b5cc40de24d8d830491e962c6a2693f3778b21b4b165456045f08561d4194d7b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

211a155210f776c6df3f25c0d79d0a7e_JaffaCakes118.html
Size

30KB
MD5

211a155210f776c6df3f25c0d79d0a7e
SHA1

8f2ad4eda7a056e6dff9e8fddb3ec52a972bbc54
SHA256

b5cc40de24d8d830491e962c6a2693f3778b21b4b165456045f08561d4194d7b
SHA512

c5d9467ffc2128f40763dafe718494d88f0271b81033ec3d157e3461ab9230a435f265496e959bb4933bf204d8b8e61e5582622760ccab0feec32075c47d95cd
SSDEEP

768:95KveKB0i5Qk/H6MHQJem5rkCxCkC3C3CdCdCCCCCQ7oatbMekD:rKveKB0i5Qk/zWkoRSSyyNNXUaJMekD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5A400E1-0C91-11EF-A41C-62A1B34EBED1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421262518"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1744	2372	iexplore.exe	28
PID 2372 wrote to memory of 1744	2372	iexplore.exe	28
PID 2372 wrote to memory of 1744	2372	iexplore.exe	28
PID 2372 wrote to memory of 1744	2372	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\211a155210f776c6df3f25c0d79d0a7e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbd1b5eb717e52c4e2a2eb612b451504

SHA1
61f4e8dacdc8fd117e0dd0f254c079fc0bf57b8b

SHA256
30cb5db580491524d8303724305510184578a79e566f8ebe35f6144e91b5c5c7

SHA512
96a3c8e6b13609bbbe3dfb9c09d857a7508d7af624a681a9f09e91bb857bfead9a215a648ddd4a9c6ac02fc8fd9033798f768bdf3e4c00c49781f4b6ccc22711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcc037bf15b51a9ee2225113d4b651d7

SHA1
acaefeee3e594e27f939d5ab9fa89ff1b2a9f683

SHA256
99b665213e85af37a04ffc0a0b09e727a43a73cbdeb77a6ca159232d33e48f3d

SHA512
25459c02d211cf2a421a2eb177b1dc88f7aa1d7f0f914086e088fe3856a309ca6ded1a35852f9d9272720e635b32614754d810e36775ec88835f21ddbc56dd35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7554ba286c5c543dba817bb6a9e537c9

SHA1
fed627836e1fcd5b2a95ce9498882e5a119902b5

SHA256
f7207ec3e12280d45368f645d9d645ddb6041789deb54d06cd89392a803baf50

SHA512
2c3404797e1d3d9e3adae81eeecc27416cb2fdf470c9e8d74ced3c370b9172a3ae70af830137d11ae85d00a07db396609e920b543e482d1277bd45d777b0cbc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ca64a74c45eb3f04e4751e55a4c99e2

SHA1
3224cfde6e857b05c791a6a50034af358e7f6f61

SHA256
13c0c5bff867afd0bbaa8875d0e379ac72f0b40248cceb72fec172e6a9284a63

SHA512
d5b7d7b8bd74e459da5f965fea36c4e9964b3a20240b65dccf283ad341705f709b17219d8b6d8231d0511f736b934f9b878493875ffd4b61c4520c7ad7fe7dd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69c279aa787373b7c46245d7c4a063a5

SHA1
dd0f72bb77b2001b674bb19ca93d2a63726c75b3

SHA256
6342242b97712e1a3de0e3ea036d2b50ffb3d9107a73de95dc372992c13e38c6

SHA512
7d5daa8e108b4e267d3253577b42b8d25b9a0e00074fd31fc9a7795fdaad7179516902a16abe42a4b145e78d83c66e08c77597e62d8217f6e6f05ed55e1ce80c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
617bcec666ce4086a73fe2bcf8a7e004

SHA1
f17aee0fba54a7d068eaabd53e2dcf6d18f66ef6

SHA256
134166dc69b8cdf2770dc9aef68ea94629c15024781e26f299ece3baf09a9f45

SHA512
008e559d43e3bd77c638c4b715ccdd360e390ff6340e2440aa675a6d24181d44b8c14be468effce6de102603939edbf22c1c955609ac8959f6d723e0284fca28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c19f9d81eaddf3f3648e9c40443ee0f9

SHA1
9f562a9059bff4b139b9c38b603c76402e2a30f7

SHA256
5360840015acf5cfdbf8fc24761bf638ab495a912e2e1726a82ecb4c36ae9317

SHA512
dce1395f5519888e5d35a3139ce5c9466c857aeb3afebf2abea2b22ee80d1de8ae05cc65d082a675cf5d5ad89af3c2c593b87ace24a0b84a003abe446156232e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b523d1f15e3cd5e23b2b45b17f429430

SHA1
d7bd24cb803c4402face747a253f32366473b14c

SHA256
74ecbea675b8f3c2df048d79145f422f702846c49612b261c462d3c0b3bbdbf9

SHA512
949fd4c360b7471458181d969229c5dda9b2104b88b8a7e3097df8c67fd3d02fff70656cbc1c4daddb4f2f2866e15a030b67242516d59c4772740001f0d34d6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cc357bf782b10aba4a5d7f7d170cbb4

SHA1
1a05372a9d4c8363efdae25e58b30941d7bc45b4

SHA256
2d346b611ba6f34dbd6f1e6fc10caf24febb45a07383bf99b2878a6010492d7c

SHA512
a7744b96d98736ec1851b731ef5588bd4d8265fd14cb48c51d15b6ad666b32c803901a39688d9d10e45656f6affdd0563c43349bca4dd0bde026a6f6971b07c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD3C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE3D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit