86831615e92f9e86fa1f101dfb58ce8231d940abc3e98c0de6939f21a899f9b3

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0eb5d2c0ab5e36efd01cffa7569be31d_JaffaCakes118.html
Size

18KB
MD5

0eb5d2c0ab5e36efd01cffa7569be31d
SHA1

b07af4108c3e98092f1b5b7c3094d77391a96e06
SHA256

86831615e92f9e86fa1f101dfb58ce8231d940abc3e98c0de6939f21a899f9b3
SHA512

e4f823d3ccf5fa7210f50693fceafe60852942de35c72701719434243d5e7be0acecbfddab1bc9253c79661ab03b0a53c1732a0037833845af449e384149e76d
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIU4OzUnjBhS082qDB8:SIMd0I5nvHnsvS3xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420820620"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15E53301-088D-11EF-8D15-FA7CD17678B7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1972	iexplore.exe
1972	iexplore.exe
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2160	1972	iexplore.exe	28
PID 1972 wrote to memory of 2160	1972	iexplore.exe	28
PID 1972 wrote to memory of 2160	1972	iexplore.exe	28
PID 1972 wrote to memory of 2160	1972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0eb5d2c0ab5e36efd01cffa7569be31d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
5370e3b6cb9ac6376b5ac3ae54d2e5cc

SHA1
9d14242cde985e5db5b727d2c6bea1477e5c3f21

SHA256
dfc377004bf4424ad631c1fc45046964de445a8215a7a4c2320820a00ac2900a

SHA512
5616daa54530cf2754f6d11122559c0e0093f7fc1fb82651947062b152426d31e3cbbb9bd9d322ea6bd347da374b22cff41fffda02e3ad4ca54b31cda44a9973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95dffb1b6d9e622f78b37c972ec41421

SHA1
b325854ef3c3b0f717e02f0b5b3ef15e1fbb212c

SHA256
4be30f4a6fc09829c4191e21c6ea65a189c87e9c40c596ae74dc5d90ed45e3a8

SHA512
984a2b5a9e77ba64f25a25bd9ebf4df8776133a5ccad20c4719964bdc29dedc9bd0b50b76d88d89bc9392b64a5188dcf97dba043a8d09eb04b722d977df49e38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc83be513410da560b3cf4ccf9ced52e

SHA1
135a328dfdacc8fa8f40fd569dd8d112959ce506

SHA256
febddc25dd08342fe9bc8555e092bab424219809f32d2afc72a5398f54397b9b

SHA512
ca02f13602cd968d28803f060746581916227ac83040e2d3408e9df2bb1b52f3496236ab527e151911fa64e4c4fd287f17912de502144c76cd74857f363f3230

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15e8b848ffcc1cbc1cd1646dd0ad3f0b

SHA1
f2c2040fe35cb7c3ead317e914748857abb60dbb

SHA256
e4ca657175ff4899ca134593630cbbdb1d94205773734b85810e4a79918d49e9

SHA512
74803b88d1a8cebb77cb4467325676433ac8ca046253075040a2ce3a488c6e03d139ebc60071b5727f86b3e4661461d2b9d42561b90a4a7bf420b085845f8b26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe85f9b762c1cb41e7979cebae949953

SHA1
777f70de7d26275efb8b59dcc31721f7244998b0

SHA256
ea773c8b314f349246655af629a3f57076357bf3b76f1c237ec048f9140e13d9

SHA512
77aa804c8c29d5b15376d4523bfb273e9c0aae2a511a115239c498434c65400ec32885a84cfa4887f3e29dcdd5e0063708ff63d2723741c9af2150f2b3117160

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8f946ac6e7755dc2a5e740cb768923e

SHA1
8d7ecb01078e10c441dce3b25ff625f89aa9dc5a

SHA256
bab2b91f1cf51a11118080e9d29f60f29bc2822034587fe0d6838b3ead5a00dc

SHA512
bbfb03f54c447b46250a4630b6aac7a8f77ff6acdfcedaf4261d10147e72ad0fdcac991170cc1e43f0b3e4b7d72416e9f3ef465d96e328a50826b5a98055c94b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a369d36c4b9fb15742474a238e2994c

SHA1
d23908b3bc6773d18b918269171c224331937dc0

SHA256
71204bc50eea35d4f295f7354351b217f68b4ca0df9f663747d92fe7c21d703c

SHA512
88d1f5edbf80a823a58a6360d55e1e8eccc0f61544bb116dbbd539269591c51f0c7a375dc3d95985183032bfa86b40be2d93d8a92e08655c3d515679d21f28ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
887043d6bb49a2ce074a3ba8f2ef9719

SHA1
830c7026028c6e59817131d06e814106ed9525dd

SHA256
98ae1e41fba20348203b5d386fe129109162b81ec6377e1203f714297aab6929

SHA512
24d8daa31f2d43e3df8d65b23806949cc115cbd0df08fbb3a4d599febf6611331045469f5bedaf4ce98bcd8899da2bad039df78533b9e45b6d602f7f98e5efa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ef119d30e8070c85c6453206296b6c6

SHA1
afadd6d922347b931f2657a1a597fe5eb2349ab1

SHA256
8c7536a7bb194a8f09ec314edf8648a2121871cdb57065d884da9e74acc80116

SHA512
9b682607c39a99a53aff4a1212dd2ee9784299d9d8982dba9257b54795a1c064a0ddcc4f8c6f6c5d5760e63ccc1e40d17d1dca913ece7f8826f57d1665490049

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47c6cd7b6d91a607051ab798023bb78e

SHA1
c9d08659030ff1b322cfe2ff32c9f3baf54b50d4

SHA256
c0ec90e7ae86e7f4e8fa927d8ece4b7f4639a985f9c287990f981ee399b5cee4

SHA512
6774200f3455f88deb931dc5b6cd3cdaeabb5088da4b44582ca1b51ea7df06c92eaf0c5c3af725fd975d6bacb4e5086c2c3e76ee0f2a3e694723e66579433aac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f397b85425735e37162d16ed0663947b

SHA1
c2898cb1ac8b8c9fb8940a16d0a6238c89c316aa

SHA256
78c3bd7bdb2efeb54b24530f95268c5fbaf7ec5b2c96cd4c24e8ddd6540fa6c5

SHA512
3e6db40a3bc01995093b6a77db76e7a7d3606b353789bf491450a7715565c2813a915736328643d5b8364d11dcc645907c5d840f823bbc911005faa9e9c0df88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B24.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit