0588b40046c963b41f1b7c9ff478dc4465697b2937658a8f6a856a56cc07f026

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5113b2191c518f39d175480b24a143d8_JaffaCakes118.html
Size

48KB
MD5

5113b2191c518f39d175480b24a143d8
SHA1

c4e1f69b0299daa246ab1ea04762b831729f9742
SHA256

0588b40046c963b41f1b7c9ff478dc4465697b2937658a8f6a856a56cc07f026
SHA512

8843d0f0bb26ae16f2f502d1e20e491ac8e0b6b4277bc55ec3016374a3a1d39bb3fa137c97f1888353c760bde0d748528b8502692513dddc5d053246f5204b0e
SSDEEP

768:j/Vt97Rycy2aWzkHa3Z3MymBTSaemAEL0jqckF8SC0/ZuOU:xt97Rycy2TD3iDZSaemAEL0jqck0b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422135486"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E8DFFD1-1482-11EF-B2FB-7678A7DAE141} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2808	2172	iexplore.exe	28
PID 2172 wrote to memory of 2808	2172	iexplore.exe	28
PID 2172 wrote to memory of 2808	2172	iexplore.exe	28
PID 2172 wrote to memory of 2808	2172	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5113b2191c518f39d175480b24a143d8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee4d85ac68dad5b0182687a18c04211c

SHA1
29cf6ad9aa0f28a0e8d8997ecdc09ad127089bfd

SHA256
6614dcb7f8a0dc4a7f99826acca1ddea276d4379485b19e2280d456d1f3140ea

SHA512
310b39be222695c81c604909656ff7270245549ec3e60d63b8b6a8008e9dd9ceb8cdaa50dadf70251c211b0832a0c4093f901fea7024b49d2c9bc3d8a26956ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c236ed0bf089628c0547a5d167e488d7

SHA1
f5d38dee5116c77a98d47dc2d2fcfd5d06e4f8a5

SHA256
3331167987eb41b466b3c427ed845ddebb106632d0ed8356294a2086e8052582

SHA512
76fb243a644dfc4e1f229fb36130160ebc8d8e9f238cc928bd1a6e99c16bb04563ad43d1882e2e180ce80c68353b0d9d007bbd3280eb0ba0c10e3c4a15a97d2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb32acd0e5f4edf2d3129dd76b599dff

SHA1
6f1f4c4a7f21bce2abdedf4f6afb331ecec1b971

SHA256
8a53e21ba6c536e4219e0434e769f5464b561f91b38f3eba5b0957cca7a862c9

SHA512
a533a8235dde3864587661fde2b8f92dbad251682a6e5504b7d512d9ee558f4a14d46bad65cb636124a3d08fc9624452d5ed8d6bfc8b20b5162b7c0a8fde2312

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8601ec2d9f413a027c6afd840a75099

SHA1
71a8b62446732dd18f184d2ba3f42635b85a7ef2

SHA256
a9e558ce2461b7a5f6ad748f8ecf28447be3b3993b47ea1aec9bdaad2f8bf988

SHA512
fdc91d54d1fbef21305c942ad63a7798febc83e9c0a26abe5bb87a8c41664cb300c29901d5bacfdf7fa97dd655612b02a842e0858d71530d5cfee4a84475fc9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cba6532d865e4b5e6a9e7cb1cce7393

SHA1
ab91496e30697673e0175f052b23e8e5ca7906be

SHA256
6e588eb9bafbd64a811aad0009c79f05b73e8c30887288275ded4cc9e8558352

SHA512
ea265c0c3af89ab39e4ae28238522d7368d3e5d5177dafa0e2359756788a5c8ffd338983f29e5332b8f6aed55948e00256a260d4b0c64a6696dba91e6e963acb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fedfb96fb4f1b2ff50032d23d0cf3fcf

SHA1
c89a8a7ea805fd3da8641fde09ffb8986f62899e

SHA256
6859f9a811f5cdc8dd109322cde7430a9c4ca1faa4c36cce138e477cb80e1c47

SHA512
7851470643501f2e9189d39a12b9f9fbdc5d5b6290240149d04a1256f73e00e488a4005e91e1f55b85ad0f7af49636678c15ba0b6dc123e99cd8eb5595cbbcc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d61c6f3121908e1e30dc3a4d3d45829

SHA1
b12d3da47f5fdb265d47e265f0bbc0b4ae5f916c

SHA256
b91531c02fca09b72664ce16d2798d1962120790169f4043d7c8a9d722e650e9

SHA512
bcd9877233c1875fd83b46e8cecd50b020bfbe3102352015d2ac71bf4b0b282b6f1d49e99ae5b1fb686554c5441c20c93269c87fdbb8ab9eebb5b97a81f03fa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac872ff4182db66dff0725f0f79fd132

SHA1
3c4c6b62535f889f93548133f31eea3ebf8af5ec

SHA256
c9584be8ef4c8810100968a7b04e5401b112d59fd84fca065349b6e91fd5875a

SHA512
3177a14591a6a76eb6c1e1bfe649f2ab33d3e5b3c77a43c20e80aab467f2e687b446e9a140ffda7adcc0f0857de004bd4abfa2f79e3247cc1074df3cd41c188b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72d13a567c1c30cc715f403d7cb45f48

SHA1
0d89aff0ff7060876a0677ee3343b8265bf10393

SHA256
1d8562676d19969052db5e817a8b820cf4da329a0ddaffd848d9259ecb36a722

SHA512
3ab9ff5f6b076c156e1c9f06424dbc94e08c11ca40a119f979e46e7bae25878a8563992ba0cacdbddc0ac785679977c130ef24ea85a7993d9ed38a7fe8a2e230

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A1C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A2F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit