450e9ecde8d24ed79b2af436212c1984b0da8650299cb64445488c41ba7caac8

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78c514bb2428ab81d2f1c93a41a7b223_JaffaCakes118.html
Size

49KB
MD5

78c514bb2428ab81d2f1c93a41a7b223
SHA1

cca63c6d54c681336ad1e986a1de2124a9d08ae4
SHA256

450e9ecde8d24ed79b2af436212c1984b0da8650299cb64445488c41ba7caac8
SHA512

be87fb92cec47291d9e51425838c754915660954683d51dae8bf1f37d66c09eb4b9c64db657ee5042e4aad581e0895106284139f0268659cb835891d64882405
SSDEEP

384:5Q/kMbZKz1/2/o2z78DndE9h8FHsLCCL1Nj/Y9ACFdvWYMy8eXYtIYpl8N19mOKS:gI2idEcFq5NbYh/8eIWPgb3yZv5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E3C4BF81-1C0F-11EF-8C89-6200E4292AD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422965872"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2832	2232	iexplore.exe	28
PID 2232 wrote to memory of 2832	2232	iexplore.exe	28
PID 2232 wrote to memory of 2832	2232	iexplore.exe	28
PID 2232 wrote to memory of 2832	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78c514bb2428ab81d2f1c93a41a7b223_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a35efb7608d6d53d4d598313f03a6c36

SHA1
2236da3f5e3100e8330e20a97edeef31b842c4a7

SHA256
088b5d711377fd2c501f671783e4d767ffecec2c271f2e8c29db2218c0f06bab

SHA512
4d233c6cc73b4a94e8c731013dcf1478ad595567238192daf3a5f1003785f63460fba832de099488983f70b52c58ac54d71f4cab3ccd7eda0ad75398dc093b22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
859b24b4ea8513dfbc6f0186747351d5

SHA1
a1441b5ce92d4295526c3946f1c0e2d1d2155b76

SHA256
d246dcf29ef10bde6676934c9c8945de095230c24eabb8e66d8b273a1314890a

SHA512
d499d4fc0f51dc9c3202bb130b9a3d9bbcb6dc96e614fda1b1fdd7a06fe1578d4938c0c63cf3b485abd394858e322a9ff9b9520e3db1d14f0bc6e6c5906eed13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91e0e909decac035d83b94c5459c3062

SHA1
49b369b4b65ead72e146abd3aae1c0c61c28917c

SHA256
355969f156f0d988b0a1649c637789eec9fc6dda6edf109fa7bce7cd01eb1647

SHA512
cd6f700d24489c7556a5b66ba7b449f7118b1f68e8e405cdd0327d1fae98d28d3023a56caea4b9458e60b55f7d2621ef76ba5004178403cdb56f229039b36408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c859ce6729136b0eb12629c2dc032abf

SHA1
63fbc98f6fec45485514a077216659693d485f44

SHA256
d05286f541d0ed4a496cebe77b3b921baafdce351b41bb6bf47258748ec79f18

SHA512
c2d4e70ea1ed26ddc7ceba825ac04a44e9b0acf5dc69657867788f322db68f9e9f988ee3976fb0f27e74490418b1a8f6c3518db2e26433c48de891908afbc88d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de9e7c20d66d7befb788b771ff05db09

SHA1
9f366c79cdb6268c865e9cbead1e10346485f37e

SHA256
fb38fc752b666d049cb67c973c758e3bdb01a0fe1444ee81bc9cb0847e9acb5f

SHA512
49e39bbf7519f29eeb202c3dad2a3369ea5dc987e8441133b3c52e67cbd53ee2acd280adae9a621f3fd2a68635ac7f1e3233b67b9978edcbb036b7a4baf301a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b7b16d88b63cab858b41f36ace9b0aa

SHA1
5f16e323725c5e5b21fb18df0d5fc2b21a52686e

SHA256
0d40d51aec4f12982d5c9d0c79df6cefc7f53b917a971900d17385e8e39466bd

SHA512
eed2d47786bad84037a718c636953f7c0ae93c86412ed3640b3eb7215c8a0061be3f3c73c50e04422e8c4118a1a6d9768e2ab694940acd37d25efd2d9936bf90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a8344404bef91747289e38d5025c8cc

SHA1
0c958c29fbfe7276b85caa9bd6b67d9d8cf7a9ae

SHA256
edfa10c2c9bc46421ac6673bc148be07a464a6a395fc6ed2fe09e8616f8a5838

SHA512
7ff17432099912530aad038c346b527aec6c5f2e76526c0a22276334ab8244f87220ea7e5b21a9884eb4d21012a7ec7bc1d1b03ed2d2901ad059ef8a2a347706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82e129609df017bff5c0727bd2a20be7

SHA1
a723cabf0717ab324c607fe3a321083202e817dc

SHA256
7015bf8e7800b0374357a4e3446dfe0c7b2f73f89f5e12edec2cf61c30ebc9cb

SHA512
dcb782edb261c533cf38f5e5180f1794ab38d7416ddf3ed8e4a14eca81e6bc29d26fe3b9e2b571f90ca822cb6054383aab6585b74d57f27d89914f768313a091

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80ab52fd0e3c3afe3c3ed8ce40c07b1c

SHA1
35e62c14c703ba6a67acf1c2764a52eb7abd6364

SHA256
a637773a5f2f438a5e3def25f4cfa76780c81f5564ffcae98b076420b718745e

SHA512
9ba9b5d0be9508777ae596038e35a0673a65135a9b04b4dee58f9097cbe6f4a423af47dd6c27a2cdd3c7ec63e65f3d2019a5e20904e1ab0705884566de660e98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab232C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar239C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit