ceaa29b81e2fedfc030fcd924cad7315e90490cd08a01b420779e7248c35b195

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72834f46d38a8385c8a5757ded7d5ae0_JaffaCakes118.html
Size

86KB
MD5

72834f46d38a8385c8a5757ded7d5ae0
SHA1

fe1ba7310072790eb56e568406ddf655ab2c214d
SHA256

ceaa29b81e2fedfc030fcd924cad7315e90490cd08a01b420779e7248c35b195
SHA512

a0a324ab016df47957c6cc3e3e355ea7ce3e7a2109a2974f0d0f35c7ab0cc83a6595e5a0b4c013bc892733ff169d8c2b4c9bee6e3ec647ffb98941e6ee30c869
SSDEEP

1536:nhcBczelh4HWP+denSl+Id9L3THQAVPs1rs3IIWIIw0bDMjjXfm:nhcBczelh4HWP+denSl+Id9L3THQAVP+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E0F84CF1-1AB0-11EF-A3B3-6A83D32C515E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422815114"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2620	2276	iexplore.exe	28
PID 2276 wrote to memory of 2620	2276	iexplore.exe	28
PID 2276 wrote to memory of 2620	2276	iexplore.exe	28
PID 2276 wrote to memory of 2620	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72834f46d38a8385c8a5757ded7d5ae0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
345981651e4dd60de6fc03e344984e10

SHA1
c40caa0775215392e083f81f1f03bec631b476fa

SHA256
8ea358e03fe11c22d2e9e2bd60df603d470c66f3287e4b26a38497b34047ab7b

SHA512
5b2043bface0a1279fb88c9ea6b8337ff5da36a63d43642fbd455d08a517118553743ccbe2d64c9f1a5f0baa90a3facd130c2e42ef80377d9f9f2bc5d97338ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c9bdb23b4041e1d144c6cc9bcf68c13

SHA1
234b229c1aefa6e9bba4f480aca08767e216ea48

SHA256
a4f5496e94c455c4045f176a0583dae47358e1808f741a8823a23dedcb5af905

SHA512
802285fd67604f9c180b91e9e0de81f442ebfb17b3afd8904bc19419359092401509c66fe28816ae3fee9682be942407b9922a7afd343b3af55e3c6475907f3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d0f8db8363915eeddb5db5e3e382620

SHA1
a9284ed18e19f8b2811de33112c8b3f99be3fc2f

SHA256
62d18e33cfc89ad48222c427168d962dd731b448189e42ebaf173615a6fea493

SHA512
c2a43c4a490c84326a1dc82bd7273c10719b5252e3284652d2ba3067f4a542497ec2b2c32ed7586e39b18df9ce8f88fa035bd2158a5bb6f25ac2c618f48a4157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca565162ab9add5707ab00cb803cd781

SHA1
6614771fa82bc4b682d5c6d2751767ae194c7491

SHA256
57dd488c1701085f18888cb685b1ac50506e74966558172a7571bcad78aee132

SHA512
1f8521a3f4eaea614ebe63e85cb6c85ea3a8cfb290059f2d6c4aaf81df1587c1f48ef8a2c43405c6bd08cc5fecac91523f8f0ed40ee03ba0ffde1496f06b9c5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b2dffe46fa57aa2e9a3dc3edbd91fa2

SHA1
195b543279b12e1389f9191e0d7f2d1245925250

SHA256
8ed5b047302b909f6704289f62f258645a3a652e09f77084a8492b00f351596d

SHA512
c85ca55ed1a279bc013f661f89ac938382851ab1e6164ad85decf1cd08fc47324d1149aefb5fe85bb611b114f73a913b3f8fa0ad07e9bb7e69329ba3e8bf5cc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
996a16ecdea19ac8074522af126a2654

SHA1
252aac8a52b5e5b77849d3dd2b1d25bca58ce842

SHA256
b6a1ee8324833f60c6760054a9dee503c71296b49895d8ad937713338c9d6808

SHA512
9de538fdeee019ddee6d20c309e78c6e155b61e24db1f70fe1dfbb179dad7e97e44f231eff266b6ef1e52b2f093196d52b04e70815bd39d6b3ba9c5625866982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
caac828dc1abdf9d65255d425e9760e4

SHA1
3080d77d109c943071f954f39dc5fedadf39ab03

SHA256
716ca0cdff129f54588c7968771f6f0cdead52a4e34cd7f7f4d3536bc2cb7f1a

SHA512
5fef6708439ff5968749badbdee363fbd4a301268679e6ff39a94687f04752d6f8aba6b26881c75620172644737a99ebe480a4cd22b9ddf3e952bf236f9fb351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26c42302cc6524a1f4744c638ca463ce

SHA1
38d992413ee5f8085ef66da34a837d7c6da4f935

SHA256
ade32bcc65d8beece31e897460d765c6970492b14c43f462739eb8dab905cfd8

SHA512
73c0a67b4e76c5ce9c3616a7aa1d8ce801469916be0fb8aa58f429997fbefbf0cbb7ade6d4200739495e07abe42ece3ad13594362e91c97b5ce0129647b66d7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2692b78b4d43011d468d2cde9a4ccc5a

SHA1
6b5e65863f30289d43a3c247601d80e9a35e051a

SHA256
4ce26c396b538eb2e91283fa2293bfc2fdd5a2a7e925bb11d3edc0699983d164

SHA512
c3ce989911f987ddb1eea79073458bcfee2654466d313a4468d9a520f4b4485cce6c460105567cab339217dae0c3964889bd051ea4365c7214f387cff176c3af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18D0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19B1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit