9835eb7f8d860781f71c3692fd46d0a85ce3c5ee40219732d0fb4b1836ad1664

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

159d130110e5e6d21ecf2ce643f1a35c_JaffaCakes118.html
Size

18KB
MD5

159d130110e5e6d21ecf2ce643f1a35c
SHA1

8f4f822d23cb1cc6c3f7721cc1876ddcd2c2d48e
SHA256

9835eb7f8d860781f71c3692fd46d0a85ce3c5ee40219732d0fb4b1836ad1664
SHA512

74a4c8988d7f4c7583457ebd2643d9766d5921c3f99a61260780d313753d1ab0ed9cb8eca453cc92c3ae3b0e2c73037b93f3a824ef912ef7341068f660f39a13
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIM4GzUnjBhqs82qDB8:SIMd0I5nvHXsvq/xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421040147"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{363E9911-0A8C-11EF-8442-DE62917EBCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2752	iexplore.exe
2752	iexplore.exe
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 1296	2752	iexplore.exe	28
PID 2752 wrote to memory of 1296	2752	iexplore.exe	28
PID 2752 wrote to memory of 1296	2752	iexplore.exe	28
PID 2752 wrote to memory of 1296	2752	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\159d130110e5e6d21ecf2ce643f1a35c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed6584db6a9982bf38fe546fc80ff722

SHA1
49b57ba4139227374b596bdfce412d3e1454b18b

SHA256
6b088fe316e6cbb6da41c5b38a2e5d5ccd77e0a01d72bf679218b8f3b6181396

SHA512
3f306cae819e65c8151351f64d0afa56fd9801b2ce16524874eda8b11924d5eef4e0e25bcc248532e3b93e98dfd49bfd4fea88fc1b4168d21695042a2f3d7475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
811dd8f3aa2be2490e17674350ae6b4e

SHA1
ba5d0399865e39c40a88694e81554c3cd94d2136

SHA256
f45d20e95442dfff9b04865f224cc592358ca4afda406a7d16b8fdb8e42e8cf7

SHA512
7259b392cc0262195647f16b016d92d35693e759a6f22d27f34fac786197ccfd0f94de93a87c5d02f1f4231176dcdf07668047ece5df624d64f5f1c537ef39b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a43be40659e1c9e50b3989ccf37dcc12

SHA1
c849e717a221ae8ab145f7a826af57f2a17315de

SHA256
5b471adea947998402b63f45c399b89bb57bacb254033b0cbe255c727a48db19

SHA512
7cf8cd76ad130672cc909b1af1719102a75cbc66eed8f4f6f372da056f2f2d72e967ea452db2d26c2aa815e87ba8f874fd33aff2874835f1f5852f230f5bc78c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07e0675853f0f3f56ed57af413be4f90

SHA1
f9236159068a036b96d2cca61441d7dbff22282e

SHA256
630d97dcfc8c62c0e514793ec6bc38b5dca3a5d1d47d525f41ec0cdd05ea6eec

SHA512
b7d87f0dddbf1cfb9c0d2e4ed1472244849a31a228ee570d0479d9c7af37f396038d7cfd47606c04b4b5351fe179653fd2b5923b87e7e03e9544a3bdb382ab7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f1d5297bef435e0e45e62a61aaa1894

SHA1
4f707e5142582eb72753f9237f1a54d2fc869250

SHA256
1c1e457ae40350a91963b832822b5b196038f69808c8e4dadf0b59f7fbe12861

SHA512
69d20874f947298d64026573b4796f46621805db3c357c602a8b53bbded794895397f3de71853f6c10a823744a896b79b774d17eb2bfa6f1738cdf6b9d14084f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4256fdba43f1d01a4eb44058a1b6aeba

SHA1
95534f068b8e25ef5e921168f08b6548e26f0f11

SHA256
890de0773c3fb8946f1aafa05b4e8a4950523f29978da9e599dde19a5efd71e7

SHA512
ed2ed1e71864d4f71d0ec6e6759ed96f44b933fd257e643320448a766d447fcd8582e0b3a8f00dffaf447f26b852621fcc15727b7e650a802f26a05f92b37c12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
359b595e6827ddc9e81a6eeb8814380c

SHA1
aa5d6e81f17a8dd82477eb4964dc26e2c0c80cc9

SHA256
303850267429c807ecc97430efb480a3fcffb22cb85983beebb709ecebb7570f

SHA512
15eb02ba3f6a054db9d386b63e591a8c43e77d7fe0a1d9931e279b17657b6ff7109da5e1f844ca885c207033d989732d998922a0f51357ffb92db588ee840835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
396e686e6bc17e21899c9ac6dbce7812

SHA1
390da2dc5c788b265cb6a5bb5241828b5c830878

SHA256
35271e7a71a64997d2da5b040ccf4abe123914c5f67586c281cf83a2b7838624

SHA512
e24c48aca1e3bdc751530d47a4f7fe94720094c2b83f51f4b232501d323e27b796319b4f0b40dbe8fd3054ff880108eb9b8ca68972273282d928a0451b738dd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5702820fc47a7e40537bd35bfbddbff0

SHA1
cffdaa1f8005734de90d5872c92785b1d1f1895c

SHA256
c6bfa9ccded9e95459bcc326b7d24c94a64a4af2ba0e8aee75d32d5808ac3722

SHA512
276bd33cc97613672d53038a794dcd3ab9330957e2c962245708974a27f27cb4830160a1266113ada8a7ec864b57032ba2aa1f1bd08a56db5b0089f5a57a4b03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2196.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22C6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit