b7bd33c5977202458d8a554ceed2caac9556951faa447e9db4e4676e9ee846cc

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45e254f023e25ecfb8b40d8dba67dda3_JaffaCakes118.html
Size

18KB
MD5

45e254f023e25ecfb8b40d8dba67dda3
SHA1

ae71ce54fdabf2b2258dd11a5f2c74dcac70b571
SHA256

b7bd33c5977202458d8a554ceed2caac9556951faa447e9db4e4676e9ee846cc
SHA512

0f84745288b2feb3104527b58f78bbd1a5e5eecaa30ccf2cd194b3a8f24e529804e6ee7db4cad3bf9d44388d1bed57d16f40170a67253ca2eeb4bc5b91e8a67d
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIr4dzUnjBhnJ82qDB8:SIMd0I5nvH1svnixDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421933126"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56E58261-12AB-11EF-9FA2-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1612	iexplore.exe
1612	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2744	1612	iexplore.exe	28
PID 1612 wrote to memory of 2744	1612	iexplore.exe	28
PID 1612 wrote to memory of 2744	1612	iexplore.exe	28
PID 1612 wrote to memory of 2744	1612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45e254f023e25ecfb8b40d8dba67dda3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
651f92bd2a176558585434f977c0f8aa

SHA1
4cc7f1720f832f05394f9f6f7cee3f47a8d91afd

SHA256
1710f9b791aae55301f0dfd53a2e7ce971b56ccaa8787f8d57b06a71ed73e02f

SHA512
469f387300f0d2a0fddf374aafda512c279e7b37719747651b799497a93230261bbba9d9074d4163b913adca5de83e146221a2dc14ebebf15c152648b4861bd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
deea547323c26d6a8bb9689e98ab1bb8

SHA1
ff47f3b4a4905da0ae976b4c77456e4ff8e544e8

SHA256
3fbab550663aff67f57dc6fbf1752ed583793de53b55e99e1a9018de99b89f4a

SHA512
0d147cbd93436a516789d984209a0fd9a45af2142a6376dc324dc77f6586acd0f55a0957cb3cd97b4e9d0dc7905cf2eda7ddbdeb028099b0a813725764c99ab0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2c91178ff9cd8a3e009061327d78880

SHA1
6ca8f7717baaf45d5b699cfd6d2526455ccda2da

SHA256
d7bdfd701e617333ef5b904c5f2da1dd03a18aa9f78c05af9b32ba00c8ad8b03

SHA512
e885672658f52d205a6d898213e1b1612cdc0ca6b71e140ec55262635ca709099e710d395dc427c5de12b3badc5ae5d5697ee0adf8488870d6f627a88876f361

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
520c42566cb4ebddc0295af883237423

SHA1
4ce4e6356c735df5bcfbd35d5f5060949d40607c

SHA256
d9e31c5613643a753b9f8a6d14c680865023e0172f438531cc988a32c1ea55d2

SHA512
d1359ecafb30d1716e959f0d8f9370a81d2b2335759e4eb87d46dbde86aeb294b3d40ded294159d4e7c0a89df3eb3a1c1e122e31d731cc396422f82468e80af9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5babbd167633c0ee48e26059e25618a9

SHA1
6abca2780dab43cac4f36a2842f865899d21ec6a

SHA256
6974a4c1d78d77d4b0dc05e48309692b91a7994573bb62a2658e98245d6fa94a

SHA512
331c886a158aac1d273c64d467c0084a7795b76f8ceed252a3afe6421f9739eaad608729052f1842616dafed30951e531f9e74d85bc5d338f08b0d85281ee248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceb15575c89b990d11e7fd95b1041038

SHA1
4f02213dc8448875f50dec1c3eebab4591be65b9

SHA256
806e8615352cc337196c3156695662a0964a7ed5dd6be9cb234db56584d87800

SHA512
326665594011222f96875fa44e5862e2783ad96751d6fb490c70f7000e73646eacd2a6ddeca2721ef6e48a007d59ac93ca380dfcb9d2f95ff2835e7270a8f031

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa00b6e82349bfcd98e5c6c51d89fdf2

SHA1
20b8619c56a2dde9f8662d6736a00808bce8aa0d

SHA256
04d778b87e1b1ba091e04d14858b9d740c2f1a0aff3e60c093e76c6896ba20d7

SHA512
3133cf71404ab27e2567f54af4e28110a2479719923f3fb7039bba927501cae7a9155fcf76d1c6c0305d537171b27ac52ced990cc60a67b579728ec3b490d830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9daa19214cc38ff8fd4c3d9f90beec25

SHA1
e300e94a31c06181c177ec2d41027d048108a142

SHA256
0e6cb1dfbaebc78e40da185f78af6fc456cd45afb617478c1ebd3b44394fda45

SHA512
5017e5c09b3105bc599a083a49c7ff019d199d80ac0c98e7eb79dc6bc39298c30d52f7711638760e962e1844c86e96c60b8030ffc5e45a1404b68afc1bec99b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8457d2d4fadadf5c87b0a553f28fc10f

SHA1
b37c88c0454fb383c627078957b0fbdf89108a45

SHA256
0c06d9788f4d6d1c111b5768ab930e853dfefe28d600a2176d6a7f10f45a00ac

SHA512
52b7a36f6a18c4182e447901da1ce1d673ddc7e18d69c068d6fdc90597abe2d1cb4bd46ec6b13867b43dd2c50a2c05369a33e31c77348a0520e2362cde3e0ee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff5dae2631ca2c62d028edf714bb4869

SHA1
a71078fae2216d752f5d56ff1a97ab9087087a23

SHA256
22069e2d37d49b11318e5f3ba078d019fdac4fc2ca0d8b8b7234546901c3fad1

SHA512
2553545051401e6f4212ab9d979c7d682c3fd21d6c192e21c965027dd79506d9844b6884ed518b8c6cad407e71f294fc2f2cadf3dba200bdedffc4c9d9562519

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70038945941c46fe3fc0d4693c7ec8ee

SHA1
8dd4417f628f7e18232c482259e89b31c78d45ee

SHA256
c75ceb31682239e3d0fcf66980f070e7555e5b996a76baa360803c4fa0d2c4eb

SHA512
a281193816e45342c7948c7fe8944304022052b908f122155d1f0d24851c2f69f734decf2364a8bf5a281d828f457ac35392bd0ccf609a0c724bd7d9b0b1ff39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8F55.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9076.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit