be0a6fd5e01f3383bbde32ef4a6743e153d6fa4878e60d58e47e61cbf95aca4d

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b8f96708b51efc65c35f466a2a5be2d_JaffaCakes118.html
Size

895B
MD5

5b8f96708b51efc65c35f466a2a5be2d
SHA1

e2ffbd51b4b32c19af4e12d1ce7b268e9a69ed6a
SHA256

be0a6fd5e01f3383bbde32ef4a6743e153d6fa4878e60d58e47e61cbf95aca4d
SHA512

0083f451b1ce4bf7f5f2a279fce35cb6fa1aea52a0022723dc9f53d9eb4869dbba491fd24a9c6924d95832a473f66cf9447293010d173196552cfe81f9d493d5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000000022cf833d5c1b965143ce50c356991dd7e213eb7cf81625470b6f558f629916000000000e8000000002000020000000f3272e948ec46499cfcac9f2d8181f56b7f7a7976cd9c189c390e60470dda73e90000000c79ef906ee979435e898bd4088b193201de990aea78c5c0b82f0a0754f2235bd13e00efdc64d26e99ae2fa3cf5c520ebc75b0bd8fa00e2875aeea45d3d0da5cb98124382e18ff38ac48b5f398decd7d3cc2d78169754e2c3d7d0f847dec383bd9fb92c557c95f820aa775158f785a95919173ab56944eeb5c004068132afd91c345bbad42d6f18d3b3194a50afa7556840000000768ac28c915e01c2875fb62f7fce7b98a1db1398dff1aa8636ba1bb91e4cdb7373eb4fd3bedb6751016d090a2e80dc014b75bf5bcc102c7c0706687bdcd14953	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000cfa9e732841c5cbae2d3678fc19792a5e3ada85ed2a0e7aa23ee5b42df7441c2000000000e8000000002000020000000949f83932a100108601cece5949f5fd8a3707d606460cf7cac3695181c7a366020000000cf11c226193a937665b3d2107ff0091f223224c1f6136b1e0a4954e6c820e95e40000000a6ed600ceeb9b9a0af08ec4f017561fc623eaa29f974afdb6326c1a4505a679e062c6d055b1b3c98755a4b5408c35ca1c0a8b7def3f4c2df32fad7fca9fcc887	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801ad29c33aada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422316026"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9548CE1-1626-11EF-82B1-CE167E742B8D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2324	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2324	iexplore.exe
2324	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 3056	2324	iexplore.exe	28
PID 2324 wrote to memory of 3056	2324	iexplore.exe	28
PID 2324 wrote to memory of 3056	2324	iexplore.exe	28
PID 2324 wrote to memory of 3056	2324	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5b8f96708b51efc65c35f466a2a5be2d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f222a4918abd3e4bd1c890675436889

SHA1
845b6b42b5c3ea1a27318a553e4da3bee0dd307e

SHA256
3840db3ee0e94623a401ca56ae7f9c84f7b84db317a2f009421793fbd1129cc1

SHA512
a8b508627d17d52346766204b74edca75ff5605aa3dd0cb0e7f0ae4a26cd580ae5ca749fc749f1a31e98146d2dd422aace6a1f1746e1343f2b8d66afe757391c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9905901eaac34b72709b9bf1ef9738a0

SHA1
ea96e9f2e71d639254e7794d7fc3826f3640d712

SHA256
1019cfb53b0491b3af719e6974dd75bb6b7b3bbd508ace4f1e258ddd853bac34

SHA512
487eee560638e63a04a8770179681dc7d2330f7d8845c2002f249fdca01b80979b01db61c916f978037380b1681f7466befbe090b0fee7f2c0a5a9b5c332946b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ff1e344290abde3747800f56abf7d87

SHA1
53c90e58c8a2d06e3eceed848f46e508b25ae7be

SHA256
8a47a0f627d06fd1bff059ce4da23994e8997d028314351009c05324acf8b836

SHA512
1829a318c4e177befc1e960be4b726144692ebdd1b6a2c0fcf3740385f0005b6a09ac3c07169be474427509b7c49b87b41c10b94f53469cd7c112ea63e3617a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78fb2698199c9e49a90821143aa73853

SHA1
e69e7fb217cf84fd4ced1894e6e3d33873e4c42f

SHA256
1e6ef41cb556dce4af1e197c98bdbaa7adf4d1485e21e11569c80a816bef435c

SHA512
f229df7f7e0ad699317d8d52148838fb17cb41a03b8c60125273bc61c11275987c78bf862b734d1ad48fe716096b30bfe9553ce567317f7c376daa647fa26479

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aea936a150d909f9df73ae854e37428f

SHA1
f1a22d16d646b24491550eb6db9c91b2cf6c701e

SHA256
760b8afaab960ba1d13b2ca55c4bbfe0b90a69f740019758d223135e5960570a

SHA512
cd84fee1f94873f2dc84f57fb3326975832f43098f2d35e52a37c2ec704466b72b4a0a50c1c4c72bb5d89de09e069e0367e5ac074ad8074b7478e34cfbd58465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c896ae5bdb1131052c57de3380d6aed1

SHA1
fd4c868c18714c7dd7a9231a6bdaf77601eb684d

SHA256
f9b086c7299f041270a39db79d4b390d786decd045be33476ac09cea87cf4741

SHA512
89cd1eb4644f346d5ccc2539b6a16926085dba8ec8f884dc68bacc0544e0e1735be5e11b1aa9f9f399473a0eecb99629d51afa618630a03b10e10142d118e6fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c71ebb87ea1c2b81c898d51f4b81a1d7

SHA1
6b0bef15b2e84150b3c02d678bb6444ce255fdff

SHA256
1ef2b49d0226356868bc3076c187d4d6d821aadce05d04f3e3c42709696ebe3c

SHA512
6e5c73a573f51a25a5cd5109ab42be8fc546d38009724afdf52316d036f2c0674e56ecb6ceed570e9ed644fa114bf5d9f6881c9ca4800a2045ac3dd29a32f392

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b1a8aa00f791742fa6210b62785c07e

SHA1
06599fac162d5e9ea754036edd6a65b5de465626

SHA256
698d56abb073ab48c24880350625b727be57beb77c547c9811c71a2d7a0422cb

SHA512
203c5100e305e1c82231d73d79dd1498f938cbd69b10dda236eba6f351389bbd30eeea62a128b47da341e9f82bbf1675a24d328d26909452127b10aafc910bfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b070074caf7702962b03ec53c9b2d9f

SHA1
196b7a89fcb551fe41a07157b7e96ff82ad4d8ab

SHA256
a279dd0854c9f9a901da51c7fb7ca096a416d57d227af8167552b1182f276c2a

SHA512
f1b6ea3a969ca68578919ded8eccb31f5edf71293f71df61070ab623c529a81a1fe241ba39ae58c7833b8b9b0d4b3ef2cb914416c5616c8a1497ec7cab299f22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c78a61bb91779d84826782c22db31e6

SHA1
eb2d999195965d7a00615fa6ffe5dc3c3b12cbb0

SHA256
913e36c8a90334c31c90148e8931ab2eed2c5beb1960ca6562d0b3e781a46798

SHA512
352dc358f8f83da451079923e033b49afe67d1564641240c60b380844750196ffa29b91a70a7d8d2d5e583f65dfd6a7c72f38259258e689613ed6619216e56da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2733.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2891.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit