ff204de40b25f2c629e896b4af88fa0716c60a0c60c44a1ac35d10be3fe70790

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0565eb2bec97d3a3c7223a4935b44a50_JaffaCakes118.html
Size

12KB
MD5

0565eb2bec97d3a3c7223a4935b44a50
SHA1

8105e9be47f5f84eb628377c616f8ec44d389e6e
SHA256

ff204de40b25f2c629e896b4af88fa0716c60a0c60c44a1ac35d10be3fe70790
SHA512

abf49f724a36222d503007380092651a9b5053a62aaf2af7cd0c19efcb46ed4c650c144963de239bd06044a2efb27718fc5fcc44290627c03707f2d1eca98216
SSDEEP

192:SmdPenV0/eqdLgfPaRw3NzDdTvrWpSM6d7+YXz0:SmdI0/eEsfPgw3NzDdbrHMsSYXz0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420476459"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C5FCA861-056B-11EF-B2C4-6A55B5C6A64E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2836	1952	iexplore.exe	28
PID 1952 wrote to memory of 2836	1952	iexplore.exe	28
PID 1952 wrote to memory of 2836	1952	iexplore.exe	28
PID 1952 wrote to memory of 2836	1952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0565eb2bec97d3a3c7223a4935b44a50_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b41c51019c2e8e4379600958a2371ab7

SHA1
4180299e901c4f9324b0b59c0dad7ccdf0d2d16b

SHA256
e2bc7f975320aa5467a4901bdf8cd49aab991e953613c99bc0bf0c60f4794a93

SHA512
36b441f0fc63712baf8a3a888def81fb58c5f312efe10dc75991c6b189260b227b4021890526e8adcdf5334f1ec51512296be3e0c14673644b0d27df8fefca33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
651f97f0e0599f1bb430081e37aad07b

SHA1
f89711e1b0a526f6950e8153a19284d9fc59acb3

SHA256
0c7996e0b36a2924e9703a247b6049e2990bc56ed7ef9b0e83776ef5a01f99a2

SHA512
7f38f152838e2f921a31a1aaa0322901fb4f3a55c6b5de2c72f18fb33a73ba1260e979e07b0531d68e091ed6e37435409775e3021752cfb45f9c2b7eea4ddcc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1af4b6f570fc6a4b351d411d4594ea15

SHA1
477a60f806fea52638c73c697727fd404f98ff91

SHA256
3502ae357597c48bfd2733846c541388c42451e12b8d297a29a24f372b1d0494

SHA512
6b7cc12a5f0b6e7e5ee861b694ccc8824a67ed6187681c01262d4bd4ec994b4d6fbd4f50462525820edd7928fb6b9be822a854fd30096a30b56c5da4adb8f83f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b57153b75bcd191c299efb383713f267

SHA1
6ee4971e13f995b592e3ded44fca16b3850b29e1

SHA256
1091b9ddfbc161cdb80ecb7829776a5fc161df58d1d56576f24e4acd2ee47984

SHA512
a1cad2c98c5274d82018f17f5818d9c1176fe4a85d90714be6416d067cac18988e90310b8147a75fb143490f9cb57c5471cc8250b65ab5ab129e463b9f1eb4f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
689355b4655650e140a17a49aa910daa

SHA1
1e8035e9c4f15a6374530d52401fcd982a20089f

SHA256
acbe10bd255af0d047e52a4b32c6d707ae74dd7abdd9558a513aa5e08c51b02e

SHA512
0c0d8a6184515e775dac69deef701be6d8b410fa1e023c72e84f0a38a573683a5bf4ceb7ab27dcc281ae5db2e75e8e1f88c4b02d6142206f3bef09f0498a4d96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f279c49b875681809158ff63d38a882b

SHA1
b8cb46702500f1a84a4cf3299526216b9ef5f413

SHA256
c1813f50210c4a0b1a3a66706f252bc61190e8e2dbb068dd068c13b820bc069e

SHA512
0d235222887b74f7a78d647bb1e01b18d6826a55755822d07c34986f1fbbae331321995a6577a45c9c853e171eedd9447c9c446e0a9a0722e839aae1ad8ca25a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68be46d21dbd289f3e746e9f16a21179

SHA1
2c0c6a521af93bce29744e2f557398ee37ac51c9

SHA256
d8f5e6c4dc108d2b186995319a8564e88618d8be5bb906ffb81f81e04559e974

SHA512
e679539c3034c5309aa51834ae78465f9419783d760a815c76b916c581092852d872433f9fa67bb1da35dc513214066c5de32d7bcb869cab670c617b870bebb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04236b081153d62046f494b7f0a4d806

SHA1
e8e02aacb777ed1652ead0a43351f740351e279c

SHA256
43613060808941d4b5cddbb75a96918aec5c1164752418758988f2e2aacc2668

SHA512
e7632c4f9fc1665dd2eae0fc2705f5eeb8dbfb287ee36e82c4a0260e16c458f5e6e1a414276c5bd493f0a600b0d2b8b1b7aa74b3391bae7e3772203160a77c01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2191833c9153c61153120b3f2be23df5

SHA1
6736dc24c6414e369d328ff5f95aca7004e0038f

SHA256
daf2ca7d7aa09bc2db19e62d61ade9c22989f4afacfe888caeca11f1bf6c83e7

SHA512
fbef4e5afa0f7e252bcec9d38b79b1e17f49f901010ee0eb8422f98af08c4f1883919b2294e7a61d1e399737c7fb2998622dad4fb2a9dd140e31350ccc0a33c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27cba096a97ba4394d9fcad167dab43f

SHA1
d02897cbdcca363bceeaeb1c5fad6de709266ff9

SHA256
c1a24f2cf2477439a2588577c2c81578967d917fa7eba5df00a0bed178a26962

SHA512
b30f2d5bd6432bbeba58b788021540865135ceff7d8634897e041e1db4e27db2a7ec202a1e4b38cb49ce84274b108107848ed746e686b4e4e85bb43a843c4615

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b788c8bd2a1478e7ef93cc9dda90d4c4

SHA1
0d240f6a839f86d07731f7c592fc649f2ccab8e2

SHA256
b77022a48973156632aea6008a22aca104b6c18adb07a79ed7e04971c364b890

SHA512
34f964d033f742c7b6bc4e6ede74cbff172e7e6ab302fb834c7d1b7d33167f54756b1f7dae2232624067a314e90a3c7f5dfb35f20ef55f654d5f134c3b2d7d34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42603ecb5ae9585f0f9930997ed002a5

SHA1
e39a279efbfdc11bb822616d78ebf305cb36eb7d

SHA256
180eeefe9b5f5f3391579a8162ca7ce590e3141c9bc944dc208b907008580db5

SHA512
df24296ff1e5fed12570211b91ea8b5987270c944c86e9618617d796b4e4bae46e58ab0bba7c0065b12fc58b160c9bb3f74833cdbc57ac312f90205fe895fc8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fb36b796d913f3e1c65b41d2f952c55

SHA1
d9e1bccc20654a5402721d958b35c1fb6100e64c

SHA256
cef2f9bbbb03b44448a5b423f20819e04968db20594487b8997397285a64fd69

SHA512
3d268b9dc95001fad5962a94c37e889f9c1a3bf19f7aac7b534d7eb4173c9c4665558edc18eb07b05c1cb56d463acb9997aa0963200b55f3eae7f539b0b06cda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
252B

MD5
29f230899e2da0d7704aa6f2eda04956

SHA1
ff5ff01c222fae83ac6cd23d5c91ba40def6716e

SHA256
bb2547175ea6327ca1bb2f1202fad10f06adc69829d3d932ef812035cbd59b00

SHA512
29991d02e69eb5072141fb4321341ec22ba7408ce81fe5e3ab70e3713c78fa0cb0892cf62d5b534466fa3f803b02bc3c4d57fa2c449ace083f7d00d28708c9d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab284A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar293B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit