877becdc8032aef15bb9403bf69ee72b26ec7e42f6c29868b07360705cd4938c

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

50a54f7a5d6b0f95fac20a5d4077cfc2_JaffaCakes118.html
Size

22KB
MD5

50a54f7a5d6b0f95fac20a5d4077cfc2
SHA1

e20ec600ac2759306ef1b6287b4b79eef1090586
SHA256

877becdc8032aef15bb9403bf69ee72b26ec7e42f6c29868b07360705cd4938c
SHA512

b85cd42f0c7fdc4ff206a1c84ba5157ba7f6cd07f223bf9e89c2a0bb66f75231852d184939bb1c017183c301c8c114975ec5111a374a4499b5520ce6c9975771
SSDEEP

384:KSMO/T/itoic0ucFuiEgxmq1ZN2h1+Dc9g3MzD17CoO/Ezc6JEZu38qb1:j1mmic0JFHEgxDc9gotCoO/Ezc6JEZuf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE125BD1-1472-11EF-965F-FA9381F5F0AB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422128826"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1264	iexplore.exe
1264	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 2216	1264	iexplore.exe	28
PID 1264 wrote to memory of 2216	1264	iexplore.exe	28
PID 1264 wrote to memory of 2216	1264	iexplore.exe	28
PID 1264 wrote to memory of 2216	1264	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\50a54f7a5d6b0f95fac20a5d4077cfc2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8276e1d29d0ef65f8d426b9eb55a2ed6

SHA1
8efb6238c7e0331f13e39a941478753d0e405285

SHA256
0fe7a5616557ffa70e6c0fd5d3328fe973e4978c8eb07266499a51b5ce87af07

SHA512
9b0b9b1d8396eceede75fa416461523f6b7e596f7fbf7781d8113b99899c3f66911786382acabcd97f5957efff668d421697cef19cdd2711e33a6db85cd33e32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b37d7158fb026d094e10b8e51f05a56

SHA1
24bfaccea7160d6a28bf7621b423edfbf2892524

SHA256
72ce38333e620a06e151afc68d647dc48592d82302700875429227aad03fd8a4

SHA512
094c7a6f1ab80a7da6b8b862c896cbd05c590e0097a504b44ccf2a239e5eb30108437ae95e0c41658a46d12210c49d1f4f0f62495a424da78ba34ca08e5991ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d53ea3a3a2fe6a17a3dde43ecec939f

SHA1
c999ad384c2994eb90817d34341a73c53a1e103e

SHA256
42f1af8dfdcd11a6b8870913ffa475d0bbb012bcf0bc82e8ca24972ab1959fd7

SHA512
85e744296b347d1f8a5793a07aee0743922fc66f6f9a74e69b998b28c912a149fee59785baf77b87086165a8eed1e364dd7fa01536f805b1a6e5ac21b0fca683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b988b47d48c2dedd594c3642fb077475

SHA1
0d37374194be08bfd205692f535b53f24439c919

SHA256
7aacbb8e3febaade7fe0c6f69e301963a53e30babc9be5451f4b805b04faa170

SHA512
912a830ff88c0639d52dc5f9d0d001965da0ff42a3d520c3d2cc999730993aba3ef18f8cd7c5ed04ab9d75d29c925dfe1d1ff1980bf65a5c874a3741aac9d99b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d85c51dbecb1ab661741940c7c86df5

SHA1
fb2e2953aacd836d1d160b754959618b14e5ec45

SHA256
47c2a3a583b42d85d866ac155b412a04bb96024a9cfaa66a68af1f8b171d4a68

SHA512
652543df6809a983d6f8593023425eed37ea17e3ae940d15d1e2f4b971b2fcd6da497dfb82487b05aec78bdbc02cd0b12f6378fc8cae2f973024a44fc0f86311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25afdf805f947b21194c339340dfca72

SHA1
3779231b94887b77ef21bc3e43364265ceb79a66

SHA256
f508fbb320d16075d51669251ec5118379eca85efe5e3676ca37aa84c93fd6e9

SHA512
01be4d9d1f8d65547a08ab14c6b459b89b29014af715a49036dbea058a2d8c33b72cc7f4df700224e5d761f78939fe04f5ab1dc00651b410421ef90b3bbd4eae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e433c6c0051d41d5f8255972743776e

SHA1
03701de9ca0c710fd813501168a56f36c9f445b7

SHA256
bc765a19627e707be7f98984a9bc96e791a12f488803115c3985529d188a4ca7

SHA512
68621d79f17502a7ab5e3aa625d876c26efec5ef9feb4ecf6b63aff4fb6188a71dc9cffa8ebfc9d6cf791a7a8c7e5636c6b145cbd47f84be8528e5f63237fb9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
057416ed2520dc4cd15d2a967aa1a170

SHA1
933534dab3e8c282426f73abf81a2f43daf81c26

SHA256
19337c3e7b70cda493b16be4761ab01a7323da10cf3584b1cca1fd167159f232

SHA512
12a18a1a16c2bf78ee50d7ebc976f8100074de3ee442cadda548b2d49ba67ed0676235c1be122d3475df54c105415e86e724c46a3220bab8b9cdb42e7ec509a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b86ea349bc2c0bc07592a6bbe986f1e0

SHA1
30eef25b5d42c8755bf5e8021dd6334adeec6848

SHA256
b91149afcee09cec0a7f008a1e48ec847c185d428e0a9c545db2d75d88e548ac

SHA512
20bd6aa22e9628b35311fa5ec2bf8594a729b1d596c67dbef79d989b12ef10fd72d73537b5a90bb817c7a0c7e3d6ea64c087a650d7b6d61c3dd0ffb8e4dddddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11a9eba8d4176f3e533711a0913b3115

SHA1
a5df0081f988dfb128e1525706069125cce43eb8

SHA256
fd7217c795b96cedfd1e3c04748e5a7266663ae256891dd6b6d26ec62a875bbb

SHA512
248109992c7090a1f592c0b09f3f28e14a685d0d457c15861b724a2a32aff976dace83d62ec45e513d667e021300b0496fe8dcc4278637bfe2e3fd6e89229f5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F3D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2FAD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit