69461718d8ceee4eef70ada87a7a988601944c4bc1a7f37dd8427c9829dfd235

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 10:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66ec1a035435e307bb0d05225024f3b6_JaffaCakes118.html
Size

18KB
MD5

66ec1a035435e307bb0d05225024f3b6
SHA1

e0e8fb021aa78149f1b9d39c3603e045a23ce5f9
SHA256

69461718d8ceee4eef70ada87a7a988601944c4bc1a7f37dd8427c9829dfd235
SHA512

b8dc8bffabe8a425cb9e9a8385e61afbc3e78802927aeb4da3ac14cc9b2f282bd70b5e6623cea6c26c9ba3dc179330766592b753162be98eb991bef0f6509c23
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI54zzUnjBhl/82qDB8:SIMd0I5nO9HdsvlExDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C4516A71-1824-11EF-A34E-5E73522EB9B5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422535034"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2744	2204	iexplore.exe	28
PID 2204 wrote to memory of 2744	2204	iexplore.exe	28
PID 2204 wrote to memory of 2744	2204	iexplore.exe	28
PID 2204 wrote to memory of 2744	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\66ec1a035435e307bb0d05225024f3b6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dfe839e9069c0347b77a8ace5dda96e

SHA1
230d1822ef3278f001df3a266a0ce8415a1dc788

SHA256
222151608452f1c1394a92d13975ea458458c436a41268d06801e176b53b8946

SHA512
a9a60595374590055fad4079110971dd36dfc46dabf04a15889bf69f20cf9e26d4e028337f5edbfa8ce18312813eabaab82e86de5adc73df77018926249cef48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
704cd2dab40174d7e049c2d8753db26d

SHA1
1ec237fd7842020ad2f0b4a84d4dd228069466ae

SHA256
5fd6c408db1b2e131e24796b208bb53c55256df25548493e8b180f7dbb0d5137

SHA512
02701f21ed248497bcfa5c3acbaaed1b83f6d9811177c2539e5be208dd2fbceb8cc2989649f1e5c1c8ca521aba69663704c5b1d7b2989ac8ae88c26c32f7b481

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6357c56b0857b0afacbc110011645aa

SHA1
093e38fe22f1bff9f721f9cee263f1d11fff222b

SHA256
5b444ba039a87ad22d39f78a1c2deef07dad8c6fe6c23c4637abcb4d399d9bca

SHA512
aeb00b9f029291cd84b93d06bcacf074baf0aa78247b72231761931f503f96d770c9d3bc2a6bd3368b87b5a2ee0912c4250c8f9accf08f37c0f5e908643b32a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44de8ec7e5ab7ce347295d1902610183

SHA1
3969f6954651ced1aac4b86c5aa08e86cafff8b6

SHA256
aa066200a714469e47137bfb204af3df1b583ec28ed2c449a8b17189043b8743

SHA512
bfa6d386ca0b65ad0adf7e0714166da30f9eb4c37fbff32e9eb68abc0f3f0e52da6bde6a08f81569db271821277394ef2da3da29524135f4712430e595b381f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24f40c690f52ff9cde6dafc3a7e486b1

SHA1
29a6b2129a428e1994399c0e7fe1fe4da6497702

SHA256
c1e089c3ebca61ed81c124e47ca7acee7984375b79ecabcebe85f152846f74a8

SHA512
25ebc1f35de80e80c305ac7561b37a437cb2009d7247870d2dbda2b83ad589d575f08ab782c372d4b78b661dea2da2b6fd64e56db89087e357ab1d91aa2b50ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b8870619d7502b7c2f2f51d639d79fb

SHA1
173960547210e2caefe8d7dc7d94a9d6e7ba8e1f

SHA256
8d9664c553c06166af4d57cbd753902b1b5acf90ea2d6ea8e4679b53e9eb177e

SHA512
4cd7b282d1cd69389e5724fe54732e6d18e94dc96c91f420a8283ff42961fbf66a55eda55670fefa92093e69388050331f22a942a0596fda534a1638278a0d17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82ab5c8195febf80a9731ceebf3f9455

SHA1
5fd21a01661b907b7ee873e5d071a65182b4bb68

SHA256
3217bbe94a09262e0f8f539dae0d48b8f5944cd5d645be73462b8c9bd32170ba

SHA512
82efd22fb8bd83b15eab6249b71cebf02e335fe0921a3c0928d2d27e9dfa13df06ac35e4fcbcd5ed57a3f5f6c375fd37899bc957b9264a35b995a117138b4cc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a72002d16ce9c28b81d34bc7f01eb05

SHA1
04b281d4d6d3ece4cd1d4d3499c8a0149dd67b8a

SHA256
62ad0531526e3b65a6b4b804a9afe233c85f77c196ff3119cefd8abc7309da92

SHA512
0f0e2fd10c02b1321fca9085d7c7098eb27a16541df9e2d94f42f65a506c57312719298744ac31d0ab5ae843154fe9046433e027e2c469d9323ba6c94b42a33d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44047003b5570b58a06afdd23eb4caa6

SHA1
5aa08a2f4d357d35ea9c6c4e31bbc150eba9e669

SHA256
580317ec1934c5b325298dd5b424ffef840ce94d6bba0fa354e88ad433d4216a

SHA512
1fbab0140a5ae1b1d522f0ad46f9d91bde6ad54c84a49954e7e6c7300b50ba185db6292cecd293d07e33b21defc6625439b03556005048ddd3d5253654c83b3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C9C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D8F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit