324d6f1cdafcd21e21868fb47818b3a6eb968348af84d69a7916b1c61afd423f

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

66ebaa3d48640b51aef831deef9cfd22_JaffaCakes118.html
Size

19KB
MD5

66ebaa3d48640b51aef831deef9cfd22
SHA1

857e64162a7b4e890f4d9476f831ee86765b7e4f
SHA256

324d6f1cdafcd21e21868fb47818b3a6eb968348af84d69a7916b1c61afd423f
SHA512

f2e9660fb9121a049326197b7996f32608b8788a980b655760cc73a44fcd7fa4e698c0cbd38f4c7961d233171d57013c8918708631e29b05c93c3f44c0c00367
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI2AEAsB45qaCKUFUf6zUnjBhhuJY82qDB8:SIMd0I5nO9Htsv4BxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422534958"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96FC86E1-1824-11EF-92B8-52226696DE45} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2768	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2768	iexplore.exe
2768	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2124	2768	iexplore.exe	28
PID 2768 wrote to memory of 2124	2768	iexplore.exe	28
PID 2768 wrote to memory of 2124	2768	iexplore.exe	28
PID 2768 wrote to memory of 2124	2768	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\66ebaa3d48640b51aef831deef9cfd22_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2768 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c6ca63c3e01ea05dab1492ee8d3586f

SHA1
8041a9d61cd54575ce62734ebda7b8447cf908f8

SHA256
25a5a5124cd785f0b4bd607ae5ac079790cf05f6e682dc540828ff296cde1267

SHA512
7bdb2e5a309325b506f2cd0eaa8bb3aff5c201e38b61feb8a1924dbe96f739a8a33d8715507102dc265c57912dd6d47b7b11103d52551d4736872adb7232e9b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa9d88041306dfae71b217999e311e85

SHA1
18a4a7b733ad2441d24dc7954b02d87b14ca3c50

SHA256
ffe4c311b1a5544bf8cd9de713bf305c4f296bb27168892afdd6269e5ef649c9

SHA512
6b1840522b93719e00cb49293e2843a8cca5b4735fcfab533e6ee11d3a2012fa81fe3702024c9855a52b85b977f3d0f76f38dd0c21d4751306218675135e0014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e1bb01951f1ab94ae9f6685d9d2e76c

SHA1
7007672619b459c19eb069dec44a74be1c1cd5ae

SHA256
89890bd2afd32781dbd4ceac3a5aeeb4d7bbf250424ebed275664e46921b32c0

SHA512
671ee24516d101a4196970688c0817e32f2a7e95a3f9d6bdbbd07dd7ef7e0f9996a82757f5ac85f4bef9523906c03d70a1b34c428828ead7fb21fd951bc1d037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa53d00901a99a5aecda4e8375340751

SHA1
77b009d4d1dc1083c556a8afc45beb7b55fa4993

SHA256
9b84b8ad63c37394605e7b1be44d80bcc796a4aa4a00dffe37e2eaf604693316

SHA512
e97ef042480541c1461b2d6ccb5e2f58ff7bf8f1c162c5eb8d0603533631f895eb0fb904b3e9e8a348d88a7a73db9fe0e54914743b1a0e5ac5752974ab72c6d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
708e7885669d3d3884fe7fab93126ac1

SHA1
3687ecca80e0753e9d5f270d7817fbfb58863f9a

SHA256
82de5bacf5255a1105fd76aa0512b0d027a0f7268498a024cda93aad210babc1

SHA512
8bd822aff81813e4817a8f56b5c137d94d6f52d32198edaae89b42b889019fbd1b3e937edc6f98d96fdcece7d2a285253933048a40d111a5d661c75208ea4c70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f33bbeebea640d41f9eae5faf188c773

SHA1
5433a681ba64332ad4f0623b07ca69b21b2b1df8

SHA256
4c4fd10e7b0407539c12478ea500c9dab991947c32311ca4e7f9d055b42f6f90

SHA512
04c67e44a9c67dfa431f5cb924127a3194d5ce64bfaf2fadb1dde40e43aeee1c56b6d45a160bb0dd475c19d5f2cabc4a29efd250f30a92a6cc8c46a33c0e7fb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5ced86863baa820d3c49ef1bb24af72

SHA1
2e9258190fb6f810aa49823fdbad2757ed015ab7

SHA256
b9e1341ceef67dfaa9e9ec5db8ab71047d7b144fed02482f467faf1a246a5398

SHA512
b65944b17427d05409a4803d879274494b9f189bbd1876b91505b3c958a85f02777ea57c984560af7fb4ebf75da1d3ef8b28051776c88ddd2edc1ffa33988109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9475b836170093c781439b778314841f

SHA1
cda93448dc100b78ab7b3a559b13c52b838bc136

SHA256
9ef510d530f473c55f8ca871d50cfda16463accab74206ac1e0821b767bc33df

SHA512
1868dcfb017f61469f496d508a1e47506fe1bcab11a54226f8ecee534bdf81cc87eecd00a57dab89edcfbaee530ca13adc5d08b016d08ed0a5e7aceaa9127727

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dc1649a39acfa8b785bb9eb211cdf70

SHA1
6bf2e091c77885c54df71082865e5e295104d261

SHA256
086951b897e70a1c06848f64f4e9de354c9474d866e34f5300a438c2e5618c97

SHA512
ffdbe7eaa1c4dd81ee56418dabc206c1fcbca21071280504d00c4bcef124ec396b1bb34def362cc2d8d0af6ec920e6917a7788b74837659538bbe3b9ebcbc62d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B11.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1BBF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BE5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit