41ec2c2420028b696bce841f8279805b5dca529e6e69083f83f3189c7d60168d

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

641fb046938d156be1055a02ee5f519b_JaffaCakes118.html
Size

19KB
MD5

641fb046938d156be1055a02ee5f519b
SHA1

6b55210928d239cd0ac6c61b5bab3f3bc205066b
SHA256

41ec2c2420028b696bce841f8279805b5dca529e6e69083f83f3189c7d60168d
SHA512

74538920102a4521668c76935dcb61c21514f34c422133690cf3909c85535779252ec7bee8665b5d98a289a4456e5e81b1bc48aa83bde40b3891b44778a701c5
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAICQTTTnTuQTTTnTKQTTTnT+QTTTnT+QTTTnV:SIMd0I5nO9H1svnixDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80AD0A61-1796-11EF-99B2-4A4123AE786E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422473931"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2448	1992	iexplore.exe	28
PID 1992 wrote to memory of 2448	1992	iexplore.exe	28
PID 1992 wrote to memory of 2448	1992	iexplore.exe	28
PID 1992 wrote to memory of 2448	1992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\641fb046938d156be1055a02ee5f519b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f89acaeca94ae9bbb692dcc31d8c945

SHA1
0c8f0066db69a9c8a4825247fb5102b2a1a55693

SHA256
50215e853142d50858439bb5fc22fc5b0ea13aead6f1a149ec471c83e56ec35b

SHA512
74943bf19dad13ad314c74c63285cf19a2d47a18fb06d74eb358b647b25c3d77efb0abeb90c17c01d6a00eac0f0d9ee3bc12954c9f8a5d2b7273681784e811fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72166c180bf3121b3b9a0d5a7f5e2ee9

SHA1
afcd437769d595ee504a7682aa07e6ecc7ba4591

SHA256
4ac891a1790be94dae8d556ee1f55dc6ae948f8e49ca85705279e0681d0f33c5

SHA512
da510f5d16645473aeaaba62f72d65567c233f0998f79c95c820e3f86101ba6a86cc62149b4b7079a73cf7c600948894742acfb0422dd98313b9968b0bf34104

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b90ce77cb4e2235a982d72d066d7dbb

SHA1
e49423419c8ceb0ad3897a887c8200db8f4e5e95

SHA256
daa3dbfc3e155ed67ecee0d9758f0db59d033a750832f13582e46a687c49a5cd

SHA512
dc1671274434d99f59d2a6c32fabdb81f2536494ceb7f159c83676a6f88f7eed3b72bfca859dc352452e878a334029b607a6de0ed10524843126d00d49ff8549

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01d03bef3e8f553e17efe3665b5a1dc3

SHA1
52a615cbd3b4fdd6940ccf08081ea6ad3d42a165

SHA256
da9a0fa7f9ea2ff4babcf7b22f4752ff136da56abd57a2819f54b130025b9487

SHA512
56942ba713dea3203ea2529e4074d7039de867756e95ac91f402736b94431a7b5b11f8534e29d5c40352f829a9d5e7b72113210ec38cea4f6617b5db1da03c30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c389cef5a8be156b210c44b1729fb47

SHA1
f0b037961823c446fde935840f7d502cfa3c7239

SHA256
b23f0bce071bc4cea4d67494aa7a9a9abed8cb82336f379c4b0eb599adb88e07

SHA512
40be7797a672a87b7f367d7ebf5a3d08b60b6b21112afbb29fe74ecfe639e1a2ef90f9f7509025aa844d34ca24c8e9bb078c7afe64a170ea1bf1f676e642bd93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23d13be3af441ac21085b4e44a9098c4

SHA1
f3674922a15713b9684ae07a86ea5fcb19920c85

SHA256
30622835d287d5a7bc4ed4df67950325995484ecd71664d82c8067168bde71a7

SHA512
c261686b0c1d502f19b197f08f0c13c743627f22e64548c6a0056df7076b63ba3e65f11e7f4de96494c8e9b8c82cf2756f2953eb076fcc67f2b66c2780416052

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d107e9aa726c2c81efb7197547e2836

SHA1
a3c66ad38edc35e3edba04551e87e103002472fe

SHA256
89ad26c1ed5af49ebbcd644bd560dfe71210aaa4ec3bfb1ea8f7f36a8b281c1d

SHA512
a23764edaa7e75e7809822f9826de2723ac969f101679b8f0ddd44522cdd435e94be721d3b4a53393e2f8b0b78d94fdceed575c3da0aa06d2b46c833d7a9b492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0adeebf94715e7e8809e05014e7f8897

SHA1
4b381b5dc9655ab2f44c047afe63df8e6b7f6727

SHA256
90a4c2130170c8fac69ff0c6b479cdca0ebcbd7aaff11866e5297e6764264180

SHA512
38f725cde2268526fcd83b4458d1339facc8b149b4356a9cbc61821e7b9c3e4cebc0ac8b9d47e4bf7efd23feffcbe3c5eeddebc164b8d908158fb54fe8bcc57f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c11ae71dd4421945754a4c4f197a6fc

SHA1
d7c4d2159f601aade2b56ffb2143b23ba2e9b70c

SHA256
79e2836c5e5fead4e9aa36bb03728ee333b28d1ad00169f7c978824ac8068754

SHA512
b11cae7f19a18933ebd3760ea1b46e2f269361704b65a9a1ae86d95533713aa90142d9bfac5c04403dcbcc77721b14991a864113cdcb60a471dc43e7336a0e6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f654a272586f5041a36a44e6b3d2fd8

SHA1
717c0fdffaf486acca19e252fb849f66129d73a9

SHA256
32eb2ba88e8830dbefde89b0a4d500d7af72c6992e507985bf8e37f88ef5d825

SHA512
07fecb20e6ea0a9b4d6124e3b05a3572a002b8433d4b0dea55b41840d6f442d841ce93bdf23fe410b9bb66c2e38a8fa73145040f63847b0c97da134a747a8ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab191C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar196F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit