80f065c29e52941ebd23525433a1fae3e4c507a74bb63ef2307a88241bd0b6c9

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

487e447e5be7e9eacbfb20491d29618d_JaffaCakes118.html
Size

120KB
MD5

487e447e5be7e9eacbfb20491d29618d
SHA1

f8871e9ad80fe4d9890ecca6fc7c5592eca21c02
SHA256

80f065c29e52941ebd23525433a1fae3e4c507a74bb63ef2307a88241bd0b6c9
SHA512

7876d881f4fbe07dd6eb7f6497654e5b91231aaca4c2908a6f5475ac1a6fcaede7a92761b6dd997d384de03cebd04c789afada521147fabfd7526e8c7f17a9ca
SSDEEP

1536:W9kYsYjHCDhNfF1dO4UDUoUOGU/UQUPUrUcUmUPUMkU2d9wT3GZ5aEnww7uQ+0+e:9YsYjHCDD91qeVMJe2XeiF58Da+MZF1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421976619"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9BB67061-1310-11EF-B27B-DA219DA76A91} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2744	2072	iexplore.exe	28
PID 2072 wrote to memory of 2744	2072	iexplore.exe	28
PID 2072 wrote to memory of 2744	2072	iexplore.exe	28
PID 2072 wrote to memory of 2744	2072	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\487e447e5be7e9eacbfb20491d29618d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61

Filesize
192B

MD5
b2b1ca144b7be5c5f187c5f56626cf57

SHA1
55ac1e16e925af4bf750a0e3f708ffaa3564876b

SHA256
a8b446e0a1cfedecc0d5c75791ae97dda43684b28f06bb7aa51429d560660bdb

SHA512
c90414bb3e5e42417fe7108a505b3f629f40649d837cf95a1d63c26ad10e51cecb70c41b8785ae2ff6fded88cd766c9084dd998815095c7f1f6948b004b9e76b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fafb2da325cde13c96806ee0bab80387

SHA1
d248802a3aecb94a30906ae5654e4fb4962e0e26

SHA256
3194a5e0b7d29c957a28f40ace0311f2e8f876781ccd9455f89cc94f1fca5e87

SHA512
eb7af95d1858f270f58e398daeac42e290541d38161312736292dc5a63708c40c46a16ee420017f5071f4f193e601b12df114976c6c6633600fb70f73cac7dc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d03d4d0f73ef827180d7a222919c80c4

SHA1
04ae1483c7b14676383cf207272a845fc924dd86

SHA256
d7ba792d6414e65ccc22bd8f25c9b701aba718d79c5144f09d0e5d6114126bf3

SHA512
dd2fe767dfa4ec99f45a4428acd960bf05d28e94d6d638b54bed60b1496b5d5f25cb69c94642522c896ca2ebdfb5aa7316aa44eb63cb2706146cb9daf26db07e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6844c2898119d3559ef96551b8262ca0

SHA1
9d00ffdb76b17e8f891c0d193d5ce32b84d95015

SHA256
741aef578f9c4aaf2eeb7baaaab87163ec7a1b5bd547cb0f4226d0e562a8a449

SHA512
fa23f9579492f4936e7c0c213b1881089e72d6af418652c9462bf85bb9c0314d8cf151761896bd6baf6497b282f21e8dbdb2ad6aec64bc2abe11329578e494c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2e8e6e74d7e08f01082b482f0db310f

SHA1
ee0018804401c85d890a31e8670d8a883920481e

SHA256
d4105db3f2a0ef6f07f362fb056ea0c4b9370efc8df0d1a7fc54b974b0c28ab8

SHA512
d2357dd2eb934213db5751f06d7093e1c918821443f44f66469deab1ceaaa7806c75da703f3dc7ef2ff5f05b1acb240d6e4186ac384b93599f6fe59f960d2ec7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9278cf62ef6ef81d3dda64836da344a4

SHA1
06e26bf213138c7bc07263bee4a45c9d2a774723

SHA256
4fe66c42dffe28d7effef5405a695bf8e62b67a2188f64e77f4b58609b8cf34f

SHA512
2397519dbededf7b2e28b9f7c2d77ff0a24b456a2ad3ca2d86391476b62bc21ecdf9ba04ac1b3b1cbab9cd0064018fbd8d06ee4fb2314516179f69bfa0b30005

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77600b2b5643a90280f9c7babae83a71

SHA1
b34cff034245efefd75c150fd0c8b9b4f2c462ca

SHA256
fe86bf233d5b03840236f64c5f245da1348e071d404eb91a98386e7074be1a6a

SHA512
0a510414cb5804544445816cc41bc4ecdd80cd363f506ba2ba27e1e00aa65b348f7ea17f1539bdbc02332b605e501fa491aa251680a24f3629299e1877e5ad04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
558538074bdd2fe787c3c460affeff42

SHA1
8db28fe2f5568b97379bb6b6629f253108fec7be

SHA256
d8b37511a105dc5f05bb5fed18167ce4c8bcea42de9f09cc608bf2bef024a73e

SHA512
2df24b700181862683e5389a4e85b06fa4fc2231aed2b9f6ceaa9db21528929a72b01d51afaf820a44cb241c3043bb1cf8850795b9ad0949c10262f9a1e434f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
212ae11e74365f432768529e474a301d

SHA1
cb19c0abceb3f33a4e735ff1525e362675a5eb05

SHA256
9134f1b4beb1fecc68a69f94cbfe9abcee50424325c2a0b4e56ebf40821e11a3

SHA512
ad12e5f69d2a9bee575e134364d656d8d2e7d6ee373e35b3d69ecb087284778d55703e2b1c815d79f91f5d9625fb4ae78d4e7612250abf2b18a5e06a60e9b461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f7796ede2bafdc7561fb698ec2dbfea

SHA1
fc31402a1e24018ee5ed2be57f8171a572269200

SHA256
225eaf6e11b39f7d2615cedf9bd2a3e1fd5b31a328eb58d143eeb02df1dd66bb

SHA512
b2354d3f3e98182165bd3499159b04e6d6d8159dc33c8140acadde415661a9d15bde3cdf566ac74fa96d15f8ddc0953be0b1359b157f437b9006b5ad4606e579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a37b013564e38909026d655fc41a927

SHA1
2bf0703c611db4f8fd86cdeabc1d932254e97c8e

SHA256
c2f9225eb6b26a531750b7cc084bef4206924f2863e20610beea005e70bad3b8

SHA512
47800fe9196e81e633a3cfc11107d39ac9dde62d9c1f7f129eabe3ed96fa07e824994977fdd3f21856ebb1e0305df13087212841244210524629ca2642d19e11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28e94833aa5defc9c7e0aeedead0f940

SHA1
e4f37cdcc20646c837286d2e10a6c19eb37d3560

SHA256
00a82ad9294753b0decc5a4be5fd3163452ed5767b572b6dba0023e855479a9d

SHA512
8558682a3584abed937be7b7f2e60c66eb3447613010d9f74dfb2e2ccd5c9a046a6f317d6fb87e06d98e3225c3ca3536443c26b6c694bf34215d8f44a1aba060

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f84c25edab09cb7bffa46680dce9eb5

SHA1
e4d78d4f30a99fdcb59f5caa56aa88649cab0f85

SHA256
3630b101ef5798532c4bccc747b33f1f0b1c94b19627ec64eea2e4280406ce13

SHA512
f6bdc24d0a44d7369ed4f8a1755388bfea058c277bc8dc4a2430b7da0200a3144916bbf0191c39004a71a0bc3fa3ad2578b3d1dcf7348652ad20d9cf4516c0c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NVDR4C1U\display[1].htm

Filesize
173B

MD5
bcd560eba80b849c980a5123047bc8f8

SHA1
cfc17fc5f3743042a8e00ea8d8b2a1e17a739f89

SHA256
5bd1cb20b56bb3ea06d9c3f0abe9223a38e93f3d833df496524dcdebfeb3b4ca

SHA512
1fcc48ff7443592fd8bc612d9625171563bc1c6a31d825fbf1fa888e4102b1ff0616a425f5d59bb7784a671d86bbf0cb637a98be95de8c94a98dfa9a13349a2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab29DF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29F5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit