8822c46c506668321c68e65503465694efc7b4e40dd337a0acc601566e42b7fb

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68182bda399b74b52ecf8114c0990d23_JaffaCakes118.html
Size

67KB
MD5

68182bda399b74b52ecf8114c0990d23
SHA1

9c92f5e16fffbc8e74f315546b54cce1126f9198
SHA256

8822c46c506668321c68e65503465694efc7b4e40dd337a0acc601566e42b7fb
SHA512

c8ef18fec2bad7d46273f8eba8516fb3f69d3efb7e249e1fb25551ab98dbc1be85b68f6701b539daaf62dd3de166015b8ff8bc5e5844a0a81a0433579aecd932
SSDEEP

1536:Sf/5kpEb29JQdfOs4fHX8F/IcsmDb25BLA:Sf/5kpEb29JQdfOs4fHX8F/I4aY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C5FA5911-1863-11EF-8C27-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422562096"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1548	iexplore.exe
1548	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2528	1548	iexplore.exe	28
PID 1548 wrote to memory of 2528	1548	iexplore.exe	28
PID 1548 wrote to memory of 2528	1548	iexplore.exe	28
PID 1548 wrote to memory of 2528	1548	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68182bda399b74b52ecf8114c0990d23_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2ed1a4a6d2c4215ab66b3f125d7d442

SHA1
4ee0d2d11eb9a1512f685c75e5152bf2454bc57c

SHA256
8afc7c9a69bdd6b882de88ba80430cf0458531ee8cbcca43fcf87cddfc7f22ef

SHA512
9321b006f4b81c14d1d29c4f5aca95eb06d1bb525eaa81c48ad1e79e6bedf710393c041a712829018d603c1ab665439561b46688ba62d22234ff5439454c794c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e33b07897d543f517d1b5dee3ac1ff0

SHA1
cc59adb35b397c57ef4e4a84970e9ac4e7a3ca29

SHA256
fe5890c578c2d973a81eac5c396daeca576c699f4da83057aaab13161f819b06

SHA512
a2a3cbe0939f28dbb1e2c7d3c44a1ee5cb8966d4d23115409ba5dec6f5ceadf41d2f6041709da5eda2e2a10a97cd07522f109a26bd8ccc74df50cf7df63cec79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf4042633e63fd240fe6a7e37bc7d073

SHA1
aba847358deaedf2610ac2bc2293acea92bd20fa

SHA256
8ceba3e1d076ad63d06bca983f3821f02374acf339042b58e0ba72fe3757cdfc

SHA512
7671da0881aee435a7e3fc8a5baac617d50aebfaa9ed01293337c1e03a3662f8b1b42bd3920c6884aef6316da6f1fdf29a6ac83d2fd3fea12af33fc942e5d037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c553207acda374e576d5457fb20c032b

SHA1
307233116d81e81f37d6bb39720bf83ed0d44a3b

SHA256
00efa55f9e9624cf5ccc6f00bd9b6c311f27f82421c3f037b53fe2fc7db0468f

SHA512
9984785d427b3f591645dacacd0a50907966e28e87733b29798fcfd519d732781a21919d582bb082df327554d79852273dddb698bf44006c8213c577d0330bc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b8e359616d31fd3ef88d724b1a252e6

SHA1
e1e1fffd78150a593472cc86be1a7ac2b6539eea

SHA256
1ead0cc377bb4efd478e2a6acc77d74953cec8695ad5962ffc2e22821f34caec

SHA512
d028453a18df64d7e44946e19598aecf5e76cc6cded14fd4602711085ab5f01b106e059928fa35b230765ac92a7fbd00a10134faf88ef574938f2e42deca281b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79823272f6aa4ded35156a6bcc093fb2

SHA1
a2b4d9cd9cf3e0b0d77ca00c9e1e17493c23c43e

SHA256
f31ed13729b7b2e6cc57192cd75c75019a3e48d9265d71fe79c58747266ca01b

SHA512
207353f9ec77e3db3b289a670fdd954a91a9910f6d73be8f7d912499e095db67f707100cf8d5ed152e95288e65dc7ea985c964b45e1f875fc379fb08b0cafb05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0a30e1a951e83d3cbf5bbbf0063eda3

SHA1
34cc3fede532cb48b75da8635ce1a6fb06503208

SHA256
4f98e8bfd5c773004535ed115cfc0044cc2954a6cca4a62f47cf585086a50b51

SHA512
00d010a3a806c2e62e5cdf733f467b296ad485e9e90a74a2de270b6efc6cc9e1adca5194ef96b7ccecffb94ece17112eddbeba05d4a6f3134d4f504d6fbf8bb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
251c6fec74cc9ad62e1621b6dc3f33bc

SHA1
e263ac019937634745bde2274da39aef6a637a61

SHA256
5d8e9e22c58157434cfbf77f9cc16f3eec7f4d2c131f52cf7b23114583de98d7

SHA512
2eb0c0f57147fc181512046baa104bcc7fdd15cd43f592869addc1fcba15072448e86d3c4a57ba1e3e70875874b944c7ce73d8db95d08a699d9c0ad2b68a49fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
664e39f8b14063f3b08e11251e30846c

SHA1
c88ce63f4b9df19bc6eea7730b22706808c7d96d

SHA256
17eaf47fb45a5d354617742a0e842042181be8bf73bcfac29c349f691a15f56f

SHA512
4e191d5a6fd48e076fb575601a4f0ae0b9a31e84a59f681c89230cfc431ddd78d1cb62ff239866026b99dd9403ea848703be0fe2b56f41566d949218dfab7043

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7CD0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7DF0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit