616a36e0ab136dffcbfce4b3137eaafc3ffd6ca238d08de1787687f62c2f5b94

Analysis

max time kernel
65s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

454e6d462d5bc5e65e1a9fcf72966a67_JaffaCakes118.html
Size

189KB
MD5

454e6d462d5bc5e65e1a9fcf72966a67
SHA1

e17df1b873655bd59339d280331583b8437cedc6
SHA256

616a36e0ab136dffcbfce4b3137eaafc3ffd6ca238d08de1787687f62c2f5b94
SHA512

4ceeba70c1098c2e177050425027a989331b453ae8b12c6eeff7ebf0b41e1c93463053dd14ba593d424381ccf364fbef1ed79d180843b6a8543c313d14e9485a
SSDEEP

3072:S4TAdiyfkMY+BES09JXAnyrZalI+Y6XXI6EyA8:S4TAdnsMYod+X3oI+YS1tA8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9EEF7E11-1294-11EF-8FBA-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2440	iexplore.exe
2440	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2500	2440	iexplore.exe	28
PID 2440 wrote to memory of 2500	2440	iexplore.exe	28
PID 2440 wrote to memory of 2500	2440	iexplore.exe	28
PID 2440 wrote to memory of 2500	2440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\454e6d462d5bc5e65e1a9fcf72966a67_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19842e4a55a429a0d645b9668d63883a

SHA1
4c3622c81c7c60fdfe69747b75f7d63b05ef63ea

SHA256
4b1c228ea7c2b59d7ef8ea13cbbbb263b1c826b36ba0eefb408904bfb0512f8a

SHA512
7bf895ddb10793a4e8557bbe7af422a87d29545f0587962de62bedf9cf15d75764d7ae7f494bc0fc3ccfaca02d006e009f313d905d7707f670b1d047ab756df4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4ec4b344e1dc6f30cd13e872f635835

SHA1
de0677f85244892248e87ee20bdcb0134b1c3e1f

SHA256
5cacbbc090be0edd04e5460afdf35ec46e72d1684440e0e1f88d3eac879611ca

SHA512
94c7797c10ba7f454ac640d0c436a0068b49091ebd827c68713754c73bb637a91b8549bc76eeb29b1971aa08b89830b4310da9ccfd21a5e97b0d1ea148e76460

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48643ef0957b7ee7aa6d0f7de41e22ca

SHA1
889639773cf98d84e35ad4be1868a85bf0cd46b7

SHA256
d8088b1ed42bad99bb37e3ea481f72b5adac42e4c737bf0f0a372a18af84e48e

SHA512
fa25391dd67901933df4d5de4512478b8d4c67f3cc34f8824ab78d6ff2a5f255599465cdaa3ef63b692b1608f9d5f51e8b0d33a0663ab6d17cb5a0bc15068e35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30b8c7c7b01059995aeee57e3a7b8042

SHA1
f9e7dd34f552f71d8ad586dab870aebf2608a399

SHA256
67a8f4f297717ec7f9f49372bd61cf13919235bbff73415924aceef401c25acd

SHA512
2f25a143e97671f0958c48f70a1d321e6c1de8531741770864fcda6c2998114d444d2c03f6b7375f67fa2b14605dd2d3f77faad61d90e43564161127b271762d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02300ee4d65c1013e4ee955736752663

SHA1
a04fe06ef996a4d7f7d67473aca4992a855c8c64

SHA256
0fd35ccee459b5b76c486b89188245b85707dcd2ee7ccea5cd07636b87efbd93

SHA512
b1b8e6e61a1f15f27da69469149e1e80df3ffcdb27a124353504380ba43d4ef82bd05762a7d558d47a7780e30af2598944f212e04fc81600f35ce89c9674c620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3c9b1f72b806aac8c38a2103639400e

SHA1
702b31969235ced8715e51273bb448f03ac893b7

SHA256
08659b6d66ce7bf3e733d4b12433b323335b195978b4ae0e428cfc8638f7ac71

SHA512
3a40a397025e86f6187e1bea27f56749a7663432cd9e975f2cc373b430e808ad5e8a3e8cd523bd771e76dc7002b2b40ff3b79af8ba8e01a7a23fe57bb49b4996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b362801aba78bea67b7bd0da3fe5f35

SHA1
8531c9145057756385055083078a71a78d3cb32a

SHA256
eb327fea4af8fbf4d64002ad4db1b0a0218de00f696de10fb1a585186c9109b1

SHA512
4c9c4622ec9e5d79fc5412a6952ba9eaf2efbebdbcdc91649a2a1998cfdc2a28b3c9f54eaad0e206dcd203f64bde9e1c436bf3e25af65a7198dcda4324ab1707

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06f78b4881076e901f3a618eb4cc77b7

SHA1
c89d8f25eac91659585a2a219defe250d64403b4

SHA256
4260c9fb2d8e1a82c078029856dd86870372077f215b962443c01846eddd0555

SHA512
ac2106db4424bfcbcbdcbf564e118565bf27908e7e1ce3f5a107fb80d4c0960766f0665373db6953100bb77a957d51cbcb0b83198845dc7e33b67cb95d2f72ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4709a6965ba5309e4916b2664265c052

SHA1
df3629c15323bac440594d42874967c5e39a5eb6

SHA256
993f7c7899aa7a74e3f2a6ee4b28cb9a6be65c25a3c2d359e069b852642e9efd

SHA512
e3a9e7ee9452db7c037146b444ca05d5ade8ebabc16072ca07f5f1efe58e3f6289a73b4da7cd85aa263e0fcd1bdc46159be6e490f0fae49638eff00f1a58074e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
768ba05c7180f6c706377764d370c3b0

SHA1
a1c70cf72b180128840db6b5ec98dd49dc5e6dc2

SHA256
bdf2fd264abcf1171e952543562934caabe185ed4a8eeb5ff49a2c29b9ede3f5

SHA512
68630d647644e9d482eab2fae8f040fa6e871a1dbc6ecec802cd54fb7a9a0cc27a6f012900f5f523c608b0f96fe5b612e7dee3fe7b07912f35f46a0b5198daa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ad74add3dc4a1715b0d9a4e5175221a

SHA1
292b991e91deb417d9d552bf7b6f1673af1576aa

SHA256
d0f53eeab79328cc973c73e537d35a9a73bde7da3a648057b613eb9406f45c42

SHA512
76536e59fde26a45723e4c526552776027846c87a9ef9bdeea687f8a6c3ed3bb9cd1911575e5ce89aa42ca7e4a7120423c23da37406485a7b27ec4bcc2bd20b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b403adc3af7a4e20d660127d0d8389c5

SHA1
d7902494d2691022e7f593db2eb66388b4ab13d2

SHA256
162a06d7ecb351e23ed61340053016522fa12cea58955fe2846acd7b3916bf33

SHA512
6b60413c045f40d41c8bb2c9d8e4cadac27b25e9b4caf2f60ab1989f55d9cf6ff9104235d46638bc15bdb60e139e936036abc41f36b84ebeba4895d354803172

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ad33cf570bfcacbfcd6588ee1d27dcf

SHA1
4e48e1b4b83fcc54cf333ad74a126b7168f7700c

SHA256
26e3eb2612dcece03f10164563584804f98f2c7329be3dda81c09315e4d72d2a

SHA512
5cc58adf36d924a7ed32a61d83d404759343631cda264350266b568b71eb7e8d93cbe90b4698c4ac7bd8a7ca3f5414f224330e7c4ec1e13b362efc8d75fb130a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0730bb0a827e5b7f72ca9d7c00f9297

SHA1
02e79e137ce06f7539ff6c77f92def13113cc45f

SHA256
01245343976babcbc236e94d9d61d1d620cdc839de19ba19d56d4c118fff26a4

SHA512
05357e5c828cfbd072ce1e8cd35616c0b038af310a60f791babce8f49a30ad95d0869a78b3068636399b30cbacf5979be51316418bc19b94a0447e9ea883c6b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f8f0b08aa5ca820f37e71d5621045a6

SHA1
7035368dd9be47f1046d1ce117aec7c728cc76c8

SHA256
c91c4b0914303940882ce399cd2707c55355c8760b681e990c94220f73220859

SHA512
0277cec8df5ad98874df6a829430dc66d9e33f9bb73afecff23891403a936f3ca83e4b35ce8cc72886e7485e8edc31bc6fef1d63b018a79ef10abf4d1b1f0060

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab15E2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16D4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit