1de55a8824cd7b8c50d83772863db02168ff004156625e1ff995200aedfe9aa3

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

980171cd9ae0cf2584c16f19d429ba6e_JaffaCakes118.html
Size

20KB
MD5

980171cd9ae0cf2584c16f19d429ba6e
SHA1

74ef3a22f933714dca71f63aa50ca82ae1a2f911
SHA256

1de55a8824cd7b8c50d83772863db02168ff004156625e1ff995200aedfe9aa3
SHA512

2b20744ba263cd4fb67d96db2c29a1ca11fd29327ce69cf4383040b2915ed47f8afa91964b814608b6ab9618225fd47f47f63a188293ccf1513c1672c47c062b
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIP43zUnjBhRr82qDB8:SIMd0I5nvHxsvRQxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72D72991-232E-11EF-B023-6200E4292AD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423748655"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1580	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1580	iexplore.exe
1580	iexplore.exe
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2344	1580	iexplore.exe	28
PID 1580 wrote to memory of 2344	1580	iexplore.exe	28
PID 1580 wrote to memory of 2344	1580	iexplore.exe	28
PID 1580 wrote to memory of 2344	1580	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\980171cd9ae0cf2584c16f19d429ba6e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1580 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4faf9b45945da7ae16efa7064fca5ae5

SHA1
fc670a0fbef4abf68519a3f6dfd984861980a7f3

SHA256
299f8b2ef0b06ab2beeb2d2f93750553ffb85631f36342b5ce100a8d3423ed47

SHA512
6e0ee7590610b345ccc605c543f2a33c1fd5d02506a409cf7471151e2604b5d3e1ac54f430dc122107c2c38ea06495e366b284f0f11b6ad6154ad4f5c21fca60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be79b8d26baf7506ecf425486058fa1f

SHA1
f35a132b0e3f340916733342a3644fdf49a9516e

SHA256
d694bfd85423ed5fdfccd5b8ab05019491268e7047cc283914e937531bb76342

SHA512
ab94bf095ba00fcb58ac6e392e78da3fa2497441b2272fe2925a7c9b6396bb789808a7f625b10e715f0abe1a2929e5efbd6bfdf4d081b3877a17311eb1f69c34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7669595e443a6909667722c53cad0e70

SHA1
912bd01080850af6c92c0683a472a887a5efa136

SHA256
1c91cc138d6dbff080bc7fa00a423aab35cf7df1e96f29bd88df9f48dbbeae84

SHA512
ca66578c7d83840eab089eb6a5da4d6f34020bebb055d09bf4319e3d27bb115ff3bbfe6537159d22ff24ee57e8e91d4cd4b44ad80d9ac4c1cff681175294dd68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de62237fb2756fc7983b7634ba678647

SHA1
68a6e6dfde19ca4d9dace2d4fa4881558f503609

SHA256
bf566d497ed1dd4fb0ffb7b2657f2e088218e4619692a11b83a97e1ca2de7198

SHA512
6dfd262b0281d0d0d1f92bdfc75795c67d1ac10011b5f5c08373c9630ee52a84635ded8af14a919f4795dc82cac7fc22b295f8c44350429a8253beb4984df0d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5b0153ee64cba86b0ca2ce1483aa7c7

SHA1
dbe988b0245069a4e4974abb4b75bc643c749b6b

SHA256
244a70ce9615b2612951783ce19955b2f244a08666fddfe0bc2314349f7a3028

SHA512
fa78116054a66ecd829fd67b5c725f108e54a5b0215967e84ee3075a1087824b4c97a04200fa63ae06b04ef5003e4f1eb6b8ae93e6ddd356dfe620a3f6328c85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db3b2cc66f640ab5da7caaab8acfc2ce

SHA1
203b24a2a71c70a975346b8e9cf7a78ce670e886

SHA256
58af0a15e9d02505a4794d2f140d2560ec32a6e233a4872151093d0c86315272

SHA512
453f1d08bb0570f6df10d9b73bf543e70e96e4797b1fc1acc551a6c503a5539ecc833909f61d0aab3238477f48ac43e3888bb93ac8bd47ddbdcfdcc8d528d517

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59c9e18e4478799574ac34946e0d93fe

SHA1
7ec11524b281b6e0c2323f590269cc005301df8b

SHA256
c0bd03af427c2e5aff9f4557de3f41588d60f1d40bb870b7354d49e3e1e19639

SHA512
f8eff65a7a2698903dc29272b45804768fe1668b95c8595168a72f1995e52e5fed0595c1c44ac5d07458752b8bc62d771c5c8203a6752309c47eeab735cc88bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bac9238ef66f39efaa6500588fd99cb6

SHA1
e8c6a9dc8e5ea944b6241e35043a854018e6851e

SHA256
002e2512c4dc36da0bcda304d9b4f1031f75e2ef39989256dbf2f26381e74bbc

SHA512
e56f01fb6c012d85162c99d3c09c2bf41192772d6048ca77e544f97673a681f97a1c921636d39275e2471a8c15fb05ce837ea731ada30b3b6c1e6ba329c9b206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edbd6568bbd65282d7f9f7d60f4454d5

SHA1
1f58b5c0742b37a17ac108797a9ee81ac270cf00

SHA256
d399fe1a55321b02422de4eed91877689cda85e0ebb9feefbc53b901464d0892

SHA512
0a382169f67db4eeb63fd6d6ea1ad4b64dc9476aa26e4c300318dfca7c35ece8bcb0f8b66783da25ae69885b624480834ed1651b911077c99013a536ee3d19b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab143E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab14DC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14F1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit