e4c998f5dbe62261bfad5a0f4f357841d26cd51c936e5433b49a47c4f78792aa

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70bed08f5816cfbf36df02f014749f74_JaffaCakes118.html
Size

18KB
MD5

70bed08f5816cfbf36df02f014749f74
SHA1

d74fa5e87bd5d85df806725097010d62a596a3a8
SHA256

e4c998f5dbe62261bfad5a0f4f357841d26cd51c936e5433b49a47c4f78792aa
SHA512

d55a164fee2530bf892e823165b45aa183d781f148a9b76507747ad6fc723e8ed50272cb55cb1e53faf23a85640a6ee017e501900f90bc1878ffa1d4051b7e09
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIh4hzUnjBhDV82qDB8:SIMd0I5nvHVsvDuxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{829CBBE1-1A48-11EF-9BF1-5630532AF2EE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422770287"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
956	iexplore.exe
956	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 2796	956	iexplore.exe	29
PID 956 wrote to memory of 2796	956	iexplore.exe	29
PID 956 wrote to memory of 2796	956	iexplore.exe	29
PID 956 wrote to memory of 2796	956	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\70bed08f5816cfbf36df02f014749f74_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32b3a2e043e70931bf13a0efea9eded7

SHA1
a2d85a6ec736aeba62a224d71e76895a96064d0c

SHA256
082e1b6ea8dee5d1cdc4f4888648441ca890e4f5026aa392356c213a55e4b938

SHA512
97767ea81f5030988eaff91feae11853aca586af84a2784a3d01a92021686825387fbc3f68f35971675697c0c60175ae2e7763da7a3658f26192b79583f53ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b67e10b1d28d0e5b89065e6092b0ec71

SHA1
da6357a65e3a566b55fe31afc9c8a719a6bf8569

SHA256
55e4674bcfe12a338d3ad4a79637b16a5541a0b91690954c92db987853a6959e

SHA512
88233edc27eb7f909d1b8953b0651196cec7731c8ec80366338d9759718e019bfdb63da90fb90b43ce51da040ed65e1322e21e90f3a23a5ce5a24c1b34950d40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6224a64b65ef198fd2d82bdab28a9587

SHA1
1801d3407e3baf6eaeada6676ffe4e679f271c75

SHA256
9a8cbdd3f1391efa8d20178feb3ef43886e2b47bb9cd25732321a4323f81ad24

SHA512
4468ecd10131a1ca1f23a7f543255d6f7d4c144156efa605a700b54880c7e6f8ee982d83428f7396089d3301fc52fa8d97d7dc221dba0b3802ad6874393a47a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7ea091ff877dc353b83a965e7bd201a

SHA1
b26ff2a1439a567fdde2d30022996804163d8559

SHA256
f77afaec0aef12fd0e02ed0415a4aabb56101734cbc481072ab2acd884badc48

SHA512
275eb9f46f2773e20339f584e834b27cee27b9bc80f7199b82c073990f0792e518bf53a6f17e0cc769d679f5682e021870810cf873a1ca494627e69e26f4f556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe3c8dec9fd8eddb668a1c20b78df83c

SHA1
b2b4d55cba9667a954a30db034f323cd08fc4838

SHA256
04218414de06eb3cb75b52434a8f90e813c86576ca37b60ecf9152c310c32f93

SHA512
f1a5dfd8d59f11ec40c6ae875ca9f594a0f8d19e904162fed674a79e9dc6ca64a41e6a90b7276597ffc42d36a1128e006a1527ed5e0f75a21dcc86d90068cc73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dc38d18c7d5fa7a9a67154721406d73

SHA1
795035afad7fb8a6b3fafc2c98cf81338aed8879

SHA256
07497a46da1dc314c17f202d8732aafd9e262a23fa53fc22c31aa326b99294e4

SHA512
5d69d9444716ea8ffab8ec316033decbcc854b7ea8f816f9f709e57d769d7c364f8180256bacf5c617501062825a11aff2fc84dfb0ca74761f648ab8f70256dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f94202f08117481712a8b58f9a582b2

SHA1
8553790b0731874eb316e1534bc315da6c7e1b92

SHA256
1345af1b014619fdd53704e41a355e172004a5d32ac42f68767724f07823e83d

SHA512
0b5df6eca286f4458da82f542e16da6b75d82f4cd531b50505a10cc771931e66fb349e01e87165879ea3d41df505c2d6820aadfc510b0ab7f8cc70e683c3a719

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea0eced1d84fba6eef03db15a350397c

SHA1
b5e25b0ef00963b7c361d2a1f15be3b7a6c4b687

SHA256
88f68a3afebe3f996bd50ec77d940bc6b4cf71c67d46b3c39c496e6c39690dc7

SHA512
ba2f2987e50f8265c23140a75791eacbd1515d9528a5452ce781eda9c9c4ae97b80dea037c7501bb99016b40a48b4a2ab2edf63bc381391c6af7922360064f88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4be792408af6681dc694d8a607712b8d

SHA1
fe9a7e57c4ff8fcdcfd6c4b9f799f948f1b75359

SHA256
094a383d0266d8786079c129d3460785173292d04b15d6264c85909c4f25499d

SHA512
24b876e5a66719eabfe3a6a1bf935580129551823536485ac1be8889bf0332323fb8365acb0001583e167d52da0e789f933c151fcfd8fc19c69c613dffdca76c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab148C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14DD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit