21ce41e3690b6be9571da1d63fecb091813af448272b7890fc1c8e7ddff81ca7

Analysis

max time kernel
68s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4308db2833fd829343072bc6e30b3461_JaffaCakes118.html
Size

12KB
MD5

4308db2833fd829343072bc6e30b3461
SHA1

92779596b97dd6d00177b3f19dd949f5913c0353
SHA256

21ce41e3690b6be9571da1d63fecb091813af448272b7890fc1c8e7ddff81ca7
SHA512

dacb3ac8d0b737f54c41cc91faf4aaf496dd6d14db91f094995c90a80ce0fea52e3c420dc926d1d5e817d97a085d5c83e840f0b416eb4750dc5f82ae21408e85
SSDEEP

384:eEfOasA0dUvP/yVSvqsAHNtgXeSXRXsc6YGtsDiwDFF3hXUQ20bnvfEjCI8Qz6bw:VONA0evPqkvqsAHNtgXeSXRXsc6NtsD0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2EB72601-414E-11EF-A76F-5AE8573B0ABD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427060821"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2452	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2452	iexplore.exe
2452	iexplore.exe
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 1300	2452	iexplore.exe	29
PID 2452 wrote to memory of 1300	2452	iexplore.exe	29
PID 2452 wrote to memory of 1300	2452	iexplore.exe	29
PID 2452 wrote to memory of 1300	2452	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4308db2833fd829343072bc6e30b3461_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2452 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17da51e69cf526978bb4f11387df8382

SHA1
61efbd0dfbe55581b30b96d0d2f28b79f5765b29

SHA256
59b4125ab852a1730a70ada79107d47045d37ce72250111a0e018da13b5aba80

SHA512
3eff7bf7302c330c3e1384588a27595905b720dae657360d048b176e676554144b307076177dcb66ffc13c70a392bacb66318934ba89bd142c47221b4abcdb90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8919db4f1b9f3a74a999dd5c0ef26b6a

SHA1
ed727db1dd9ca676f929995cf975d6e33947ed77

SHA256
e1b5bb8449e96000eefaf45dbcd62302bbb56c3d75967a84326a22102352f252

SHA512
cfbc7bedeb438f06c801d476917aa5c0fef3a80ab2aad0f1dc1ddcd64105fb668ae8e889830b8f9221a9d003057345a150326277483569a244e48d642a5a02b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6509136e9eb7a51d45ee2b1a32b893d

SHA1
ff3500065bc0670834e103f0713d8a9e52f1a64f

SHA256
939f38acf7cca88e5d24920ebcbe81858e3879b6ce2b0f8a02b93914017a91b4

SHA512
edf22996212e391a219c1441e7d04a57a07e152fc99f8c87fdd70419c3bba92a94c37210597ca7f76aebecb155552ef7b0f8c5d2b1e994d5b0a17173da97c5de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1be8a613570160fb02155787c5d23a09

SHA1
7bb3f43eed69cfb0952a117b96c427592c608d17

SHA256
1e81504d353641a57ade4d0b892e27b1be85e7f87476c07479663e1d5d3d4fd0

SHA512
51105db550019835ed1a1b6ca4ce461dcebe6dcc6152ec288bd91ea8347d8cb33ea13d4e22fda0f6696f867bb84f5ba6e499a5977d174f5e8ed0abff729dae53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9dc0f6bb84e48199efdd40fac73aa3d

SHA1
445eaa6bb4521376b0083ad6b907766563785118

SHA256
5c3e107482077636cfdeb3671776215f43310c82cf4b10bcb530cb8bac714456

SHA512
62cc0aae2c4c5d9a1574c25d8581c934edd5ce2f455335cd51ff839b7f109bd517968faba9fa6c5d353b29a34ca63a023518c88b28856d53cdbcd6a60579eaa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c99c556ff1891c1f6c6c84ced6240ad

SHA1
e5970dc0c8cbd832e21529f893a3615fc720df0d

SHA256
9fc0f6246900ddfc613254ce2658cecd934e9ca7638db50ffd9c1471199f9b90

SHA512
22187ca322bd3efb4623589825b69b5131f26e9603a6774fb85cc9093109fb2a216a7c4fc1cd608956972ffc4ae018d707d647f1a863ee5891b8d5a6096faf7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33700741e72308ac5d279300d0942ad2

SHA1
c32b78128ceebc1933077484358f29125490566c

SHA256
c926f621183a9d916a2a0f5e679386937addbed5a931b86365bb30240b03bcc7

SHA512
4a86272051216007854609e86608388cc4802d21d4dfa6581565d06578d208041f63d02e3538b75cd4560816d7ba0595abf9835dfa12b66f7b696e774e492925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
227a8a32e82a78b9017ec17912841668

SHA1
3e23fb6faaa665a0a564519ba4ee89a444c7ce39

SHA256
e4f3c3b26a034a12bc6b839ccb676d7a9006d45539a51f498dcd26e18b206c04

SHA512
61078f47b7f8d3326a9062502321573e2ddb589ea262bd1cf67f93800ab267eb33f911db64423f1296d4bc578af15969e8c4c6cb0a3cb511b334533509b74530

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17deca6a39b0ebc50d46a5760cbd1a59

SHA1
cf07768119de65d3af4ce6cf8e8203e11fda4aee

SHA256
a8c4bc69c2824689d058ebff152e60d8eb4c41c85b5e576cdddd3e0d1863c867

SHA512
49164651d67ad7dbed3e295549cc75918952f54dff611717af23a8228cf6ca5c88c072ed7b9a9f1a1f723a2f2cf02ea41a1149cab36c1fd4bde912805c3ac889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dab6227793f9cace53b8d89f196ba721

SHA1
2ca078ce1b0527f74b2d2681a5a8aaa1f0f202af

SHA256
8ee7a92174c26b5af51cf139f44d09e698dc313e40a02ee562ca9c66a9c5ec9b

SHA512
8c1915cee1ef37cc66aa0e7d6a119c7d0b7a097b5e53d9597bdb94bce83c2c699e6c61b698c6f96dca690bb4d615a25b4791718e8795de0355e19b84161a6b5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3ab5865bd42cd28684f8f0d1d37e6d9

SHA1
32eb27b39bbdc33f028c7c9c67f7979152e373f1

SHA256
f922ecc1bdcd4fcd397d9020b35a18326cb2fda7feba0fc9c9e8c805b37c0de5

SHA512
e3d23f11bd51bbf4f7dd6cf1e6bf2533d533347b68bd122ca00bcb3554422e0f213a63457a145d7dd7cd7f0ce0b3dbc41075e996b19d4be400b5708e0f5ca2a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab115F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1230.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit