57b79eb1e4e078a0cdd5aa2fda58f097f15da53b2635a4e95994f56973521f08

Analysis

max time kernel
133s
max time network
147s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16eac21b29af03ca95d7ca74f0912b23_JaffaCakes118.html
Size

16KB
MD5

16eac21b29af03ca95d7ca74f0912b23
SHA1

1e48651830797841c474b7876fb39faf0b3acb26
SHA256

57b79eb1e4e078a0cdd5aa2fda58f097f15da53b2635a4e95994f56973521f08
SHA512

f2f896df512a96a4bade789c25479dfeab0c8bafcb8af3480ea15a759c24c42287fb04d2cf6720e2c40f197f9a66534d69f0e078bdb6e51d1c12c113a21932a3
SSDEEP

384:SIu+vYWcCCAydUcWTDVDwSTESs2QlsLhqHGKeYKCP:SzsYWcCCAyacCDVcVSs2QlsLoHGKetS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425672179"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFD7A2E1-34AC-11EF-9BF5-F6C75F509EE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2944	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2944	iexplore.exe
2944	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2340	2944	iexplore.exe	28
PID 2944 wrote to memory of 2340	2944	iexplore.exe	28
PID 2944 wrote to memory of 2340	2944	iexplore.exe	28
PID 2944 wrote to memory of 2340	2944	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\16eac21b29af03ca95d7ca74f0912b23_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e15b9251ecaf7a8989685dff92eed717

SHA1
19c279104e7b76caba010378d7a53a15b74a986f

SHA256
3af324acb762175f2e808b08f3c1cea312d45bc0879aacf5f3f107ec720851f6

SHA512
96a70a78ca03fff65c0cd66d0ed459f6cafafca77e432bab17ca1ea177b5cd204251c2a8119b402cfed5de2e3705427d3729f42959360105661f5e7545dbc5e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a2806ece689b4741d1ff905bd535837

SHA1
7e07f0878cbd228cd34abde25522f7b6b9e1ea4d

SHA256
82c5ee58d554b326b33bf126b746512bb4ea5aedbcb6b86916b692036618e668

SHA512
f87f52fafee9493d28248d41fdcc4822819bce0c920bf55f130bbdb2a271f15d8aa094a5302716d032f906bbf2e3d4540fce567effef5b781273640e85d6caa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a67e0f875e60281747e6ac758a87773

SHA1
6a53d46ff3682b67e728f79abb4ddc26a5ea06a5

SHA256
06f6333d7093715af32acff0660aa77bffe4ac55e8008b3f55ae58afee75801d

SHA512
1c6f7c749122b252abbf40c55407064a4c8a8926ec680876e546b39712be6c8e31c3a7af79184b0a74ae9c09f5c693352907b130c7a1f973cfeac1dc24899271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59bb74ce854d96af37cc9919955518ca

SHA1
b7edd2df6d12ffa8ba0d4e398a8602ba447faf69

SHA256
9aa8f2ef8fa41efec333f40731cbf7b9ccca2923217d86e2d23ae8fbc2c11736

SHA512
26d5e021cac38995b2bdcac642d142e156618aa6d78b3a6781cdd422d13795a55beb80bb1cb640d8e35a3467e1cb11d806b21c3175084b9b8969ad284b6b9362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cf1fb49f5580da691ef684b44a2213d

SHA1
f031f148f37e82659172a840fdead0f1b27de32d

SHA256
9a9aebef63e2a040bd151ee290d36938bce2c3c11a4e4b790c256a84336a2051

SHA512
74380a454523ff831cfa8913cd185e1d30812d8e176fb8b09fdab7a409db46c4835092c9761037dee25706925b6821c8819c5e3b42ecf4df8522fddf5c8f49b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ba683a59afd02296fbc09f33fa72c54

SHA1
4a820661200e5fd692f7681381775aaf8f57986c

SHA256
a9de410be995b3ac71b1b5c9a2d6fd1bad6c410c4e0ee4b6beca4fa36570e8d6

SHA512
5600d5845d2dfa5993b2072fc5bbe49b83b90bb292361e96389fa2375dbd366aad9728dacb68bce76517420363f4976afd67ebfd39671fa1320a840f79eb1280

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57fe0e2e94f251f902ad686cb0b2e703

SHA1
e171ea51cb40710ddaf3e3685b38c61c0a9c9d07

SHA256
8e80d4da8f12b008eb001d7eb79105509b4541da02711665c30efe76c5f1ec96

SHA512
16b5ccd9d349b4c6c257ff7983975ac3bd44e10af6e650141f0948063bd4611a61bd8f67d4564c208ceaf9ae3c8d0a385fdb5f27600d3ae6d7fb6cb07fd2ad33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04fa5bc613591a837ce58d8922f86b80

SHA1
b4a3b52e6021126a6f09f97fd89756c4e308d9be

SHA256
20962598524f31003e1ba307828146252f3fe1a9f06278e9cc23be3de09828ad

SHA512
134cc0ce267f3ba6133b98f44c133fa5c9c549f818a11dac587d2dff9ca93e57dce12a5c74eb6ff7a62db2f6dc3989ce69966cffd7020b0ab90c3d7f3a619bce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f123e74dbf4f4f8f326f0a8b694d06cc

SHA1
4f6943e108e55b55ec951fa6ec329213d45b9d35

SHA256
a16ca41971a3e7e0aea74c47dc3ebba8cac20921338b6ce918785f7eac586846

SHA512
7e1a93b077a16883bcc8d6b8fee90779574011251a14dfb7b9d37c3668ac80f3dbe1f26ffd437004b95b5b1fda88be98aa179e31e016a04c55cda2ae2c22a97e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a495ee7b41273358c0200731b1c27552

SHA1
dd54391dcb0bcbe795dcd080b78c9aae763a029c

SHA256
b7297b9bb3c5ba7044ad1489e8bdfb10cd0411fe172d1d7eee3059ac891b4785

SHA512
df4dace839063b197f3949dbe63e66ce71de013d7621cdcbeeb876b6beba0541ee0e6b744ccf0c70df63d8e9650f0300489060a1ff8c76b14a99389ee20951ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6847.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6914.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit