ca1fda1730c1e5abd7f14ce4e1ce68bc50afe7720fb243498dea15e225607aab

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 11:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0e6a71b7f58db08d85e6a1ea72a88581_JaffaCakes118.html
Size

132KB
MD5

0e6a71b7f58db08d85e6a1ea72a88581
SHA1

1fe2cdb5af04d35471af9b1cbd50afc85f9a93b6
SHA256

ca1fda1730c1e5abd7f14ce4e1ce68bc50afe7720fb243498dea15e225607aab
SHA512

38978f2bf72a97a5d6f8f0ad2527b1746a3f40f38d442eb2d7dd3fcd2847eacbe6b812f3bd30da14d71a873d6fd48da6c5cafdcfecb5e0ba2df6573c8194c90f
SSDEEP

1536:kyWStSsSASJSiSBSQSPSiWt1dt7VtWetNytgTtbxtrstDxtMRt98t7ztRktGRtdw:DwKDB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69035891-087A-11EF-9486-4AD8236FB259} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420812599"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2488	2204	iexplore.exe	28
PID 2204 wrote to memory of 2488	2204	iexplore.exe	28
PID 2204 wrote to memory of 2488	2204	iexplore.exe	28
PID 2204 wrote to memory of 2488	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0e6a71b7f58db08d85e6a1ea72a88581_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8eba4e57af99a5056eea2341774b82d8

SHA1
01bdd39d105a5d5d825cd35fff78a455903e67a5

SHA256
969a36116c98b8954239f93c9d0510e93950c70f1fae43cfb8de1ed0859a5bac

SHA512
991a2211e9a03453f2c835118dad8741d42a29469f7f94250baf57dc62a239d10b4d084fdc83db1a37a7fb3c8abfa691e75f29c35d18efbd9c38e82bc2094b7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27ec9be3695902b87ee80b16c66b8036

SHA1
60352f9030dfe4dbbaf5d9736d72d80f97076807

SHA256
8bcd3ae8e5704729c5f12465c09c75c22a36b7fd81d482a435604922d1bb90da

SHA512
d09e6d04cac81c6dd888ed4dfe66d813460815527fa6d99ea62fd9bfe7aa6d803dae45a3d1d223131273bbbf0d5b22bbcd91ebc0359b3081e7ab17cca01e3b18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2b5c3eb3066ec76b9b2ff2205c39b16

SHA1
def97f2d3d0485a50ec79ab68abea2eb8f66f9fa

SHA256
c24428b6c5023e12a3da8e55433971e603fe10f1214eb45e8d0a1e2f38997b6f

SHA512
d2091bffdc4a51c49d90a0c13da7a774c89c953ab24a3f6b81a224cc0d64ab17ea76e096eeb5cf3346d89a9898fa8bef84e34ecc2eeca73f8736dca7fbc0b4a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5784745ba37322de9d09d08335238c83

SHA1
4b676223e13619b7c72fa171731bf4e043d7fb8a

SHA256
db8d513fb541b65eee05fd0066ffdfffc7bd874dc095ea9f4afdab697923064e

SHA512
ef02ded8ef5cddd78d09607abd5042922bc8315e069ff8410a06de695fa44426e140f1921bd9df6ec30209e9403f1c6360a5cd87f74161eefa4cf1fe6c68dc80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3962172bd48b2f1cd2d733b3ef0deac7

SHA1
6d9e795fdd8bb4d131e0a4ed4b736963706a4d91

SHA256
9f7dadc636a0cc76485416cf7e24fc333b93b25e3e88ab92f743f3fc655df567

SHA512
6677df2f9ed9685a15463fc39bd606ec1531cd2d7c5cf6e095cd5dc46928712650dd7a29a6925d277186cfc6a8cc0cd0c836ca4c2acd16032678f9175ef26abe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a997b63188b8714cca9d083437db466a

SHA1
a9b0c6b54487376b65cdd831a8f4e5902d51279a

SHA256
f61be44fbe3ef5c3534bda520d5d5fe6021335f9c901a40d81015d82fdd9f210

SHA512
08d01377109de1586418138d24c4aa445cb5b1caf9f0019fb26e445b8804df69782633430776ac348fb030f5930798383c3fa5cf8f0415c38095e5007185fd45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a83ea6dce184445284536136b1c4272

SHA1
c257a4e30e73f5e26b7c03d26b1bedb8f819bc49

SHA256
24a8f08009eb44ae382f3abc6fa53ac4db923b811e3eaf5556facd7cb3a13683

SHA512
e3774c8f07e211505215d1d189833db4589bc7ebf31614f8e608a09042578bfed523b47fe32e3e2a8111ae4044cb3ee7bb72f66f56a967e126f82983e04d5f5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6361a70fd193a5f0fb48a9a1f94fbf98

SHA1
2f2d08c7ed3483847d4fae681a917b894b683d4f

SHA256
29b1cdc880aeb313595c704d6cf6e33a20dcc5d1fb2e08306e0fba3d36a70a97

SHA512
9a662cb7772f2a9a547f1adfc15b924af32152a3c3d530d196d409dd8549cbdf8cd0f13af0e44bf5d3f2262ef431bd1ac2362f8cd78f80504d536fbd0d7eb0ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aab79711beff334eddbacb7ed29d4455

SHA1
63a320647a84c9cda1980d21170ca19a9b084c79

SHA256
b129f9c2d2aadf9ac0fd96ffbafb588dc736ceaa51a009d16a2806c8d21780dc

SHA512
e658852efb5aa8dbea82aaa6a80c07e9396801a73daa25e956801280dd77710b9b9a5f0088bacb1690e424ffd01dc982be9d8256559f3b9e62087be81e6e84af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3add8c64aebca10b35f3d8eb0b36f81

SHA1
bd07e1be0bb032c3ebb168c7991311512b9451a1

SHA256
98ddce3c71ea36ce721902e2d2fde28d2d9e70b58ec5305b9740b6c4a74e0332

SHA512
43c97643d4be7ef7bd55efb538752a0730a9c70610ebf649b80340d94fe31b9afef999266c1e78377567c5e345a928ee107fd9cc45b97b34e6a11f6286276231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2ba9bc2a6d82cead6a2960791efa474

SHA1
ae6535775835f3002e4b364c221654a1777bfb64

SHA256
f7f5c3cb4d5b9618720c8d8fa0cc706c3e8fb6e96edf5fd5873ee90e1a4848b3

SHA512
30211d8acf7e3d226e8674dc5803372c847228da8ca02ba327f0ffe9051f992178705153442e7ac1689f0a91cc0bbdf8354cb31e766d770b78140c4113131e50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B3E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B41.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit