d9b0c01677a3685e3d5d264371c4e06d7d174a93d043f18d96c177c7b203eebf

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

840ae0a61d6cc4166f5258a398379f70_JaffaCakes118.html
Size

33KB
MD5

840ae0a61d6cc4166f5258a398379f70
SHA1

7e57b5b59c9ea22becdebb1d408e5b7112c49b0f
SHA256

d9b0c01677a3685e3d5d264371c4e06d7d174a93d043f18d96c177c7b203eebf
SHA512

4b8d624bd1b5a023501015be6717e8600a1215a339b1fb6e8eb81c7ab5288539c69741836fda4b9bef819b5c61d1eb8c144b9df7ee91d5489349f3f912d86868
SSDEEP

384:lv6qTohLSDvJa9yfeUb6fi3OzzgQ/STZsdQoGoVBt0k3ZQGZXH8HWHO+L9okUKNY:1oMMc2Q

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423229773"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{550B5921-1E76-11EF-99EB-F2F7F00EEB0D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3056	iexplore.exe
3056	iexplore.exe
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1272	3056	iexplore.exe	28
PID 3056 wrote to memory of 1272	3056	iexplore.exe	28
PID 3056 wrote to memory of 1272	3056	iexplore.exe	28
PID 3056 wrote to memory of 1272	3056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\840ae0a61d6cc4166f5258a398379f70_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c12d08a6c5ac0d78d5ccbafc0960dc8

SHA1
1ed73466925fec933f7f35396dff5e837b0d2842

SHA256
bdc026bf6e47c4c39fb21720dedf5f39c782ea499fe8b2a22a0cb70a2e65ec65

SHA512
ed3ea9f71be88c9191880f9498a561f9e712aee386503e02a96a91230cd34361d985d0dee5cf40343d47776b2521d6e906d1d5d43c9217447bd35605ae6113c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cbf7df326cbc759443f72540b18a009

SHA1
d16297c28a8a38336a8c3a9608c02bff45b17852

SHA256
1fa8b5af6b5a9179b0ed0430d5e28933830ec25d78e079a5849878ac0aca589e

SHA512
d7e109c825553d6a05753db979cf2a0ef06940992ddd2ff3ed94eed6eca605e0c3e71d6e3a5cd544c4ce963d7c42b2fcae37761265bb45b42a5ad2d8fe7c5f2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6dba88a2f97879eb06ace4b97e1ecaaa

SHA1
19fdebeb06db8c5012c3c0a94a856ea123eb853f

SHA256
1896e11f56b76496058224dc0590b65300ae102b4da9bfcd03ce134fd9c08777

SHA512
12e8a239f27d628cf56c6a2b93b92b6a943d90656867d42b77f2bd0eae20af2ec1b6bcfc6efa4980e90e14d30ebf387fdf89ddbc0d45d0a7b04b51c8034ddada

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a63ee49df4c814f14ac987acee482ee

SHA1
f36ef9ac67889b0d7a2c29cef3aa2fb8ba75815b

SHA256
bb43e93fb6921ae9554307ee8ee9ad01145931a86298089c713ef7e60e7ad012

SHA512
9159454691d8ea59d9e4fe01d1ae2526e279dbfaf2088fce44add15d1c402db287808cc764c844d1c785d34f30c0ce1a4db017cc0e758e2bf5686d680a921d16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24b23b0e8e2fe72d8a5bf2804e42cd63

SHA1
3978fb97797e2e3c57fbee19d3666c1fb1426b30

SHA256
958958f2e8af20b85c8c3b078f12da586e24b6c97c9a5a997830df74c5f21edc

SHA512
c9c7455af636159cea7b49624cd5c169fc20170f0912ae21542b62d64b7b06c92d5060a1d4c77303437c31594065a1f95ad03f76b5c1839aebd5abf24d25c7e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
911ecf8f8c4ae4595d09051c196d7fe3

SHA1
72933064c252a82b857368d86bc1d850ce647c9a

SHA256
8f32455a47bba36d423eda33dc12bd0171ab454719c3fba6bd2ccf40e3a65981

SHA512
b309eacdbea4a2787bb5efe0f453d0a76a6d1eaf846786b2340134cc9b93d2e9100990a4ad93e91d828074597edf72a125b3b8237e4c670bf2470a828c8eba6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2961a286394753b7a4c1d46e1178a467

SHA1
79425737bb0ac0a43117bfb7e136c05494493f89

SHA256
690b46ffc763b907035ee236b79d177c429913abdcad2b8bc9dd81dca7cf07a0

SHA512
5a2dc123ee5162d976bf3816625e9ae7681aa0fae3b63dc0266673dbe492ac9bd8bec5dad46d8f47cc40520f5138799e308231319ebf7ec48f86b3358cba6da3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca4813a6b5f265d6e24b9aa1c2834fc7

SHA1
531eb42ed421e878053d7ce113af70e119e719dc

SHA256
499ad2e8d5d513081fca80271fc1df6d66b1aabac51e487c6d14f9b7a82bbd05

SHA512
7213c8c01b3e2652404f05267f0b475873fd69ec91b7aca83ca9174e1e40f99ba589198feb5a10a96e1de43c873e4ac6506569a57751577b6d65100aee0d4c2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab23F7.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar24E8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit