa073e5bb525be01c9

SHA1
6350f62a2ef65421f4ece0d225835da9fd29b198

SHA256
029a360fb78f99ec32f7373b9b1010f1ab8c56341d4d77b403ad80b656a25978

SHA512
3a8437c995b9533a15903aa0f919f8cb673c9ab1112f051ffd69c21f66903417f2bef0ee951f603966b6b227a018a9e880f34090507d8b8254a92650a2bc1de3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e638b374a14f3b42f7ee7392438ab6e0

SHA1
bed8b6bb7aa3168550b0cc70c62ae0b48cfd877e

SHA256
0ec12cec738e7e7d11a580a66b57dd381d21e095892f3e3cfc4926f917a3c538

SHA512
b7109b7a7b5a87d77a9bd23ce1d1ac7d66f8e40e8525a99196290237c442580b094f8b6489b20fc1c1111196740d4119c27680ade8bd458338d27dc4e3c06985

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df26ac4fbcc38fda7c9d3db589a78774

SHA1
13c399eb148fdd31451dc69dcfd4106bf97726ad

SHA256
b2e606fcd03d7181949db4191d68c9af5c304359c48a67865176257b93d0d442

SHA512
14b4a57bb19afd02c2c485477096b88124e36ed3612d07caeab5cbf3e40cee31a090bb6e21e1799cb30fdd2cb23578759840e6ecb1cf418361b6a87c3dc02bc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e11d58fb40fd7eb8438c23590d351dc5

SHA1
d4a56ab4fc4f3d1d717e402b3356ed9419094d6e

SHA256
f3fd0aaef2228cbc17aa46222dc3d6dc5479006b40bde0d6e753756a7d46755a

SHA512
4a2da12887bd8b6104af24411d4b8b538c79d9d7bf494611a32f4cbef75e5eb4975bd58f190ffc96db586c3907709cedd7027de60cc41595807ce67f489a7b89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51795c6cfa0f72f121786323aabf5868

SHA1
d5c2d4a91e840af575a6fee296e8ddba0030f6db

SHA256
04c1fdaf81e182079aa71fba1f5ecab0429f588f149ea568bfa2c4b50ca5fdda

SHA512
bb305136d5978f1efe9e4c5b2d52c8b457032918281ba199f2738db5cf0204a8d358ed748f307a1b02b9e58091fa55d8688f794c661c1e89011907b9334d10fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c67b7cf03e9b8cecffeea70a4b21e739

SHA1
99ff5e67f15f47002748bbcbc73540f2e6693fe8

SHA256
d5dd8fb2861edf72a84d1b0f2c889d8a30fe04f894a7be926436ed575c73579a

SHA512
f5a44a7e90585365509f6ed9b6e51822f8ee6a33f51a412086d86633c4922b3d9438eda277090b45d7f2d9e93b7477fa21b436312ba83de935edbf32f6401f09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
833aeca1409fb66c19aba92818a00f63

SHA1
4821d16db7aad4ffaff0dcaa63d41742144522c1

SHA256
e2c8a249ca8f456460e122718d1953207d953ec70a0abaa3ee428f03570fca7c

SHA512
9719d55adbff317d2463d58b3fc3de238af2f4d45f61413f32db018cd8460710ab2cc63f0f47bb05d62093b1edcddaf58ab45fb72d2022ee8b0b32f0e1ec721a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc3a44e880dd9a69389acc1333180031

SHA1
7a69fe799d88b70aee5083e17d21ec3c2060c2f5

SHA256
fcaaec9cdd1e92a23acb16fb7149feb869b9b178026cdbfcaac2422615c67df2

SHA512
40e17b6d0df7a733b64ebed7a9591efe9ea2e5713d233e4765f131e6d597115265370b9d61166ad7e375b7c3b46bb64866172f3654235d0f477978e8b07806af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55c26ab858e42e9037ab5bc8729bcdf9

SHA1
564f3b2ddc046fef34362ad686c91fc8df1e03f7

SHA256
8bb864871b56e742258ddc0d4c91eba5c7978d74c5e76b8657a192de20639257

SHA512
809fbe302d4c2537bf7d52efdf04845df04b6b11e8848f366f571be5bc88951419e579bb9b573c9b6ecf778194f882de066a120658b89209b5844e904484d041

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab15B4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1696.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit