456aee2d206b1641990c0def55053ce5cbb5a5a653a23626118e3402761552ba

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 04:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82feaafb1cf0f5f6341c88d69d1b1df4_JaffaCakes118.html
Size

26KB
MD5

82feaafb1cf0f5f6341c88d69d1b1df4
SHA1

77e534ae2656dc873b877e5465187023723f11ca
SHA256

456aee2d206b1641990c0def55053ce5cbb5a5a653a23626118e3402761552ba
SHA512

910341613d4cd24d56aa222b2cc1bd29baf38aa66d2c02f962c5825236559889508bda6453e57185b35b4546405f8a0a3c98873e599c4e1c3bf2c9f50d3a8d70
SSDEEP

192:uqPPP3b5n94+UnQjxn5Q/gnQieLNnSnQOkEntkinQTbn1nQXCJVevo7Nt+Fo+Nzq:nI+ZQ/+ygc5VZzN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423204235"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DFD56F51-1E3A-11EF-BB79-CEAF39A3A1A9} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2860	2164	iexplore.exe	28
PID 2164 wrote to memory of 2860	2164	iexplore.exe	28
PID 2164 wrote to memory of 2860	2164	iexplore.exe	28
PID 2164 wrote to memory of 2860	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82feaafb1cf0f5f6341c88d69d1b1df4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db22f6008aa6d5213bc653e10cbaaf55

SHA1
91501e895ce18725b27c2d4007803b0cb690061a

SHA256
3b6135ae1fb8442ae814ce0cbc9b03e385901f92ee8839744b1133cd8575d407

SHA512
4953fc268fb5d072863af9936d889fd5e9e2902a77d7e6807d3e9e3e851f62d27c7c4256158bf52639d18c2cfb9f273424f50b2d050f84a6fae34b8a6f286380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f4a220967942a9571c2ffae34faccdd

SHA1
ddb4bbcfd8626bed984c75f7db5492066043ff79

SHA256
a7d945f52aa58c7d6584f69ba80574d70c4c0ad81f161d060203cb32473045b5

SHA512
1cb499b6a37e2aa1f76e2de5b075e2fd2b399c9e2cbea2d7203ab09f185f506540ee8d008f0029c43725427fce70f886be35204bb3e006f97aef22ccb98edbf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
572d5720457f916c1b79b49e808ac802

SHA1
ad5ac3824474c6886f9bc718b1e47545217c7c75

SHA256
c9cf0b3c6eddd7b9a01a5912d36db3b69a0dc91736fa9fc8cd2b04203a0ac161

SHA512
6a3fb60d29ffb6b0a7b921739589c83e67d5f1c15bbba9ccbb189d05a54a969e6d7b20480ae1799a997ca494d7f2ffc8a26690e23d1e2a028ef16ca1e6fb55fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81ce1e70f90a9fa81b1d12c42520451e

SHA1
d74e1be1c77e429fbaf2706727801912e94a3585

SHA256
528f71f7ef24bf33c56ee00ab33c805e915ad7cff62a0ff7ad59d1b6e634dd60

SHA512
f31eedea2793af160013edb9395df08782728379a11c887b8ef715980a46db8cdde1988d203237b39ca95d91becad276377ca890b5c32b9f6ddee2cded2284b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5df3ce3f4d10e6a2d145e475f050459f

SHA1
518e7deecd387ba6f106531caf0002defd14cc7f

SHA256
3f441a5219850da3ec5a2fcc9f80caf71463f841c5ebc16356aee208e176d204

SHA512
906a0e4fb31e48fcf85d59211d495cb01108bdabea1cb8c4cf522cd8349fbc7349f691641b3a9fa95030bdff6b2449fbcb3908fa1a02e221d8eee63bd72d417e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
097100cbfe20a324830dcd39908e20ef

SHA1
441f88d71da12010ca8bf0e4ac9e76f27663cca8

SHA256
1a24c6154bb2e594eb17cb2368cbb76cb4c5617b2259867e6f3d499fadf08fee

SHA512
497326dc48d784f991a5b24fb482afdd2d1d2b1fc97a1affe42538abbd19ca379f69bf1e121b8ad76a0eaf4d0fd941c61e4b88622f4b9ec8030c2331532ee5d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5570987da9560888ffa2feea2655dac5

SHA1
fe0f69d84648de923463905a841e5d78431f8f9e

SHA256
b16fdbde317c879461df8a3c370279bf075a3ddf8a87cb15848961781ef58e53

SHA512
aacc95e8bdee80cc1e78375a9d3946dd4460604dd22f2b215ed4fa1c862f910636dd607ac0eb674199cfb9c456d6209a5441ceb6a31464320e2c07d22bd0b24c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
431e04b680b08c622bb1d9c1899b4240

SHA1
86c71805d029ebe84ae8a6c8f662e76ca0fbe5f0

SHA256
1e2cf1e02d89bab79a69bc854bf10d942cb28b9c3407692421c5424c357dc955

SHA512
ad7f177ee07636ece2722615d7f75ba263a86ea60b92ff848e2ba86be8545dc6466a4cbb599e32133227cb8a8d90a16ed05b970026da321b31dbc6a4531b2d0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5227f3fa44b1a91fd41f5c16dbb56724

SHA1
9c0b90fa5a528a60334382ebcb77843155f4c368

SHA256
510a856f95bb6b190d76f7abd1329f480fb200468ad26dcbbb77a5344bd9844a

SHA512
b71dfb34a82bc2732ae90daa332e3c811fddb8bde250ee135421adc1c8c18e60eb41f9ca5574b34e5371de7104212737173b49df806bbedd61fc712423168b73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DFE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1EA1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit