4bfc1309bb643da48deb0273cacd53c147951f1df6c60affe0bb84537ad546ea

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2770ee26a9fadd323249b560f17aab4_JaffaCakes118.html
Size

18KB
MD5

a2770ee26a9fadd323249b560f17aab4
SHA1

0c0ed73a552a5b3719de1ffce3dc20b051377b68
SHA256

4bfc1309bb643da48deb0273cacd53c147951f1df6c60affe0bb84537ad546ea
SHA512

c92e665881bc68a9bc209b207a2dc32ea36df97969df959c6c1ca1caefb7ef562ef70903be36d77558a66f509f0a2ac60dd05fb6d77257a473b2ef6133bfe728
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI84ezUnjBhiU82qDB8:SIMd0I5nvHvsviXxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424389644"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE056681-2902-11EF-A296-4A24C526E2E4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2784	iexplore.exe
2784	iexplore.exe
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 1984	2784	iexplore.exe	28
PID 2784 wrote to memory of 1984	2784	iexplore.exe	28
PID 2784 wrote to memory of 1984	2784	iexplore.exe	28
PID 2784 wrote to memory of 1984	2784	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2770ee26a9fadd323249b560f17aab4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
807f72ecc2aae5f65b3d3eb774c70ced

SHA1
1211759a27a02604d8dd3e941019d9d709be9472

SHA256
e136e88dc4c7907bd6bf7f85878f154ecb73647e59841b7580df5f72df79a81c

SHA512
ff3c63ac802ff4da253de65a8a11da9b971c28efee5aedf6fe263ccbb7537fe1320d226e350d7cc76a2613162d0e9e8aa74fa1618c7d3a6f53197f320683c5e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7febc1efa28baf909f31165194ea0d0b

SHA1
c05461a518572d37e85889c398b1d0480a5c4d01

SHA256
4b8bc8539cf9c4059de8557ecab7e556f2da0e3bc93f90ddfdd60065b795d4c0

SHA512
ca4e9bd146e0ff0efc330e6867d2cbcc8bf4ac3e3f3d4bad709a8d64fd84ae534d1b1840a3a94e1e6e91b959b07563506620d1f4e946b9cee1c9f52bac10ee37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bda704cc9b017bd38ceb5b7c65cf7a0

SHA1
99029c8371e28dfd67ef142e1e6e3e762af88597

SHA256
62b20aa08ad62ca13083a2cdffd1b1e621cbe586b75059fb4c3303d085aae6d9

SHA512
7397f20a34d284b230c6d77024b1a0221a42c98591e85df1fc80f53edcb827e8ef9845e9160e5eae364082e43ab8b058059060a34b3ddc53d3aae681637e5a31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
928980d9b7353359b8e3579338e1f625

SHA1
dcc0edc308ad49849e57fc6b235c3f76d83f67fc

SHA256
9164bcf0f7f27be523143d2102bdaa2a88259fb0e9ee15861f397b277e126383

SHA512
71cd364db1d6c22122af5a411840ab363032af6171b25bddacd5725afcb41114f7fa8f61bb6d58b479c1e35a46b70e71081547c334b636ea2feed38fc9f73205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20447887372d3f74586db7cbdf3bf273

SHA1
80d2815fda3a0a8188e81dd3acbdfe4d8d0e44e6

SHA256
11001a5434e584f7863f2e30452d1ca76bdd9691d82b2cba14fb53cc2480cf7a

SHA512
59b609294f06185633d1292dd5307ec512ff23993ee4c81052685da890b074bfa6db047d5a11d87306dc7b2907367b3f5a587d584a74344312ab6d4b7301946e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41a96d9541ee1166f904e5ec3bc33dfd

SHA1
6ba842200082c9f577c570c7ab87e84b55bccc6d

SHA256
ba0dfce5f4cb12554ecd322cae28863532cf0fb456585d0347e58838dfdcfc38

SHA512
a8b12e56c8849867f43d1f1dafa4d263119459cef584c7d2f6661a1bfeba032c7dce871462256f173fe5e28403d7356e03bd2241bdb032af1d41b1a91eca9f1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c06a1e859324276290a652b1e1a98bd0

SHA1
50a61f2cd20928b1e3fd93349a0717e77af91a7c

SHA256
7b48c123f373473344df305c492e65c12016ea13a6d199d4571b56801a7d9cd1

SHA512
d12b2b22296d30b42be1cabd21f6f3fac5cc968ded5626bc79d9ec14db424b6eef8ff1c97156d2f8d549855c46900ccce468798144bb0d9c608375978aa9ac9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ed9d23b5f142a828d8d330d4c655965

SHA1
dccd10701a0b97325a3d4f6e3e9bebe3391de81c

SHA256
9537ee9891f7eb3cdac36802e364beca1ebe9e6d4e68b173d20d253eb9269367

SHA512
21a5227dccc4168cf5bf3f2d58707513e750781810ef60c231c70985d10177c80fbb0579e7568853811b2d04ea6ad7357cfffb99309c65d9d48f97f879857995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a38de4cf3ae3118fa9ce40aee5f53db

SHA1
f0c6727a64027c870217f96b671fe62fc5432b43

SHA256
b6af7677c0a7342ffb39d520bb5e1da54057731950fc7be7d2d711c4b1c6119e

SHA512
a86d0e359f6ec7dcf1c677fb427b8ca41817784e11fe66a5293d6b3a44926454c16d8701535387b0a1cda975d5bc1e8d1dde6e560e11d726d0f5dc32b275ee00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1631.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab170E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1724.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit