84b83c34dfd727565a75779659003539c70580e2b8889c0f96090868939cfcf5

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

15b64e8aa97b55b2dcff81d9ca8b5f9a_JaffaCakes118.html
Size

26KB
MD5

15b64e8aa97b55b2dcff81d9ca8b5f9a
SHA1

94ed52833a99dfafe15d84be8b8cb7d3df573e85
SHA256

84b83c34dfd727565a75779659003539c70580e2b8889c0f96090868939cfcf5
SHA512

48762a3d5b8351917c73fd6e5e60a8a1f249be30e691a0762e7ac7db836fecf3f06ce384fa57284e3e2c697cbb1632d63154d820fdcada29494ce1cece063f7a
SSDEEP

768:oLwqFw9bCfCwpg8oBrfGZ0/DItCNlnVom33hg4:MnFw9beppg8oBrfGZ0/DItCNF33hg4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DDF83B11-0A8D-11EF-8A73-D2C28B9FE739} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421040858"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2956	iexplore.exe
2956	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 3016	2956	iexplore.exe	28
PID 2956 wrote to memory of 3016	2956	iexplore.exe	28
PID 2956 wrote to memory of 3016	2956	iexplore.exe	28
PID 2956 wrote to memory of 3016	2956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15b64e8aa97b55b2dcff81d9ca8b5f9a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
71584642865ac1495e77c5a835beecfc

SHA1
4b3a828b1b21479ee133be6ffecf1443420c10cb

SHA256
361548d8a3c3c5a796e41b2c9c662bdb5e5f790eacda31bdd0aa9bb5cab54dfe

SHA512
f82e488975e254a6eadce279cc4aeacde8f7645651bd58bd3950b8e9505cb520de413bb9e86047d871e1061b17b26719fe61632a00c537490f3851c0e51d0595

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
671a9606e73c554ecafc5b3c34952b42

SHA1
1514ff70aa9a53ef00e4d5491022ad3a1f010645

SHA256
7195789f9ef56ef6ac2d38044284a79f0a7933784e6b3c5e0c469b054b461524

SHA512
890e8f55fe766f50edc634fb59e040a9dd2291eeef6f1770be12c4fc680c961ae67275012be4d464e43d903579c5324f52bbad5d4d326b9a8b926df26c587969

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c81bc70cd766b35f19d38dec8fad4df

SHA1
fe4e1fa25c72cbba62f1e06948fec45877b77d04

SHA256
a0a48e4f1ef5db30fe644755e00fffefe3b7dbcfc8a024e4de6e8d7fe27f2f70

SHA512
7898287989910c592f7e58a7830c9bae55f56e19c373c4c389d5b504edb82b535c55fe37b1e5e2b2d35167434f9258c84492082c0f147000c34700fe9d1f698e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a25475ad72014c9083f153f195d8db8d

SHA1
9bca9f241f4ba250cfcc12b007f90db4458fad3e

SHA256
ad57a5abe22b364e367aaf9afdd92f864ea2b739ff9d429b733d53758907b541

SHA512
2275c6f9f65b3032e7c5c121ca886bb5aab6d3f1e8141bcce353956122c9f575da28a1337e721dcf6cd5ac57bb0061474b0e11c54a5f82d4d42250fca37d8c09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c712b6e97b1660bb648e33ba419c1951

SHA1
d10fa8b4ac5beb6c9974751200af7416a1b80b99

SHA256
bdc827d043794fb2cc9cffe32ca1480a8c76104a03be15dd46a12188b18ef77f

SHA512
1b2eaaa580eb460b87b3e95dc7665e8a416165bd66ccb73b6406ce251787874a2b994355695383d3c42c3476e4606adc9d66590f0937bffaded03c2a6bfdb2c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27977d893b76bcca233ce87c84333265

SHA1
bfa6d1511476c72aa68bd61344599dbf6118f068

SHA256
3cc6e9a3ab8c00c02a59c3b09ab377edc378658097bbec7dd3bc6fffadb43860

SHA512
41eb9dd690b645dfdb1abf14d91f4dc896813e2a287e940609d58faa97824e948a20d7b54460cb0672b5f4def95de884c4adcec2351d93516ee35cdc8ebe45ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
268496527763566f0cf56e5dafb4957d

SHA1
318a387f381098ca7f66d8f73c464f95eacaf72f

SHA256
f52574ef3fc18d71f29554bd93f4547cea9ba8a3e3cf9033ccce92795c2c26da

SHA512
456328ce14b0d211507d8cf0153ae22e2198afbc44d9b8882ab56187b40574ce7b8899fa048f2861b8375f96916ee3c82cf849b26571e6f7676e11d3413873ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87dcfe1a4cf22ba00c5d4c2d09b7bac5

SHA1
52cdf1f43e51726b3a7f98fe503a6b59d2238e5f

SHA256
c28a72e2972f14f93c22bd27d94f180775256313b02c5b8efb116276f9d89041

SHA512
d3905539d6775ae530161f73532e331fb5c8b56663ee916441891e108ff3315307aaea65effed3c04960f0b605e75474f6e349580e2f0b82ce30f9e63daee389

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1625a651b721d1046790fa3d4ead65a8

SHA1
af97a95f2ab3e96925780adbd4a1096d3ce95dcc

SHA256
1041317175e4520b414e4732fd29ea581f0192f95c78b0530650a821ba3be766

SHA512
dd024919b20cae17079e4f2855feb341b6a941f60b09c1e0b6ac28711a9ab38d358254d7cbddedfae1839fc80cc9e2f2add9f5ec9f42d26b933a5747ad73b8fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f715c67eed42c73e603c728a574f5ef0

SHA1
7f58838bf99c8f042cf284559eac9792057674c4

SHA256
d1d65dc40a7bc683dcc438278b458dc427beacc702ce7b8a6dab43c0be02387e

SHA512
d5695fc8f951a15a51260a62b4ca940ab02e8dd56acd2412403256e6cd906f4db7c62b9ec5f7134e4445c92ea862b8ce680a4ec65b215517f6c352c73cc35d41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
98202774931280da3e499329ecd37d0f

SHA1
850c84f6d742ce9410a7e6af120592bd2a4a4dbf

SHA256
953370cd52c36604fc55ebd5ad6e7bfaaf2f9832ae73567d069ab7684f9e49c8

SHA512
b345ddfb7f98fbcece794206422d88239a2cd1bfac93d243ca66d75e5c7aa92ecadfd8eed4f7859957bc1470885d514ccdae3765498b4cf96d3ee5f674cdb076

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar88E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit