44f673c74b2694bcd40470ad6398de83a5c4d78a8e3cae4dfa80536d60b9c6dc

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

299004a4b76fa369d8918c1e63757f87_JaffaCakes118.html
Size

18KB
MD5

299004a4b76fa369d8918c1e63757f87
SHA1

ad798e4a81fd734fd562c341a80a6e982f155bc0
SHA256

44f673c74b2694bcd40470ad6398de83a5c4d78a8e3cae4dfa80536d60b9c6dc
SHA512

4420a5db76b15b0baa4535951df1bbcdb6624790ee7b724e184b18b3ed40e949503fae06031e0b0503c634dc3d41a891f11faa53406ec8a31359b8f5de734702
SSDEEP

192:nR7lIsrL1u2Wtx4+A5GTHzihnzp/1VAdm5ip8k/w1wvqLkw1u0vLuBuLbdU8d:R7lIcitx4p5GTHIp/1VY1D/gRu0zguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD75FD41-3C17-11EF-B166-DA486F9A72E4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426487653"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2144	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2144	iexplore.exe
2144	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2776	2144	iexplore.exe	30
PID 2144 wrote to memory of 2776	2144	iexplore.exe	30
PID 2144 wrote to memory of 2776	2144	iexplore.exe	30
PID 2144 wrote to memory of 2776	2144	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\299004a4b76fa369d8918c1e63757f87_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
893b7126d9143180f516da3192a89d6c

SHA1
c8021ba6b8798ee896020e3db0746a4205f9edf9

SHA256
6e85ed2daabd81c2492a5f9dd1b699217a29d33c6d456f1e39a4af0eac628ef2

SHA512
81313ed10363a103861712970d0e5c4eaa73a80513f7b1cad6f446891d9d14cad28106d9565d49a325e081c915646f18a8fcc7c7ed4900a7e53dafbeeb995f15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
929e0b71c7e7d4386a3d4d9b2f22b99e

SHA1
37908d19623db80fa03e9fa58a008a760f7d2713

SHA256
2006ac3df110dc541d2076dc02e6ee552a0f395e6fb731298dd30b30116fb9ed

SHA512
621033f6b1912b1fd8ee64865e5dd1574c1da5591f7478b5ae3a3fae92a6bc75d55b932566660254fb476dbfd225da3e9043230702442a0de205d2029383add3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3da4a835b58c002e08926e37a9905fb6

SHA1
bbf9b3c75ecb5c9e18459c4a1c6db1bbac82d5b4

SHA256
96ecf390aeb37004046562ec1529bcac031377766d4806758b44a20901b9c42a

SHA512
edc8f877bc460e33a23fc900dd63859a717be19dd76bf757eb402020b4d220c112fb8f56cedb6ff11afb5912df746b3ddc58d8b80bdfff64ce3ae128ef7c9073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94a7297b74982d3bbd41bb58cb230008

SHA1
b41a18eb2da5e4a014d45f8974a267ef57c64b99

SHA256
3a8ffc2d239e84b5c16ade67f6d78bdc623d866f9ca74577a241edb9067c0bcd

SHA512
98a01a6fbcead6b499f2917ac1e3616a4047044c18cbcd7b361e858d966e62a3ba6db7a8f52c79b6686e05c166b4676b98c42facc89cf26e054f2d83f20ffc6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5325b38ff58c9a270e3aa83e54b1d668

SHA1
5db1267808d985f3d4173d32b1feb516eab70acd

SHA256
cf1754aa7768cbd6cf964bc35412c8d105dc3099b0114548e97bfdfba6be7277

SHA512
608cabdd2bc9b56febc8c8c7954b302eb9db6e501999a038cc8860036269d0de821f515c0c7c899c9a402ad79512b7f69d09b164d337c817abd1cc70ff679e84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
067459f5b0bf3d41b7acb1c0f6bbf582

SHA1
738e78b13344252174b0fc8f50123ad8cb7c4da2

SHA256
9b260ce960aea66d07153146da2411ca241090f9ce16017911a0e685958237a3

SHA512
8aac4be6735bb800f23859e57883057de3b42e8a1b37c957069aa44404bd163f27867bbcdb90941627b8f9988322706468938ff422f510918e4a2ea3b94b1225

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a69b371efd39c06d8a431d5ec1a6b002

SHA1
4b095c1d4f8801c1cfb3b7d1a92acbf215540144

SHA256
59df0f2b57a951acf3714ad82e30745670aa721fd767897602237f17308e82f4

SHA512
6275ca2a2387c2c3eac4a5da156a6d1f4d48284f2392d258bd41cb46fca68dcd3a2cb4f9e0f99a31eac735b66514fa4a405b49773ff0221b072a1e38d6b2965d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77b2bf618f1ac5fe62143df0d01330bb

SHA1
61a55bc3a52de07b11544d00e9727cbfb225a972

SHA256
250b65101cd0fe40f75d2235a18c910170fb63e1443107e7fe4a031a58d855db

SHA512
a18314bc18df72d0a1a61c278e2bd8b8ebe0680d2751c439bcf7ea45e603cd6d11c73b5e6e50cf82d519a18d500372a35f87e4b02651a5c21d45f43f85f5731e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
652c94e96cdf9be2796960dfe9b4e1e8

SHA1
d89439ec59fc415647f87af423ef03df90464223

SHA256
c9a3468eef4036f5164549ff21b19f346a5e920f50b47fb8356380e868021025

SHA512
dbd017c8b31091dba0fd81a8ec01cd9adcfa725ae4ea4d3291731a977971bd533433939e44e3b354cc43ebcafaeb0225847f6f564bfc9cfde27476aef044e0d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05cd9e4a0a4df3bac01ec6b61dc8ea11

SHA1
00ed5c9210d54d1342109d585af447f7f3a5263b

SHA256
6042260af131754a06f8f3e47a2993f1ca97e6b390b04de18a6dc77fcea517b6

SHA512
ee09806afa5baad85d4ec7324145973e02a19ac8a406300ce8a8dc7efdd0ab2e77ebc6aa488f92d62222081d5dc87862297cfebf571a54fe2ea2975c0d4671a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11DE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar124E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit