7c6c3d019376077e9d24f6062ddcf22b834e3fa27a724015d898ae3a98ec9b88

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a2151c20877bf5eb80fb569ac4324610_JaffaCakes118.html
Size

26KB
MD5

a2151c20877bf5eb80fb569ac4324610
SHA1

8891930101b7e644cee4437fda54fb18fde6a7a0
SHA256

7c6c3d019376077e9d24f6062ddcf22b834e3fa27a724015d898ae3a98ec9b88
SHA512

c8b6d0f6c2f0c7951d27ae1307bc5f07157e97a6ca7c7972c881fb97d8905361c2d504135a033cd0e74c1e8a1922263e40a50a8394e0d6004b3c426ff15868c2
SSDEEP

192:uqUPrSb5niCIDq1nQjxn5Q/znQie6NnHnQOkEntV1nQTbnVnQwCJVevo7NtxFo+T:noCyqeQ/UygcicQq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424383947"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A60ABE1-28F5-11EF-A564-5267BFD3BAD1} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2468	2000	iexplore.exe	28
PID 2000 wrote to memory of 2468	2000	iexplore.exe	28
PID 2000 wrote to memory of 2468	2000	iexplore.exe	28
PID 2000 wrote to memory of 2468	2000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2151c20877bf5eb80fb569ac4324610_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
58c31abdb68a0c96302ee425bdc48ccc

SHA1
9f724928fe3df32ecefe07aa7f524eb26bdb9647

SHA256
0e4bd2ba7fddfdc97e503a3deef905d4b84e2f4e100431f59656692c085d3139

SHA512
7c30a6c3af0be43dafcbed8f31190ea6362a0c8d6e0a08aa6793b236ccb8aec3f8d2ac1b66e98d4045de92a540b9766da21f0a756ddeb2d63923e13db9ce1f04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2f0f74679a5d1984a995a943a2eb3cb7

SHA1
22d5185c14fcbda0238fd35376fce9db05f3b201

SHA256
e28a2d2eb155577f7ef560e0ff42efe2a0c3cdf16911292d8fe4e1026ccc5402

SHA512
3428cbffc2f672b06d7df7e716252208b8be505eb05a28a123885e567a786004002d7c042b8beb8b7bd9b2b612b0aa05dc755fa21ba1879d201967a3e60a68d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3775782a8a9db81d3105573b11b02493

SHA1
f80a6caf4a57429cf1e98181eab94b415334e27c

SHA256
dcad1cb4871fe8b878141e1cffdc08c9699eca1a34c43539e061ea3548ca8ede

SHA512
538931bd0b9f623930767180e6727de016f66bfa93617402f345811a6897d302dd2953197fc2523782391189b150b6138dfe3fa1b62f920299fa4a35777f9a2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4b7b07d6d7b370f625fde29036e77b53

SHA1
2e87179e15b1fda08decabd5016aedd6d49b0e5a

SHA256
58041332cfb7d9675d15931ce6cb48b11df48dd14008182fa9523180786db4f4

SHA512
8ccb8036e08649712a267b6075bc45a7f58d4b3e2562b77a538a0f21b958d0040a4b64c3d341dd236eac1929c976f45f49724ef2c70ebd9eb765d9e897ecc769

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fa9b81dffc9527e3190757eb4897c9d2

SHA1
8c0b218a6607244a46ecda0c1143e5749ebb14a0

SHA256
2a88861fe74c2ae6898a0d72abb1ecf8768abbd1ea5d44f1b20050775d76e723

SHA512
6e7d6d5f03da2edb88594dc688ef5a744b8f1e91cb7e06ddeb7a513eb71bb42aac083f8e62912d7a3010492a6e418f7c4eec6be7123eb3c7bb7f746d9c227fe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a9260fb4f7c68004bac3b319dcf34e5d

SHA1
15076d9d342b1188644c68f55adb57d5ccd7cab3

SHA256
d50cc4d764ccc5e70f195541d8a1ead1138667e953525edf1d9af2b55a023fa9

SHA512
a465b685b6958ee5a05db5c8c7cc6a58efad72cb2f2a4465da84c49e377f3f9616af4acddb6b512e80cd55eb8800a8f1fb121446d5b2c8692186bf58c1cf4757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8b62ccbdbde224d7544317dc08f5c22f

SHA1
cc455ba92a8c9c3cee9a77951f44027c25f55ae2

SHA256
b5955337210fd7f9df33fc2174862dcba8fc3ebfca941a454ce5ee036c4f072b

SHA512
43f0bba890ad52f43d8499804b95aca33a09120813165ed6d04b2b433421cbcf4024fb42365d7003d4334c129f6b9451a72c7f4a42b1f2517d9dc959467fe63a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a0fac8489ef9c614efb4e77383024748

SHA1
0049a10b16fbc445640acc89590adc83b1c6d94a

SHA256
ea2c7941b3929d1ad4dec472d7eb608e115ddd879c48f4f3113bf5ea8b862131

SHA512
293f310ae6577019931f9afe125f0aeaf8895ce15cb6527af014a3b34e125b5ade0f39975315a7546d02540011c87b5456a84f9c548bb46b911b287cf9b1467a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8cb28e491cc9f4c37ca3cc3755ee1f19

SHA1
7004ae202719d1a2bf26bb5525eec6c723bc12fc

SHA256
b54d030e139265a35cb6ce5f47d19cb1fae42076ce1d29cd13d42bfdefffe651

SHA512
84272feb828aaead105f9061a4bd7bfe2f6aa5bdc42a8a9d0b2763ef7c7b9322b16131138190e51b0dc15d7ced0f137592d2db4b1df03d73a72ecd1e10ba74cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B35.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C14.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C28.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit