795e96f66651f9431da363892fd14a833be30aae90533e2892ad315d55edb707

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16526b40b31baf58b3fe105ebe2a41b9_JaffaCakes118.html
Size

474KB
MD5

16526b40b31baf58b3fe105ebe2a41b9
SHA1

f8fea4f71074bd13a762788826f2a245520ab191
SHA256

795e96f66651f9431da363892fd14a833be30aae90533e2892ad315d55edb707
SHA512

caf07f3d6fb785c952126b351ca6ede6bab2747c3facc73d9db84611ef95955102b3369c5cf07a769b19e45541469f9f9237770fd1073bfebdca930d80b8560f
SSDEEP

6144:BRxIsMYod+X3oI+Y7sMYod+X3oI+YwsMYod+X3oI+YVsMYod+X3oI+YQ:JW5d+X355d+X345d+X3L5d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421051199"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1B78301-0AA5-11EF-AB41-FA5112F1BCBF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2980	2276	iexplore.exe	28
PID 2276 wrote to memory of 2980	2276	iexplore.exe	28
PID 2276 wrote to memory of 2980	2276	iexplore.exe	28
PID 2276 wrote to memory of 2980	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\16526b40b31baf58b3fe105ebe2a41b9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3455f8fb85b0a003345f4aa1a51c192d

SHA1
5c32337d42fb6e3400dcfbbaaba1a1f8a0497209

SHA256
e2e6923c39a435e22c8deeea93ae64994ec13fd26982e20959fd1cb0ef2cd9fd

SHA512
56627f9c414eab50380da4d7e5d023d02a74077b913b9eca6d9c7c1c72c9df32d5af8cb1dfd3a95609c2df2eea539c0024a85de956c51896abdd6c2a50429085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c72f483c30deb21e868272a1f735e030

SHA1
315c99af766120c75e42dc808b1d000ff807c0de

SHA256
08f99033e0ab5ba3ee6e7e0b07c34732078dd7cd5c6812a7cf8a815ad9358e6d

SHA512
db55abed0ab16f0223704c5d399afddff6e79c5900028e60db9ea39930cc1c3a72400af8a26690aa089381996717297cc8440caab1e23ce6e64dfa1ecf79a642

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e94f1a7aadadff067e10890717be8a4

SHA1
53d40195956faeafd78ac17121631c5902f8a3e3

SHA256
5bd8966c0ae80d7879b02585ee3d1dd3d42b9be474dd25fae6b9d5bb7dadd948

SHA512
beeb963e3bfb78688c8306b76769583cef3d956318ca2e6a3c8eb5ac5707dba3bc4ad5200335128911fc37a505cb394f0e6e8108dcb8e1a782e91849b99ecc6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1dea51a419e5acf693590c94b05dfe8

SHA1
755e2f0e10342d1dc957d5e5a9fc70b5bbc13fbf

SHA256
6a0c8daa312cc587c2741e7d77f35e0a71be66c3e62054fcafc4e86dc6171ec5

SHA512
624cc2f0c5e5223aecd8f9248cbb82048467b57ee64cec2707b638b6ef4690584fe8bbe0751cd767e56ec278c824d021353f2d612366a06071f480ce41ceb8e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cfedbed40bdb3fb46f3ac610a496e00

SHA1
ba9db302a57b1bcbe281da58f5173c057ef18888

SHA256
167dd5dfd9a8271afad6c11f734a7b89ccb2fa3df6044f7072b5a19bff7096d7

SHA512
1f5a9bbea0fc280098dfee7d5f0929cf66b9967d46edaa8a5b0a99731201212c2deb4919de5a9360c5c240601331ed1678c21905b3bcdc6830676e5c48350932

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0973d087d8605e884fb2e556e52b5e05

SHA1
828d0f0cf919ba2f26bf9c5a6ca9674387d25cca

SHA256
48075d25de9c849fc5eb6534e93ef49d901a84093826ff209a112bd41bc783eb

SHA512
0460da7298f0006060613f13d1a6204ee01e582efc11939e75f776a9a9510aafdde0c29665023562b248bb569cfdbca78bc41a248d7eea64ea99652f459c876f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7504e488680ad8a172bd9838f5e3b9f

SHA1
16d791669454f52217ea756fd93a12dc415dd757

SHA256
ba5c6df75a1bdfa7cf3b8a4399e5411e304a0a409fb6794bf44417ea04161034

SHA512
3e5e174d179ea2f26527cc182b41fbe67399f1b7908534728fb5403f0e5f858d32ca728378eba7a4b0c428d6b04e8a595550f45748e6508f2cc4e5c4226406dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a1bb9fd9b5560e5d33895405b0dea83

SHA1
6ddc377d09ff265ecab07895106fbfaad1b8ba58

SHA256
40bf4d7f1e73c29bfcea4e217da6de6784e555319c73da9630e34503930fc20b

SHA512
7dd0fdf0ee3025486531a0ccade7755e783eabe5572d3d6d075040bf65a7a9b636015681e80cc0140f9b2f88e4ccbcfc67fe27a0e484fdd2f9cdcb4539ee5661

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eea692362728e4f59f5e953ffc16816a

SHA1
f164a3daa58209ed03e635cfb7a6d50e256780f6

SHA256
a2b059f2b826e28daa4cd8ae61be74d4f5dd11378720a37b6b401d2ea3ac2c4e

SHA512
56346b6a285c938a0297a8dbf8be8d1268c07e6eca932b869a023a3f5bd358803e6f0eeb728c5dd74449a068522dd63f783dfdd47391fb29a0e7404d473b91a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit