401c99f3037446f79fd40ccb0082ebb625577c328c99f51f4937deac768d428e

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6af312693f6ac89df3a68329e3f08803_JaffaCakes118.html
Size

23KB
MD5

6af312693f6ac89df3a68329e3f08803
SHA1

fad8a20a5eea8f1a1c69134536800ec59d20cf56
SHA256

401c99f3037446f79fd40ccb0082ebb625577c328c99f51f4937deac768d428e
SHA512

ef1ded7b90e905438b174c10f390ea950b56f708ec61acfa5308631e7f929615c7e67d27adfca40353b552f8d64059f6d9ec7d5eca54ccead9669cf4cd97f119
SSDEEP

384:3y//LL91ZtBLSiO6OBV9SisiQgdtBLSiO6OBVJpKQ6gZFKFqMfcJ72DnNCyy//LB:3xOogZYEOcJCDnRxOb7nGwRM4grOz8pK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46FBEB41-1900-11EF-8B04-EAF6CDD7B231} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422629313"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2652	2172	iexplore.exe	28
PID 2172 wrote to memory of 2652	2172	iexplore.exe	28
PID 2172 wrote to memory of 2652	2172	iexplore.exe	28
PID 2172 wrote to memory of 2652	2172	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6af312693f6ac89df3a68329e3f08803_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a93d85781e3e7d5bfc15daa2b8634b03

SHA1
d6dc94077b9a80dc5cd07f1ce9b4bdcdee59223c

SHA256
e9df3ffd5a520dd0ea5c6d14e36efc3f336293164ecfc78012a556432cf391f3

SHA512
e0d42561b505d668246be647206f450bfe55015f1be5048f91c4ed58d82bff6a8cef3e2c65066703303d6299238c5b27906c991ea6fe13ecef117c9a4569a492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40d33376edd81ecc363c6325c2539a51

SHA1
afcbcdbabf73eee6e9adf5c8865070dd45b99f27

SHA256
0dcce82a093c2ad708468755210449546b3a67b4f6b9a4033a9e219a9e4254ca

SHA512
c896b542d4e007ba97d59890ea493a4d66adc29931a7317a5ecb201e38a536a0aa7602e03f1a6324247febea5173ba090bee901086472c94f871fd842346dd49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53c930a9607eb62eb01c0bfc61aaaac2

SHA1
a279d19a84bea2b61ea64c6a43bff58c9fc316cc

SHA256
d8ccd4385e2ea8e14cc18c5443d80c2324cf6adf06d01cde54dfac87cc3bb0ee

SHA512
5f7d8032ca08538352804e32efe102cffa15716cfb5a07c5713ddc41d6d6b5344629001be8949e86eac004c0a31efee59aaed39a5d42a7f232cf9d76422d3d34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b067b5ec51b055de469832660104de6

SHA1
a6e07f05cdb034fe9183ce0245aa955fa3ae8310

SHA256
1a56d220967a760a6a685590cb65eb58b87e4b8eb0ffc63dca957d3bb01975d0

SHA512
0781e9fd2ebb00c73d9632414a94657e0e11714b66900eab045c46fed212755c55060b939e33bed37c30a8977c7c2300e9a7dd41c02a64f56aa1a471575c3da9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37348fbd7cb1c3182de6f578c33123c8

SHA1
b0e957748818de9060f764721b49d94f536a3941

SHA256
9a38096930f1bb2c19f2733d6e350cf9c783ab841b069ab5c93a3fbf6c26e424

SHA512
abc1e50493a70db24a68dd8732fbe8659be8c5684fe18d770bf6c83970dccf717df822597cd0645517dc0db45195fd949eecad062029ad16c0e9c248b335f734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d62199c5223ed56deeb6a3c79b60dc39

SHA1
017317ff24171c47dd1b459e22b808f22eeb3272

SHA256
fa5eaa0748e89ebc5aa816facbf86e4054cfbd5df67b5d1aed453f4f66a914d2

SHA512
aca8dab6e485f0f34b4ecf30c7869f38c3d910a5ecdb20382088209e7e3f0a3bd214306ea4c8f4b5e9ba4648dbfa609453ff0bd6d2011027cd6e161003fe563a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7b420c6b1141c00fab83c8e5cf19944

SHA1
079ba8e7bdd4d6e92b5fadd131ef7a738502bb1e

SHA256
cd2be684bb5c30a3e8c80c5cc4e8bdde20976f1777508a05178e46faf7e81df3

SHA512
74f8637b806d1e87781f5bda477ae69bb110d2e8ccae682e1bcb5d72f270b999de8e87b5e161b0e52c0ba7a5b53f17c82ac665f5ab3320fed4845d69f479dc90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26d6e38aa7ac57ac7dccad42d17e11fa

SHA1
f79563b50894b99e41f51baedba8830b4911a705

SHA256
1ca3a40ec67690585acf8eb53393957efe2aa1e621b1ad829efb0a019c547835

SHA512
beb4427d6feabe25dec0cafad14e87a780bacec700d38edbd2693374fccb7280fe2a991da9e2ec1b751094bbb04651e9204777caad35118689579d597f5a8f5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dc347e6657a9aed8383c4238aba3646

SHA1
97c8ad403878cd271c44f211aac9bb7ee227a44a

SHA256
d50cd1f510c267385c435a0710dda5a888d570124c2a40590297e5cc6471885f

SHA512
a5dd3c72375451e96e509fe59e88bbbbeab27419cf7cda3101d4d061f68370e89411d4585ee3640a386960b6d9ffe6631ffcffcc122d501858cf0834a71ab8e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
744f57c7be790b95271400ac45567eb5

SHA1
7b131aadc9c81123f65e51d86e21a7511e945b5f

SHA256
acd6f91644ebcc77f018a74c755199fb8d0bd7d5a02d06316d1fd5fd7b99fbc6

SHA512
b54338d8107d1cd8145474dfd559ad94cfc0defe9c656682a244a77f906a610019a7ed3e19379c2e3fd3d30715943819d3e8f61937ef13a01a024233ebe24e04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab30F1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar30F2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit