bbfd6bba157eaa160359e6905295e9efb7fcda6c5577c3b33aaea31451d80b22

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16e15d60276734d2e2e563685977326f_JaffaCakes118.html
Size

173KB
MD5

16e15d60276734d2e2e563685977326f
SHA1

11fe92288c9299869d141f7b3b29f2f1f06457c5
SHA256

bbfd6bba157eaa160359e6905295e9efb7fcda6c5577c3b33aaea31451d80b22
SHA512

0b335307dedc3d348d79ac20036705a7d192b45bbc0fa36527f9c86140248f3aa47fb8f9456f23f7e938534d19a089d260f6a87a73c28f99ecaefa89d8980e48
SSDEEP

1536:/s0hzrHWTRdKEL5BFt5NLBlwOoyVi1kAwnzfs3e5ZJiFdb5a:/s0wRdtrLbWe7s37dla

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB2D52D1-0ABB-11EF-AC06-EEF45767FDFF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421060584"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2244	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2244	iexplore.exe
2244	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2716	2244	iexplore.exe	28
PID 2244 wrote to memory of 2716	2244	iexplore.exe	28
PID 2244 wrote to memory of 2716	2244	iexplore.exe	28
PID 2244 wrote to memory of 2716	2244	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\16e15d60276734d2e2e563685977326f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52eddc990c72a4d821a1595303fa4330

SHA1
b7c34d9c991cbbee4dcf705acf31ef7f8f30a743

SHA256
eb13e89b3535f1f648073d7c99f249a573b09eab695e49402a964baa1efbd962

SHA512
1e25161b901e744ebf5be19ea24202b3c45e2e8da0596e2a3ccc3002e83d5a089348a5bf0f36871a51d3e9d625c4f53eaaa0a66da02632690336041c3936a101

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3edee55a51211d6306f78220ccf7547b

SHA1
237cf4f8dc3580af2ecd9f07d8f8f7ed14bc86d8

SHA256
26b4318e0d707bccd0b4853d143e621eba7af7447bb3b9cd4da857663a90280b

SHA512
cbc221f28f7aedab393348d864909b630b180105a66aab59f342b6730f240e8d00b9fcb959f3fc9e717f5ed74c70d8f6639c091ffa4e77529bdc0609fb194ff1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b572e01817409142411d6bfd8ea85320

SHA1
1eae9908fa9d2c6b0d964d78fa390d115025aaab

SHA256
e18d808b2144f29e501395ec5ee297083686c4be4649795787bd082cbd8b38fc

SHA512
5aa112bd88226bcab00027f5714af58c0e89132d0036607a83c31336a6f604dcd30bec492dacc68f02858f8e9e8dbc9284d1933b70f6bb7c4b8120a76fea18fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b1a142a2d766131f399dc86f073556a

SHA1
7899e2f18a90956aad59e0ed58303c329db79fbd

SHA256
4c36870d9dffbf8b4cecd753d2158e165c1bed75e21e9cee6b32ba1c729fb208

SHA512
90c4d2e71e3e1b96e166bf73fb0ca279d3bcd511771b15bf84f9d64eb70a777eea2594943c40ed63d989b392461c104214a03ac9c6e76d636c65a7aff9fb8664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4ffea2ec7cfd8f268ac6e727ee55598

SHA1
7228250d960c989dcf148f2c2d5f22312a0f6f54

SHA256
df2075e12d8dd4e6e3f911bd93e89eeb918389806124e5b3a875e411deb2c5c5

SHA512
32e2c67f0132ae35c9732c6b2102641306b38fb0fd35716093cf1634c1b236ba46f8e5bf1f053248c168a7c49f0f7bd2546a68964e7e50a166d0b1ade6f92d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e91be7dcdf3cdc4255076ee09cf79f9f

SHA1
49c02bfc0ec56528f2b91cf3433758ae421ef53f

SHA256
eda422f152e9c7443214a89b83a9a4c11466c5540bf0b86f82cc0e43e9a12571

SHA512
0947626212d5f5b6cf8733942b6de136df9b25c17ccab0defb9b3f3e7b3080f1e9d47501cbb0a61518f1d297b01faaa100fd54c029ffae9211c45e2546d66f14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4ca27c35149adc1f3ea28b07d7df7a2

SHA1
8fb7c9eb66b12fbb13a502be7211236e00ce1697

SHA256
a2ec214288f417949d2d658d534d88f4b496ed97e82c940b87668f4a6a26508a

SHA512
4ae0b1f01b2901dc08a40563ce599a6d206eeb19acc339fbd14c79b56b39e47a5a8faefd4a4d1eae1982ed7d88a8ec01436e94f68fe18c093f3d572e059be5a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff0d3d8426e4e6a56b79722bbf705bdb

SHA1
019f38efbc521c80454ae81174bd8a53a7550691

SHA256
68884cb5d2773c5289b10d996f331c3ecfd476660c773f50c534fa1e1ecf1dae

SHA512
566a840552ed63ed1e602cc18f5a98dd5de1a622e3cf45a8c9df8347f4adfe576efa4469f523782f5a5e6eb9c4fbc1e4dafa153cf5672bcb45405cfed0227e8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5abbc7a4579d24711e53fa8269f57b18

SHA1
b00d96e31c341726300fb0a30a3a10597b312b0a

SHA256
25a9ace59762f110e0e39630a48328765c635d4559db9416b47cb760a535db68

SHA512
a284850f6a7eb0691d147e3ea6d2e5427d0e52e72a06bc3ca2d1cf35ebdd2df19881d3ade14c89f5b417f513f57b62e4e367df900af2cf103547e784f4d9c967

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9DC7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9EA4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9EC8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit