b0bd5b0dac62a9aa09fa16906b0e1e45323737b80f1b602812985bc41e31bd6a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

99729d4c95c6c2b2cbc825e962036d68_JaffaCakes118.html
Size

26KB
MD5

99729d4c95c6c2b2cbc825e962036d68
SHA1

f4a4ee2c8df4487abfff678ff128250b2ac16ac7
SHA256

b0bd5b0dac62a9aa09fa16906b0e1e45323737b80f1b602812985bc41e31bd6a
SHA512

9ce5c8a96ffb0fa1f15aadbecb2e9baa5cbbbb1403156a6af9bbde85667b9d26297ad19a7c4050ae651d2edd96b7ce19606aaca56a6446cecca5416426a92d23
SSDEEP

384:GWI6NxAiA0/ej2G/IcayPtSD/3sC3r3xWhb9O:MipA02Nqy1qWhpO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBABB391-238D-11EF-92F7-4AE872E97954} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423789660"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2868	iexplore.exe
2868	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2380	2868	iexplore.exe	28
PID 2868 wrote to memory of 2380	2868	iexplore.exe	28
PID 2868 wrote to memory of 2380	2868	iexplore.exe	28
PID 2868 wrote to memory of 2380	2868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\99729d4c95c6c2b2cbc825e962036d68_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42fcfa9c2e0955babf3bb0211e875e5a

SHA1
51d03af7b32615e68f1a8e0943f1861acb6ddb63

SHA256
74b9517e2e90a70c071aac097f00849a66330cfae1f20f36ab252847941ff25c

SHA512
325794ddc52d88665ca3e38125f755d88d8c8c4c05441b17fcaaae35b46506630d258917959087d35131147172adc60490f57b24067eb060009296285e929c8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea0898e52a230535967d779638c91c23

SHA1
73d450686bbdfa45d8777e968185ecd4ff8f8954

SHA256
1d807ebed1ed1f43d4477e97ff20737b5f59fb52d7876f4d0a89601c8f963d1c

SHA512
2d3f77cdbcb2b25fc15fe6fac58875385d00b01141a4abb767cdf85de71ad08e1111ad99bf9ecdb0ffbd67825a59e5c247a020155491d6410a894d7b1097107f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05a8e364ad1ddce0fa3b83254c09e46a

SHA1
b71474bbea23cd6bbc827d0da48dd8bad2b532d0

SHA256
b43c1a33dd1bc8e33e333fd648d9a615797407b64d93fed016f0f3a36299b37a

SHA512
047aff0647d2bf7eca50a221d24b3f3b61e45083d542b363bc4bbf5de6a1c702f94c163df87f516d9ef0408b700e21b48f2f8eab59679da19c6ca00d01e630c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1fc0380e1d18606bb74e103fb2a2132

SHA1
0ed8d6feb6a3ff76167982d0dd72a2abd725e2f8

SHA256
3b0aa098de4348d8515ea3da0e157a5167130dfe0fd622f074435898ef78b2e6

SHA512
c1d8f547323a12005ab71e45dd7a004f280aa722a4dff94a4a980764788843715b40e9b4b7c142dbb026694716890f2b817b36361f287d5431095b98df35f04c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d401f553b97be4de35536b50dea3ec8b

SHA1
afe1547475c6705f5e85a7c9916c78817092f4ee

SHA256
0f8148fd28d5661943f104be848cec4dc9d1d7dd62205a6d8a26f14b160e144b

SHA512
b6d8d4141f998923ebaea1ff18b9386146c93444b5995b37f87ace64569f9e57f15756dce8d673783f1e7e8985808bfee276fa11f2859f54a8d880b6c7fd3348

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65cc55229e9513f1c6789413d47f988b

SHA1
cbbed346236cab3e9dbcc44922bd1d745c5f37c6

SHA256
f6d4280cec1338519dde225068b2fca989559c14ae42c3d490ae111bff98c29f

SHA512
351e33bc4793cc794485edfc69ced08c52d6d01d871342e69defaf6475996d257bd6f1cc148bdc737415b704f86b5e45084f8a68ddbe8c63ef62d151d5cd48bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8766b9433fbe404d6e917b756ca1650d

SHA1
fd8df3acabfbbfee499d7baaa7a58d2362b19338

SHA256
52bc6d191e7bc8576ef3fb83c26086c1536125c1f41db535b7e5eb37021fc458

SHA512
0bddaf7787d923dcf269ee83340eddd8b3ed8ed027108022860cf6e172e5d09785c4595f5b59bf8b40f9d7f76bc1d944a3e166b2096580ec3378b5573055aac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97056e10af87acfb88d0476c29851c5d

SHA1
93dc324b07cc544712910773d778c926557769a1

SHA256
9a9650df00bbeface68f27cc64671b89041fd13325ed31405399cf08c2414567

SHA512
5c831a8cd8333bed5b1a3433cf46f0dbf3490e1fa2dec8574a004d9da8d32e406e8f1a1fe02b18285da828ef6643290df4f80475ef287985a752ff8569fba3d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5cfb324bb4854e82b5c978c41d7b760

SHA1
9f3fe55d5e818d3799cbe118d670254a4e923558

SHA256
1ff4319c962339b92d63f68e091bbb5ca0f4e45744294a54b82f7e7a52d8bf8e

SHA512
d305111359c299a0583ab0e309b640eb24c52e42f04d0647bd68e2c71301253238b603f95a0414e21c4aaa0e2d6efd89d5b36b16dc89eb055f6e60fb01c86eeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d69d57806515d6cb0c55682b4cfdb75

SHA1
7ac5cdb83be2f2fb16c394b1aa206e8447b640d3

SHA256
1ccc7a75685a107815ff27a22e87f9e43378e129b22df54c4d85384b0f193771

SHA512
3af19f9c5c412372c977655a3595de5f4b8a8a11c9252a7b8ec8000cfa1af0cc1625e70ab4a2f3f4a6d23efb4e04a3f053d7619a2dea4c32f94b7bca64c0ebeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3306976795f0c5073b62e91ffa1c9fdc

SHA1
cab59833b648c990697fe4bfbf850f35ebcf34bc

SHA256
ec018f9f8e002a0927b9d529842c19d541a97de1e118445f3a7dd62c37d0847c

SHA512
8c4583edf3866f73a7104131ecb6362c1e512c80c6fc190e8e19c77fba97029293d51fae23e989f607364caa3abfae1e4e3e0c7d7872b0107404d77207eee647

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab62A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar72B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit