57aa06966d4b6872840880c8aafe72c1d7d2ed3b28f9b716a019b2c42b2c7e89

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71783c3bcd1da2d8997ecbdb0d1ab832_JaffaCakes118.html
Size

26KB
MD5

71783c3bcd1da2d8997ecbdb0d1ab832
SHA1

ccaad0a75e9f4311e5c8f94209ef5acfa0273554
SHA256

57aa06966d4b6872840880c8aafe72c1d7d2ed3b28f9b716a019b2c42b2c7e89
SHA512

43c6df0bdc1d65df8e90f5f4e8b1cd04d7401b5b548df21ed32fa1ce254c0caa3706b97a9ae9c13f25a38e56f1682d2ee6c67fdf180b87c124bfd536d1eb6109
SSDEEP

384:SwlbHtUE/aNQnKBwGqByVOD52cCbVkCJ12pyx07BPCbbKsc45FJZZDA:SwlnniLqBwmcVkCsyx07gKh45TU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422789579"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C2BAC41-1A75-11EF-9667-569FD5A164C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2776	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2776	iexplore.exe
2776	iexplore.exe
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 1636	2776	iexplore.exe	28
PID 2776 wrote to memory of 1636	2776	iexplore.exe	28
PID 2776 wrote to memory of 1636	2776	iexplore.exe	28
PID 2776 wrote to memory of 1636	2776	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\71783c3bcd1da2d8997ecbdb0d1ab832_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9832ecc9822341e9a7575b852855711

SHA1
699fbf9478658ff0f89edc47eab5db0b86313bab

SHA256
0a8796186dc5814842e508d3c0097898685beabe3e9642849849f9d2a71a0d8d

SHA512
779b52e01a8de552f6879260dedc7c8215c04ed4049386821be2c842c7434ce2649202bbd23e08f51c5c47e6dd1f53924f08da5c4bd5a5c640ad634800eab279

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
702723247ea902ed338292b5b84541ef

SHA1
4585ec8298d5c0a67ddc691f61d97052f4a88fbc

SHA256
1cf1683902cbfcaff8203a60fdc7593cff97647f4d443ee70acb46d5c63466a7

SHA512
0e16ced3f4033c3bef03a54bb06f6b07875ea0a8194e6459d33f8179fc576dfe0c8ba30a88bae2018611da6e0f6757d6d10a4b71d66b0ed4eaaa3f0bc94a7e6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36b2737cb93c2f163bc6969178086865

SHA1
1d920a7fd5c065c61185774437d252245a6208fe

SHA256
65db9c1a08aa62a8e02966df6734ef1b8d71d65b1e5455039adcc5086b6d5607

SHA512
afbb9d2d2dfc378c690633af3150886952cf9f4510cab9c45686006ddf9f52655fd47218f6d1b2e23e2a3e92dab304c2714aef218d53909af4114ca46813bac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3c73f162cab49347f131d900b9bebdb

SHA1
9c4920c36c70edd5875224444cb22cee0dc319aa

SHA256
39532f8692d10edb66c6e81a5300e834993337b72a51cbeedb1852a6f7afac9b

SHA512
c7f481dfaece7bd23f030774ed59cda9b326965ac1b95c533e15d0e2a3dd3feb8b182afdb8602da875edfb882fe776951563fb44ac8bfeaed8ee85239153a34c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d014a8a9e139204f3fe6d575d42c8f86

SHA1
3df13056c540e93ac0f11c42e2edfd3d76b41b19

SHA256
50bd34dd26ead3c1951edac604773fb4bc8535dfd728cbcdb8819146489c34fc

SHA512
65825a5da7836d041b486fad1cbac716f9b01b1d69033e807dc644b738b549185885e7da362422e2abe3d198fa35aeeccff9564b7b3e0df1d872a786a51a4f00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7a644620321be49d718dec0adb9369b

SHA1
87180aead2d8f46e2cdc75bea5e7bf6cf2fc58b6

SHA256
c5aa2498cf62e74e2a05acdec9cae1c9ec0bfe132813101fd2e3bd9df7322bb1

SHA512
725f7029e6bfdf58eb7e1c5a62ea0ba06211dc45cf9d891af03c54792ae4e60e115f466370249eac9f33f1ac96f9144f7923e049c29d6312ca0d8f08fce3b023

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7633f3e0a69cc72ca955c8633e661a2

SHA1
91f860bd8a952584983b2db78d10b094b1ba4611

SHA256
03f21035b5e774506994b401dbb8580cbc892a63dc78fcbefd8c3acf58c7043d

SHA512
d204e17b1cd11fe1e12b442716f6006f761f6916a0e04fec6ada694a0464d5f28d31a794ee7be3537db76adfe9c4b037d77bb6b5fa0b0a8159f1ba40c75796b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7af00f4b5095d5fbf0ccf8e22064e672

SHA1
e19bebdb31dc857a98e31b5d792d1e09b7a7523b

SHA256
6e111db59ffd19cf339cefcfff4dabfac0c6312b230132ea10e0400e0bbafb10

SHA512
f2e23a2c54f9ede0ca9f6a9e9827b7bdbc7e91fa4d5b051d4057aa54847a2b3724b4d32f3b72603f7f98665f8f020abce849cb412601fe24b36b5e8983e40795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3bb5ff48b9cc1458c0136090f2a9354

SHA1
17e0d72a3405b02a06e2785a95284448b55517cb

SHA256
7026000ba3e367a4f1a87c77d1806b4390ab4de1745ccc1f3b9d976650519723

SHA512
f2ffa55e163c437edf7a5db4732d8f4ca4a9d1c38c8422c8c50c9de192d0a63d624856e19f6403377949bdfab392898f81899d8d91573dac2ca5277db58b10dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b6bbaef8faab130e7964858f86833a4

SHA1
13c141ba110c66dbe19359f6635e20b02b5e7570

SHA256
8667c9b95a75a758b153cb3bf09a0450e0e5ecf7f5a9bd0f219c5d561a4cfb3a

SHA512
dba0355f025e6305673ea62d4dcadb6863adc596eb98e79b356141e062f31d4ec7e3f15cf377832054881bad1cf12f5ec9de3d8b0138493a8d51d4baa6d7ab98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5f5464be904d54c6aaf45c471d4eb51

SHA1
361cafa8113fee12c186fff008cff5a187c7b070

SHA256
7f9ceef0eac271111a57adfe96f4ccfe45093448376fc7e5881bed954b29c368

SHA512
e80b15851c3524a7703f29464141e779acea071268a449385fe66d9d91bd7c93f426ed37c499a5784ba96862afe23bb789823b0cf4580d51a8c72ad2e05f0cd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab872A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8827.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar883C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit