66bffa3a0b22c029d0bbab9bed6e79358abb137ccc36e38082f2f69a3fecf740

Analysis

max time kernel
148s
max time network
137s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 11:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7cdcec6b602e53750cbc74759dabdb42_JaffaCakes118.html
Size

18KB
MD5

7cdcec6b602e53750cbc74759dabdb42
SHA1

c6f5d7c91c3fd1d8062e1da6d63ea37716c84fa4
SHA256

66bffa3a0b22c029d0bbab9bed6e79358abb137ccc36e38082f2f69a3fecf740
SHA512

15b77e41275d03238f6da6a0911e35d868afdbc12e64d57b4da05097374baaa513246ba922e739acca458c06a8627547e023c8be559d521e9722621d20f64cc0
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIO42zUnjBhKc82qDB8:SIMd0I5nvHFsvKvxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423061341"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2BBEBF51-1CEE-11EF-BB79-CEAF39A3A1A9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2092	2164	iexplore.exe	28
PID 2164 wrote to memory of 2092	2164	iexplore.exe	28
PID 2164 wrote to memory of 2092	2164	iexplore.exe	28
PID 2164 wrote to memory of 2092	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7cdcec6b602e53750cbc74759dabdb42_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9293d657913d8265b3d76abf2ccb09e

SHA1
71c815a6beee379c9ff1d2e9dd9bb805668ee213

SHA256
53490c7e5e2819d582b281903f2f4eda90c848c4f64397b96b089a6a42817ace

SHA512
03eaab819035c8bfa1e321694acb1418e20e400f77b0b2bffeed042052efde73b8754c950d87d69e4c6bf9c3c9e8e6501092a1a7f42bc040ae4f6b75148af287

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8d167645d34a21e562e708d9b92fe13

SHA1
be384d2316db6a39e0bf52daa8e751737a992e3e

SHA256
2292b0ab3ce03ecf86a28e54d575115f8e81912fab448372a3fc793616004bb1

SHA512
70f99e071bb91879c5f234148976226088a16ae2f93ebf467e8b113fe6205d5070c81f8174c12c6710e42aaf1b63e04b277d9debc4fc565e83be4719c1eee7d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7daf8f6f01a9dd4ed258246832d167b5

SHA1
b6b33dbcdbed5f4b107348ce6de8d01c9d663c40

SHA256
f6261de5395efedc0989a4d17aa34f4ba25dbe868235f68ac8c0432977288268

SHA512
3721523853864f5ad20b02ff67c27ccf8f397bfc01f254b8d7457b1389deeba9526fdd44af338e9c8304f2a9b527bcdd1631f40460d2e4ab0ed44ebb8ca864b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7549776dbefc23d2ec1ee07bb3bbd070

SHA1
ad252915d23a2e7fa29901e24a35deffca74a11b

SHA256
a28983830502d6301f4415c5721d87d85cde767d5436ca4e51e5c5ee1ac7e30a

SHA512
96f0f45ba05b08ef16edbfdb8e10b53970742ec0c2a7b7f5c547bb37d67ffad11e4e3511ae652e4e74329a8eefaa57da9fe527a11494734acf89db837be3ac3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2abec10ea5186e98db8ef94f0ad920c4

SHA1
ed9c99aaa9e641d470a6677989c1818d062a472b

SHA256
615512c10706646fe4915458414d8166e3e91aff5b3db33cfa570b64eaf79dd1

SHA512
0b9a62911a6011988b045a9e53662211ba2be7490a8a652fb85dd8292f3faf978e93e8d09a83d0c7a157a4a2e14c315db2dd0fb3843c952743391002d9cfb85b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f438c70b957e6b4a14de6cbf46e2a5d8

SHA1
da0f4cf6640e1397705704f50913db0f70d03944

SHA256
29226c91c685e7502839cf68c33da3ad82ef1d931d7a9ead68f91e8cc718aeab

SHA512
7160b8a88892ea6cf30ca7dd78b8fc937864b5c018296b097806b3a856ea3381870a58cc4c05c911a015611bd070fe7d87b604f0e7fc3873eb44fc2174f932a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4940187dd639a8d95030ef218e362b4e

SHA1
1e642722d6c2b41fad1d0b1cb6dcf1e30681e0d3

SHA256
a8962b37f4c42f74f06382ed7cff07940887241798a7ecb9bf9f004c0cc6f917

SHA512
059d6a66e64b4ddb94d05388cbb617462613cdcf98a353d3a661e4b30aa1d4fc698c36b5e3abbce2dabf10882bafd91200ea90e5014283ebc6d7876e227ccdbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
480a5401e8c89a71f4a6d7981824e2e7

SHA1
2e44c96df5014f25ef17a5db7cd3e65e8faa92eb

SHA256
5d516870e9d7d43ecee48ee7edde3b5b9ffa922cd54a3de7e89c344e54596517

SHA512
9c93bda6476cdef4613f7ae7b408b252037a2ceeac987baf7ee39440c3f5628fdf0f8e1d309afa02b3e62db5ee8061b1d23b8dac8b27ef417fb34b721821778a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d8e6115f7615a906d7a027e4a291494

SHA1
92a5f8fdff8eb1990e05a50cc54a8ba5b2f19789

SHA256
7e52db42207b468e074b4a8164acd64f01d5a63cf80005570dfac33e8c57d7a0

SHA512
3e3983abafefaa8b6645aff17b00a816214a3b8ceada8421a2ce02d40d4f61fae367ccafa2d4e1292bba7c2eeab6e01b8938e29245a99b2ffb237cb6eb88bcf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DB0.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E01.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit