85bb43348e6ed04a4ca27a3d0963d9948db4e353e548e8d193f0334db670d3c3

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94daafbebe57a790aa498ba78df49870_JaffaCakes118.html
Size

18KB
MD5

94daafbebe57a790aa498ba78df49870
SHA1

93f9d18233a23960291c1586555d77d626ef1c2b
SHA256

85bb43348e6ed04a4ca27a3d0963d9948db4e353e548e8d193f0334db670d3c3
SHA512

3121312ca1a487ac7173e60d258bc5b444f36c1b82f3ebaefad2715b952efdbbaf3efc37a298c22539ab824339979e0af3a9fa789d8f706319bdce9d2ba900da
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIe4MzUnjBhwK82qDB8:SIMd0I5nvHjsvwJxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9FD53601-226E-11EF-9C59-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423666268"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1084	iexplore.exe
1084	iexplore.exe
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2308	1084	iexplore.exe	28
PID 1084 wrote to memory of 2308	1084	iexplore.exe	28
PID 1084 wrote to memory of 2308	1084	iexplore.exe	28
PID 1084 wrote to memory of 2308	1084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\94daafbebe57a790aa498ba78df49870_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f9dbc3bc2eb2cb1ac03612c6f52e910

SHA1
0f7a38ea6d941d951e4491bf321f18c7cd8ffb3d

SHA256
9daa41bc17116499f36ade32d664066c2ca8878ba51b1fc5098ca4682da8f44f

SHA512
d1657662530b31c8a02b2f0306070d37d42352fcb2d0cc5a8af4cfd0c05f59401188bb86fb3af93d99c2c9ff733d658a996e49c4266c50d98cb754f299bf4321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4955b035bb1c2ab6dca71aa7d7385a1f

SHA1
bac07b6d8bed5d981f2d65c1d8780ed23c44ea1c

SHA256
50c7c0bc453a2d526c7806fa156c652ccd189ffc30e8af347c481e393c748290

SHA512
55b64712b3c8d5b6b0cb0c3aa9fcceb7102aac63b2f307969767c6dfe36270739d656fa2c229f6aa5412f0d7022e5a508b6a8ed3bca018f5ce458d501672fd51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c47cf309f38fde7254fe9bcc9215deb

SHA1
d6325383ad8543211bd283075aa2fbc0f8606450

SHA256
e5c812ebf81328f0f6eed75af820f23a6d2106da621831f85a89e3e5198ecd37

SHA512
5639012be8f615959182e497e72a7779ab27795796727c066437ff9c1d55db1b15e80ede4b4d15ffaf47f327b6ef5a33df9b7bd7087f4cfc692ad0004d32ea0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ec5d2c6e522f22bd7e2eddc91af3a06

SHA1
a02f2d54cbf3568c85a2ce8bdb7b2f9603e61a6f

SHA256
0092406ac771dc9da8f155436a255fc45a4a17ccaa35087ae4932fdce4ee659f

SHA512
df0c4f8bd6d982ff6580a174a8ee962c2727e1dc1a729908f80de077c31ed5a4f424170ab1e9fd07385d63b7cffbb176b769844af91630de5b1d0ca8916f07b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5bb3bc92022cac59cfb6244f483c30d

SHA1
6f1d9b8b890ffcf5fc27f01c75f0faa0b398790f

SHA256
cb822e7b8865c0b571f76f3d862d30babc8917a232299a5837794e2a4b9327e0

SHA512
020182897072e6aa63017e62dd08ca1582dd468ca919e3c0a6b185562765527c47d5d9daddfec4475aec5010b1a6e763214f466657970bf009424065383fd03c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
babbd81703fbfc879d6c1ccd7ef316c3

SHA1
93c83a3f0e2a6f35a6f90cb7aa9150a92f228324

SHA256
8af0ca0fbfad5ae64a3632abb59e8340215282afde184534174f4ca6ab52b2e5

SHA512
fd010ab9a80e0d40da9e85aa2aac3833cdaf7c5462bcf7479222869b5496ae28a019bb96231977e7bc1e326dd892724a24449cf60b9e9b5c822e836f8ca91352

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d546fa04a176abd837bc93017fa663f9

SHA1
ecee85064dd34a081375e124a740bd4cba481e23

SHA256
c399b3a1ca68b747a3b9765a7130c936d22e0c689b2dfa568027b8ab3e2858f8

SHA512
2807e1d4529b99f8050e930a4055decc7fc4c767e80e730d8d28fb466b115f54551effd835fd9f1b83fd96383f119a0551f2dabae0e2aeaa08abb36ad72ce685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19860747332e7823c3a45bb64b9292af

SHA1
849a4b205996ee1a21ed779fd1ae548176c53e0e

SHA256
d50ab5c9567a729bd7ef544c26e51b2c0221b3e1d6418c84b3a61a1f5cf8cbb6

SHA512
9598977ff01cb6cfa8159105e26fbf87a0e04ddbf76304a72b682a49acb66667f4e4d90cacf623a068bc37577cacc1afcbc060cb60fd26d396d8575469998a0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
307262364fd50da9d6de715474ce67f2

SHA1
6de5ea6cc6183703a1efcbfeefcd9b6155e58e89

SHA256
f64e488a837319cb8080c1ea5cf9ce4e548130ab42012217cbe3e48b5611e2d0

SHA512
f09dc9d17e589a855892a3c291e4a39403eeef65873627c9784298aa379ee5d9476f86e5aab6cdbafcc3874b7092e60b5976aee5e2af0f48c3bc211f1babf730

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ddc201f92956c3fd2027facb7705bc2

SHA1
5fafcecbe29db8ae21f201a8c0ea56c729142d4c

SHA256
d653316b762dcb13c1030647c7543a2197eeccc97b53adc0b4d2880e1b8a3d4c

SHA512
7155a9678dd2d39b28ac6e8cd1952a7a560261b7045eef1bcf688efa6c07b15f228235534aa74c86f8e7b872c23bdf1359d45bfd59a72eeb0aa52c6e2d605b16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab934C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar943D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit