fa5565fff5877f9a9960a5ae887ecd1f194df1fe44d1ab48e6735ff91c0eb149

Analysis

max time kernel
149s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13216e0273318c3c1bad17afce94bc9f_JaffaCakes118.html
Size

120KB
MD5

13216e0273318c3c1bad17afce94bc9f
SHA1

81e0b8d537b4e3455a4c7ef42dd8dba548f3f43e
SHA256

fa5565fff5877f9a9960a5ae887ecd1f194df1fe44d1ab48e6735ff91c0eb149
SHA512

e59067cf09c2a1e96b4b14a7080732d8870bc5c986aaee2a85871649b59d911add63af6ca4846207efa0ee5962db438ab7650bf14e716a07b957de62988da018
SSDEEP

1536:S7SHM8C14yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:SS84yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420994823"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF03D321-0A22-11EF-9891-EEF45767FDFF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1312	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1312	iexplore.exe
1312	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 2640	1312	iexplore.exe	28
PID 1312 wrote to memory of 2640	1312	iexplore.exe	28
PID 1312 wrote to memory of 2640	1312	iexplore.exe	28
PID 1312 wrote to memory of 2640	1312	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13216e0273318c3c1bad17afce94bc9f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1312 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57cd56888b7b6dd32f363afb690b887f

SHA1
a260c74c71b3e609bae1623edcb49680fe7f8147

SHA256
56fcf33328850cb7456ff5d0e7b7d2f78eee1a66653a1db160babcaddeb23c17

SHA512
b330720715807d1303c81824c8295250e7d67a585a8efc4a3190af684883456af2bb81e238bab28f221fd1df5fd5390c79c9ad23b6c9b393a1d2c1edf2721684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a78344d0d6b03c77ea5049346ef52dd

SHA1
0b315296bfd0a1748166349baeb2fc53672c3557

SHA256
e65491106c89ada18f1f91ffc75b95e0de05181b334843bc2c91233c33c52594

SHA512
31d347cac3d497ab669492719d1cd0d96075cf30d80919f534dde9c19d23245d76a7258ded10fb1e62ed0eaed2261bdba2d23daa773a54ae45d2d08c1c26de45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfac9d15478770f65a6b0680b1bda9fc

SHA1
a5e0ea6ba1c69008023f8bf917f71759e21a543e

SHA256
082a627b77321906ef30e7e6d16ea067d769dbd3783f9c7c7b815b605be46437

SHA512
54f4c6ee6939c28d7932198096b84214874706acbed8cfe232096cec595fc345e52c297ce43a17f5a72edd0661a1a38d2b46e586ad1d8d25f3c76a89158eed36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0821d697fc9853e80242751f5ad9164

SHA1
346209ce9e614c94cd3411bd2d35241fc656b802

SHA256
db5f41a0646c06e2d28bb82d754642ee5a13dbef0643c2e92b170532737552a5

SHA512
b61e184bdb2ef770b71b66bed2ae7b211b66445aa46f6d66bfc848d2ad31352ddde97217ba2e3b2baa84a1f4d53c23e6de47d3d56c004473d405da766d48a028

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2831aadb52cca68c23f4830d438a7a53

SHA1
7b72a9da9424251a5453f4db3a8a058d3bf23c39

SHA256
d1a73d867dfff21001bdbc21b686059a9393d1a087bb4e0ffd9f53aaecf97fc1

SHA512
ffc92dbb0adb1670568565182afe0de283c9b929464e9ac2aec25e176a15173e7c9b666c1425596b42ef493311b39d1b9db9e09889fbecea1d093c47ea7e9327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc8b90d68a598f0c015083db808f61cb

SHA1
5cdf45fd03008d3b3a05f818ed87c81ef5d9c1c3

SHA256
99a64a981c4f982125063a9a4f149e548f86fa591123cf4522af87b4d9cfa922

SHA512
5bab4fe982e085d77da3a1cdf4babc13f60ed798250687cabf31f7e8db0e359571fc4c0cc63c4856b7ba755e95390a945d66b53d7fbc95bb1a3f0ea8ccf218da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
effe739920044450c91d9df7d03d1cea

SHA1
c7e41ec71ed875dad10db596738359cc1024d39b

SHA256
7fc910ea82ed43f9ab39215e870e597bc4898d52acca583aad1e9fa474906276

SHA512
edcdc60d6ee6f0664a59e00e347f1e29c62a2406b59fa16ea2d9e689555d710a5e3860175aeae9f008cce2323a77096afd1582fa945b6f6be615dcded53b9800

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
806d90fea3ca726ba7f24076f82bb020

SHA1
5d9bb003ee2169eb7435aae24a10140c90bd34f3

SHA256
114bd2341145ca27051cb7608a9e97a6e7b2cdee9ef5d8448d14dff334c1ca63

SHA512
dc90316717dd8f74f6129219d4134e7ecff4a6d70488a1e8bdad9250ab96d585616954fcf476642648bb91c1caf2961631fea8af49cdd17b3570f67d50a21ca3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d73cf751d43b94c3649e547a1d14e04e

SHA1
92a169a3de64e68fc0ee791c381f8ec61bc52c15

SHA256
1fe461b8d1b42a162814fbb4e9c8245386e9320d3495e4a5e020d3c712aac972

SHA512
0c205bcaa6d8f7e1ec013313762f2d6fe0837986097e3b684a7e437a682f5b5d86325f055339696d982ee05e4862ef84d2a3d6aa87183b24f444d7b3cebe6e94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ee3edce2be7795899f4c2e1e834fc99

SHA1
08f21256fad3a2f98eff7a62a1338499d7e69f48

SHA256
f4d15e1c3b5d0f8b20d0ed527269feeecb15d4479afb2a3bd68e9fb2885974c7

SHA512
746a169e2345379d3f3eaf1347b9ce6ee69d5cf0c1cf0d3ef5582d93574f3def936051c18780003527c2688e982ae5b60c0f5bdf10318b170aebc63612f7f646

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab256B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar263F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit