d7aee7386517b87bcd68c5e775dc8035835a0852289414c243ae59362841a4ec

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7152829f2ac10d4d445a3a1ae15cf969_JaffaCakes118.html
Size

20KB
MD5

7152829f2ac10d4d445a3a1ae15cf969
SHA1

08c04570a0f2ee0b5073699cd41a00c6269ed684
SHA256

d7aee7386517b87bcd68c5e775dc8035835a0852289414c243ae59362841a4ec
SHA512

d49ba42a943e59d3162628d17d1721c6f9b4a0267da6ce67feae3e0ff9646de7c727daf3c7e50f3d6f6b54b42369892837d5b25dcd754bdda9b239d757571ece
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIQ4AzUnjBhUe82qDB8:SIMd0I5nO9HhsvUNxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422785677"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57388A01-1A6C-11EF-99EB-F2F7F00EEB0D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3056	iexplore.exe
3056	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2168	3056	iexplore.exe	28
PID 3056 wrote to memory of 2168	3056	iexplore.exe	28
PID 3056 wrote to memory of 2168	3056	iexplore.exe	28
PID 3056 wrote to memory of 2168	3056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7152829f2ac10d4d445a3a1ae15cf969_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bcb1b13a0c1aea96bfb959f1fad45e1

SHA1
aa5e4fa9e5cb7331c9229e35ef3365ff5409b290

SHA256
b585d9051ef027d1f688eb019391e1162048b3650ec6b963cde776fff1f54286

SHA512
2c6a527afc5394c966ad47d9c020ac1d4c3193433076a84559f9d0c9f9ef60f44de75546986a7046dd776f0a456635a4183a3a156b14f368fb52cba1f7996297

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62c2662e33c0155390c6c797bec0ec15

SHA1
da10eb97696b9cb255776277ad7c7fc0df7355cc

SHA256
5fd244694ccb756aa9bbdbb95862b2646df268bec754aee106e6f9ef57cbe899

SHA512
8d27dedc6cd1e32626af4cd1a7d20dce3bee9365909fbfe4c93b3687539e66c380b4e46ae0d1d208465bab0559c8c94ef275974af5d67cab92ea9bff492cf01b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6e466ea26a807134995853296c6dcaa

SHA1
81d795422e4b860a5e2824acc886c8ce9f2c5df4

SHA256
55b158b5eb80a1f08b61b8856668d493a8a674ffa2e824a3745ebc340ad2a8b4

SHA512
e7345b74d511f9431156877bf2f754f67170496802c05930f4f757e009123eddb0facd60bea5c86f89e7ec682df82528b244232484fb71fef29d92d68f85fe72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b547b305455f3c0f867677d977510db5

SHA1
186639e181d93a3214eced4082a74799773811ff

SHA256
b7aab2112354f92550fb999513602bb64ae150bdb88087f60414f71aab08de2e

SHA512
4929b2701896e2d1dc00a1362bb85cb4a6f0789d5153bd324dabf337f68a6c5b1c22a3f401437f11de72d567884b45fe6551a80e3ed32faabcc5b8461f890ac6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b4e47e39792c1fe6954b409b36d5d71

SHA1
ba6540be4ec803a3c8e2666bf380de2699b4410a

SHA256
237d4b4e5dd15f9c945a4ef1fd07cb59bbc2bb497076bfa964e7ad97f57d94bf

SHA512
76841c969ae1fd7d6909855f496f12cbc27789d42933c74f08a4939bbd9e3e5c1710fdde933d53eca4b33de58c9ce0cd8fcde745c8988c0f7d6c4d4a12a6ae92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b9d08f870da82c31b7527fdc5f99a9f

SHA1
b79d166d961db538ca7657ab5c923f2fc89ff1ec

SHA256
d8e7c32759d923786d29ef0e0f377675f36a777f084c3cc364b8e926e3e62aad

SHA512
a2c7f4102ec87c7e486a2c290b01550d804dd93bc65bda546ea82f4731a8664e71cf34c580826cf607a478e6ddcd1ca6a1cb673b55d1641a7639b65c453ef342

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b40e25feebfc3334752b711c7826433

SHA1
a76ea9af2fd004debe50e5e834c2ff74fa151658

SHA256
24587cd951fd183d491b5f991eb3e44ed180f9351151facc5968e6e50e7acfff

SHA512
d74ea4e2ec0ed9bebd2f530534976de2e166d36342162e7aabefb857780e4756fe645c7eb4452a5505f5471a94595b674157e40e667273121aee5f0525a9a095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
273aff572a90811b1afc74e6e0679f65

SHA1
437c3f2e06a5fc1f1b45e9df11358558813dee0b

SHA256
c357928b1fe6ee4a3e591fe641a742dfba54ecc76cae255caca62e5158566582

SHA512
0387496071821e794f179e977976f8c41c3bbd3097dfecd27cd1ea9786c561f4172056ca4d2698c07c4c777f1ef610784a596fd8cbe331a660113aebc28c0fb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d4d916ed3ddb9b38528b3f367a6a8fa

SHA1
48eedf0942e3877e82188e5627885dd0ba0b2ccd

SHA256
321fd367a01f9b8e5f63a9dd5e19cedb5f5bd1f346d76d19aae146a299fbec90

SHA512
2742ed00db3974e3c7c8dff992a226c3d76f6f171418f676ea610d709b3e0e6e099b939428033cdc65226552c894d75d0d49bc5f0c88d3add6928b2dc5a19ad7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2416.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2486.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit