ba4b7cb182152bab5030e30a0bf668b0e84358c7bcb35723316c991d6e52f4bf

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74c349b95ae02532f7d3118a24f26706_JaffaCakes118.html
Size

29KB
MD5

74c349b95ae02532f7d3118a24f26706
SHA1

38040823f6602c0e8787a4a48d032d1006736d2a
SHA256

ba4b7cb182152bab5030e30a0bf668b0e84358c7bcb35723316c991d6e52f4bf
SHA512

bc4ec39ce99c5cdf10b4bc38ec5e90b1dc7954438864fa97ba7918d4ad8cf7cd381220c734880e790e460d34c1a64d2805631afe05f1051fb8e909f7640c473c
SSDEEP

768:z7RtOJh8HtGjrsX/DI2eEvhjqNCPKcNrF:ZtOJhfrsX/DI2eEvBrPKcNrF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BCEEC4B1-1B32-11EF-B1CF-5A791E92BC44} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422870888"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2268	2164	iexplore.exe	28
PID 2164 wrote to memory of 2268	2164	iexplore.exe	28
PID 2164 wrote to memory of 2268	2164	iexplore.exe	28
PID 2164 wrote to memory of 2268	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\74c349b95ae02532f7d3118a24f26706_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22f1dfcbd26a6e33caeeab68b30efef1

SHA1
731ce1f98b860b9448bf89eaa933f5ec29b7df0a

SHA256
f122a7ac1c91b5a83cbfd6739d68577bf765e995a76101d159469faa2d6ba5e4

SHA512
c45129aeff349a81b09cbb888a3ab4ba67a2d4cac9bfcb7836035c8ad1f6aa04ef1c81bda373cbb0501b09c0a4a6caad40246754a1f5408045cb14e04c0e2434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20128ebed3865abb36f24c5538904860

SHA1
30e4d863b59f302040178da857f4bca13756addc

SHA256
59310da5c59a89f3f5e132ca4f37b339a602c36ea1c8fc0b076f71dc275d21f7

SHA512
3427369dc2af6ec5f5cfc48f49d15423cedd299c5480e4da5b56a73f9cffadda36aaf8042fb54dd6364b43b70f30f648e1cbaac239502b6206b729674dc18dce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98d7c02404a76a59e254a6452b7fb58d

SHA1
ae2e42d041f91c21d70eaea44943e5e63297a50b

SHA256
74878c77f9138f308590c8dc812ecf8971eb5f76cd84669329d2363fdd24fa5a

SHA512
d57c8dfe44e85966286bb13d24697497b15f71d9106dc104e7111a7398cc3ac89879dbce1f6174ff5f2ed4534767bd9728009cb3df02898de90d09843c269606

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca3b82ae91892345d3b83fa3fc82ac1f

SHA1
11f7e7b14e865588babd5d9e93b9b5b0c0938042

SHA256
984faa0206e3201b6a892cda64d84863fa6fed3efd3cff639ba64eff92324d59

SHA512
9db607b480c23b47dfb32f8b64df44dbde4ffea0294a6cb57a4426d94dedf83c728f9ff28f8538c9f55f2919ed72ae0152d5688601abd0995343c3befa6b4b90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5047b2107b940e4a249dfc35b402835

SHA1
55e23fb1c829c06c2c201e1036d607e4b5a9111c

SHA256
510136c8f330380f07617b25a4fb2b44b1ab142b20595d702cd0044b167d28fd

SHA512
f4226cd22e953c6b201bb460618678e56106d84f870fd006b831cf4e125ad4f0292b5e7937dc8dfd879016bf7ecd6a72c226f20090f59781af49421fb8eec281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e83c3dac733ca5ed1bae196c8efb7896

SHA1
c87400d02cd1bd242dd354bff62eb5c837ca54bf

SHA256
45f1349d53d9b22b58c5c5fce885698523dc48448a3b599191039eb1c294409c

SHA512
782f3e3edcbfcec7f60209d0f67b98945663c7fcf826fa0302d5d786d0a34c838608565148109687be0b6d147870074587fee2eee6dd5f7329f950fb23d79dd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f22afcccc448a05acc3817a57af8ac0d

SHA1
359a20f225da152da7c5a3efaf824a93e9eaa0f8

SHA256
b17d6746b17b7e028e29d5885e2bfcfa98d5134ba8463a1f446b3c71fe097e88

SHA512
09b0315befa08f7a57e8448aa67a38a1c3cd51b668b8c8324a09bad5dace98170a806a6e2a9ab1b31edcf1a5c3d7174210196428731d39b296fe159a27053313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
065af425fd5f416409d53707fe049a68

SHA1
a4d4fafee476a299b3d49a008ba829252ff7454a

SHA256
267a77676692917fe203b1c8d571482f71e0280377e5937b6a2c21ba914bb694

SHA512
d2397d9afc36dd3148df29a9b5bb1eaabfd26c9f1c691f46fd59afaccd4bcd3846f556f03b75139e5c78467847c5f789964158375ee9445c9147bef0514c1e63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66b893c641570d621427b38798908795

SHA1
ff2e0beef3cabbb269cce6c6d296d47190d7f94d

SHA256
764c15f9f95245c6743988c0d5f4ea521ecb31c8373ad62122e0730dae8f395c

SHA512
ac842ca29b7f311e482f064b9645b1bc551b8910f7452115a64e591f9211c886e74c2592d9c37c6d7d9ef14e2fc781e369077ab53b81597f45fa27997b7e93ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CF3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DF5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit