168809b7c65a8bb91a4e8c4896079688ee7a8bcf01b08cc6e9d298124c81d2d5

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a19806600ef75612c54d5950ad8b5540_JaffaCakes118.html
Size

34KB
MD5

a19806600ef75612c54d5950ad8b5540
SHA1

52a048a024e28ed42e8a1963115aecc838a93eaa
SHA256

168809b7c65a8bb91a4e8c4896079688ee7a8bcf01b08cc6e9d298124c81d2d5
SHA512

e928a906f59be5f13e39cf8aaea1e6aeeab81469b2df9357a975aa7164487e5f2a2c292fe3f1f990ab08c46fdac7f412a2e7f76656261899b69be9f2b1d79995
SSDEEP

192:uwXsb5nwmnQjxn5Q/nnQie2Nn9nQOkEnt1VnQTbn5nQOgjcwqYmcwqY6cwqYQ8a0:lQ/oj+U58aS1OAR/T/44

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F77D071-28E4-11EF-A965-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424376493"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2868	iexplore.exe
2868	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2080	2868	iexplore.exe	28
PID 2868 wrote to memory of 2080	2868	iexplore.exe	28
PID 2868 wrote to memory of 2080	2868	iexplore.exe	28
PID 2868 wrote to memory of 2080	2868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a19806600ef75612c54d5950ad8b5540_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0840ff1e57db12e86f0846ea211daaa

SHA1
d69c87c815365203cea44851bc474d2c9ec181b7

SHA256
2d1b65a13bba13658c0f1ccc60c70244840444673726210cd5f2f9f57e6d8c6d

SHA512
ffeb71402dc5b635c3041bedd3bfb4285d35853a9cb13b06fb15b3657c096a331de6abd91f0d174ee95fa6c66cde3bac8b7ed04aaac3893d6adb66d6ff697a89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b8e2708235fa45e058756083935f53e

SHA1
ff01a1b7f749c14782eb167ddc87bcd0362b0a54

SHA256
b27109b05a57da8c9f0202e65ed7d8da4a7961ceb862435c3a0c9f07e988f8c8

SHA512
df89a8f3b5dae058c6c126395a5c1c9461cd520a336b46faa2f514512fdcf1d4150b37f350b140a09e49f54eedd8a408be30bd2254204d6c5ab6e2b8b5ee3f5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7984d19e62e76cbe332d1f6df319f137

SHA1
ae76f8b16a232f0d70def5726cf349bb7934e754

SHA256
e877f855e432cf337fc5f3d972265b19b5631ec93951224e5baf44272debdffa

SHA512
bd3dcc1b10e9dad1b394ae005a329e04a2b5820004ec2490107aaafba65b6bd4285f7126a012fed26a5b95d2a511cbae9d9af2ef7bca3b096b97b56d122100bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a438ac576f7fd44390077b2c142860ee

SHA1
18cb2364254426607090e3652456446ed01e9508

SHA256
a41d35ced04dff835a92cac0e4f105edff9c146f5e05680a8fdc502054df25ae

SHA512
87c2142f6235bb8856e946b429ce5219b018f7e982df0034d60222ec91e28e0e2cf8fb5367a20dac1b2ca9bbcfaf0c4236507fc1a3dd8558c93710d75bccd67e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
711cb0a4ce77f5b6833de6f9b05cd690

SHA1
ea8ae7e5a5986e0e372c24d0a34bd3c82c64966b

SHA256
b1ce59c45c35d555ca1acd128ba02e9d2844e6a804f3f0215d944cffef34c077

SHA512
0c08a5d0f865417597f978c88bedc7c31b9333ac05de17fdc1bb767801f90ad1b16d8dfe3629820988037179fd2fd36f270576a1a6a8c6766b68322976f996e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d0e94060e1d1f5f4d38a81d3f0f8da9

SHA1
7b2106f9588b467e4e9cc01163816d351758adfb

SHA256
3e7444710afbf9e6ccfebb4e30a6f6e08a904b63e416455d3793fa08448b09e5

SHA512
b119a11fffc73cb2b910dbb996f6e948a9e8740ecad40b123b1de8605ddebfd96c54fe594563d35ee5e6a45a2c0ffdffd2679f8ceaf3becf1146d59fdcef0b7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eee6d2d7ed1b0c98760f3f74f5afa0ff

SHA1
c1ac7dafb47dd5a88023e9ce3e1594b709e2c87b

SHA256
a295be3d83aac88f713eacd48e348104ef770dc6d251bebcf535edda6477aff1

SHA512
02da8e31b55aa33698a976a8e3ff5c792c88ae1765d4b8cf4c2134a001882a15710ceeeb9d5386a56758f239ed9fa11de18cc577c841f381546cb4540186256c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5751aad91f735a7ab692277747f1ee40

SHA1
b601dc892677677b396dab52ba6551c112ea535f

SHA256
7d0b4493265b9f2b4e265cf52f534e67f143ab11ba6af44fc6a70a4c56c1a16a

SHA512
999d7effd7ff46c8dbd8564f47d3564dcd26d842b4a730f1518ae2aab27c95b3ae3a6087e434edf1c686e43d2e5c6d331ae813c7a68f41c33e950287847785a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fc8e6d6a2e776f735587feb068f2a63

SHA1
07360d9e0086376657e8dc78dd0d66facc47c0bd

SHA256
7821175103b10be47098872e90e7f27324885e8b4f93a669338a4c70ebfc7d00

SHA512
86d076f39b2f4ae30ffca76fe4d09be22933b6ec6a2cdd2ea1ea2617d8806f19aff6c8961be1c74a3f8e6013810b0bcd15de5e4312691d483b297b1f4274ddbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1788.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1879.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit