31992029e38773104284697ba426593436e6f8f2fdc47baa434854279a6c169d

Analysis

max time kernel
130s
max time network
141s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

78196f448ea584642b4af2a9da9dd222_JaffaCakes118.html
Size

18KB
MD5

78196f448ea584642b4af2a9da9dd222
SHA1

e2633b5b89e5cf0e75a94acb3d0b5a85219d9762
SHA256

31992029e38773104284697ba426593436e6f8f2fdc47baa434854279a6c169d
SHA512

7b03c46aa4786ef04bd4532f63ec7a3d68988be5a447ee256979fd8a3abad47b80bbb25a14ae43e90a0dac85bc1f5567113bda3fa2142399051c170b5ffa67d9
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIh4ZzUnjBhr982qDB8:SIMd0I5nO9HVsvrmxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C5E49A1-1BEC-11EF-8456-F62A48C4CCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422950693"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2400	2212	iexplore.exe	28
PID 2212 wrote to memory of 2400	2212	iexplore.exe	28
PID 2212 wrote to memory of 2400	2212	iexplore.exe	28
PID 2212 wrote to memory of 2400	2212	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78196f448ea584642b4af2a9da9dd222_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
670c3005d56f5720d0d5fecc0bf00eb0

SHA1
e073d9848a4c43cb82e395c22e8754194e8c0ddf

SHA256
77155a145ac33bf61aeffc54cbab5cab97b94a27338cef6ac7a714a515ffedce

SHA512
7569c303f44c2a5caee0ef46cf0af3bce38d0d1e0c0f684416082ae09b9b7486f9dd814e128bbcf49fd40e8f309262e91e6ca8daf916612763db2dc7eed1cf10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86b5a9bfe4185a647f8847d8cdebf857

SHA1
afbcdf979e369c704678356dafade9f1ceefa5a4

SHA256
d9a9896ae95228fe1e4ee6da16f54c15d7ed3f5015b9c1b49f24103f059478b0

SHA512
db3f01ca91a59ef91dc44c730c6494fd3ad475d06ee5b09d090c0d1233a1ef970873a5a658c85821693e87a77692b9620efba44e2de87c160887670d86888a5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
096a1d079ace63daaccd0fb44250d6f8

SHA1
c7c5a1e9f66a9ca9eb7bc550a5c7b15bd6389413

SHA256
a9900cd9b23c3b3b748d73fb5b2fee34c207a257f650bc0f7e5c1f8407b95de6

SHA512
d32e173984620d3b0e63a9e1162698970fd9a73c60115889f29250ea0ef8b85cf13a691f4c21038790d476ed0f1f56dea08572ee6c42d31cd00b1773729e6a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ea1ee464ceb34473efb1b14c5b5d14b

SHA1
faf46ffaff084965a5d3f0ea04bb9e9c7fa3c5d8

SHA256
00612b2db6338aa0eabcadc870b953f05160169b08ab0f65aeb39354c47a4c32

SHA512
d923290b597ead6ffb01f26cb8047ef3efa2b3e8b5ff37720454dac4d9e2336ce6fa416e5764fa7864642a196b58ef32c7453b945ee8d194ae0bd9f4eb4102f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00e570c2f981eda2aa5788d3a5b281e9

SHA1
8034887592cc803db1d3342b529a96df3c17a643

SHA256
b7a516b67b3b531afa1145b5e15098330beda4cfbb6342e4709de22c26886314

SHA512
ff0877c510e7d5c5a092e0cb596c8221d6fd6efcd6a14bbbfc4899bfd42e0fdc2304d79d5ab4dabee4ded94ca16ce59a43482f31dcf33aaead0191ba51db9bea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8daa5c0219cc282be69eb8e764e0a990

SHA1
b9a151bf37ad537e085c55d1cd0a410cd06f01e8

SHA256
3fe2fa291349c775bd858917ec13a07c3aa44d5df4c6e1c7298f334fad571e19

SHA512
0d86b0fc2cffd1dd7d2d407064f8cdead9e084a7e819a1e3959e6dd5b063f351459e92b0baf70733f5ccbce5fb80e48dd5c546703d029caeb9426f17f7b6ea5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f39c3d1e72bcf1d8d93e850a5ee7c9e

SHA1
ab6f6c0bef5fad0a3f22cd5bb9747ed4a7afb107

SHA256
a8fcc2c4ece691b313e74492cdc01fc4fa8f2e0f9124afd8def38efa829968d7

SHA512
5fa4f1db8db007cf762586121fb23e733d550c7440b1f334b63c947e46e7271474ab79926e3b7df784880c71bbd02440cefed525b894cc66b218b4dc641ece9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
986cfb712730f73f20cad262e86602c8

SHA1
d7abc299f0233ca9d5e55010badb238c959bd99a

SHA256
278ff0328757b1af8d454e87eb0826535ee53bd99ae73dde0da13519a5da744b

SHA512
4fddc4e09f1b812fcc9591716b43eb8de2e9aa96ef3c607fa9db81107aaa53c07252b8db2f462b7f6475b6f4ce4cdd60a712434522d09448510b602d49fe0f30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0190e3cad0a7c2253e9cbd23c2e54bad

SHA1
2146fc77368c1c854af1af258351202fef8fc152

SHA256
df77923f57520f5ebca042aacf8f64ef6fbe4d64b2c8fcfa50449b94e319389b

SHA512
a79f11c9ffdf1697e7d547fd4683c27c3452ea2292234ff8cae325a8ec50623f279aeff6b3db3ab22da11ac9daf6a32e492cf22517fc8078f06aeb3b28b85c19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99c57854843ae91760a7eee3c1dabe58

SHA1
2c11ffd7e1935f23388eda981e7276fc25668a01

SHA256
106623d6fbd7ffa25c9182c78d7928a840c5b6aff5472ae53d5018b9180d24dd

SHA512
542ea936091a3509c06fcb365413dd090c1cb7fc3278171feaa9d302db4158ec053c43b7531733ec827eebb98507ce640fc5946fc0d3ef5c012863b9ef219a63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7c62c337881106bd6fc61875e3133858

SHA1
1c22bdbce0d6d179318feb51f046c78b28b5e550

SHA256
53a2b1bb0596ae8792b90b66ac6494cae7518fc5f9a8b36a435d2a124c3f850c

SHA512
b9195d72f3750c7d596659f858a9cf7d29f4fe410a7e71a96d7156c935ed443726aafbb423a96ab10578253ace2c0480af4166cf4573c35e1985780b78210853

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar105B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit