1d90820af0819c8a57afba74220288edd4e03ff9cb77eb73a618ba2d2ef15ca8

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 20:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2ba0b3ba25086a2dd660da4ea2c6e24c_JaffaCakes118.html
Size

160KB
MD5

2ba0b3ba25086a2dd660da4ea2c6e24c
SHA1

d1df3580c0a4617703df981082e805911bebb805
SHA256

1d90820af0819c8a57afba74220288edd4e03ff9cb77eb73a618ba2d2ef15ca8
SHA512

4e79de3863a9914aca37844a30e8152736fb8269e90d5879df1e57c024f53e3bd5b7b05070577ea129cea84d09c2591543fc4fa0209bd35204e0c7cd7607b7d4
SSDEEP

3072:iKk3ksEor5sNLUbR4ABrl+KxJxKbk5U+KxeC5C:Gr5sNLyFBrQSnfSeiC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1FF077C1-0E45-11EF-A564-5267BFD3BAD1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421449420"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1220	iexplore.exe
1220	iexplore.exe
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2468	1220	iexplore.exe	28
PID 1220 wrote to memory of 2468	1220	iexplore.exe	28
PID 1220 wrote to memory of 2468	1220	iexplore.exe	28
PID 1220 wrote to memory of 2468	1220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ba0b3ba25086a2dd660da4ea2c6e24c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14771b6b2d75693880daf71fe221a226

SHA1
539fc1a58f3f37dd2dded7917864cbbdaf1f33c9

SHA256
71bdf3b66c7219d99c17ac09a41b390b647f06f370b974077adbb197a09046d6

SHA512
c2d43f5e136c7f5efe0bd8f6c3a5745c533d644c8db89ba1b0103bb419d455a074526d3ed2f44250533a4159068cb95e04ed4da0e3631b29a2989fc606135ed7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
869b52c105c1937009115c716e00b1fa

SHA1
dbfe658afa15910c90dba603d89d7511fb2e5406

SHA256
351c99af903b79ceba356ba06bc98a73eb2b62b2de5ff9590b525297f18796a8

SHA512
0a26cb9bbee046802fd11da8a9254855aac4972e2ca2dc3e3f3db643ccc7f29bf8e4c37f2cac0327a21bc05e3a95b96c0ce1a22e7af5d423f501e87bf2ce3d8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2b9c535e1d38f277f11ed5750bf1c1d

SHA1
f06004e29835503ab01dc69f8f37951dc8fe505f

SHA256
afe40bb5a6952ac29356c52da20ae528a90ec00f5e00f0a7382388beb0d82edb

SHA512
616ad3189692b1999c962347b712b6fbe1f9f893d15c747b0d2b92af6c09cf144a7305ce1f3189d260dad218ce29ff00a46c9bf1a275a454a0bd0f2c8c8d9553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fc55fc9b6900af09ac048c79827ed48

SHA1
2f45c1dfca4a8e463e7187330336a23babd91321

SHA256
0246621d210bc03d7ce75473acbf49e876d634aaca57d740018209cb028c19f9

SHA512
cc5844c72fd140657dded3a3a57feaec7058ec5dc4f3e0c240a77eb38744c4e00f59d776af66a1efb51a906c2a66a31be592fd2da7c3ad16d6abff1afd82be94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61b298151f4261254cac568d1960b6da

SHA1
423cc69786057d5c46063294bbe907ab96001ae0

SHA256
def2cc43477ba87a6f08b5fe924a7357e635fd06369843215ba4b19aac611533

SHA512
685b30577a7bc1db06ee4f72496c292f333872e8f36035b1e1352119f42f392e8f5f95dd6beb76dde65389d7b03e2b0c65f02c8f54421943260f8f459b4a7448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d8b081462b42480e798e0a2a5b5100c

SHA1
f98131a237a83d6ea08e37e7b9b7f4397f240c19

SHA256
4559e76b58d1807e6ba321ff0750c55b25826d7d25d4e2b0e20ecc21d87a0966

SHA512
b8b3e6f4cad4b3299292da53c19a58041a4526d6379a05f402334902fb09f122acc4b55d2027fb95d476bce873ddaa3b1518e5b990083973a31fd1a479e333af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94f12c69429c8c5b0e50e2d05c750bff

SHA1
b49fad8120bba8f79a7f768ca416c2f059df23de

SHA256
5be9e1565d3b33b620886163527fd970da1227d262fca431414ab88ed64006db

SHA512
b8513336c7204f05d3cb1343bd611381b5ba0ae5520c7f403825779b41d6cdf6b363ad2096b9c108dca4dc419eeb97275a7e8d740cb3aff6cb0351fb7d448eab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8340320e20dda71406ce8e3cd7203579

SHA1
3a0f18b29877129181556da5a1dfa820748638be

SHA256
7b509849a69740266c3c34bf3dfcacc385a7b5956056648c52ac4a18b55e18ff

SHA512
b8fdda67bafc76fd332bb24c019e2277bde71a128637bfd34820427a2ae0b609c1bdf409300bf708f38e8e767d66f3ad8c3e05a0a1d47b0a0db0413b8c960e5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43fa492d8f745fe0a1dd7c95b7566643

SHA1
f64aa904797fb03cd33e1c9578b3ed259190249c

SHA256
1ebeaeabc80059b5bee8a10b18cf929e62773071ab9f05fe6b5127a7d6c87596

SHA512
96c2a5beceb5f8529c4331fdaedc8b15cf9dbb02a235255040c3987f49fc5188cee3944d9fa60665ac53af48a356544f14c28cdc127b515bc85fc848ff0dae05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\f[1].txt

Filesize
35KB

MD5
71e80fcef249dbc7697c30314e169374

SHA1
52d080622dedf1d9679a42d8b016654d0b08e3ac

SHA256
8964898c8d40f74230cff903cc6b5161f629e49d22b6f110f199b64c668d4117

SHA512
3c8295ab1e7b8a77533190c86a71d2fda730829d9e207d68c9c38d1d0331e1aea1a0dadb46c4f80f8c672904e3f1fab8c67541196334a9809dde916bbe28235c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2AA9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2AAC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B9C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit