1b4d36a2d3d1b6e13a9e05fd6da38a7fab0a509a9b92b1b94f8a8c49be03c657

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d304bda889482ee7d6afb80a4f295f1_JaffaCakes118.html
Size

17KB
MD5

5d304bda889482ee7d6afb80a4f295f1
SHA1

3f85a204dbb009e3c0df64e08ec3393787c682a4
SHA256

1b4d36a2d3d1b6e13a9e05fd6da38a7fab0a509a9b92b1b94f8a8c49be03c657
SHA512

682cfa01cd74c1281f032b82c2289f624384f56520891e5356ff9f0db44c7728072724ac5062abcac75305b6a80dc523b9c1738246520c16e5b47dfb6defc188
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIC4SzUnjBhWo82qDB8:SIMd0I5nvHtsvW7xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422341288"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB4C7481-1661-11EF-BAE0-E64BF8A7A69F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2284	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2284	iexplore.exe
2284	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2304	2284	iexplore.exe	28
PID 2284 wrote to memory of 2304	2284	iexplore.exe	28
PID 2284 wrote to memory of 2304	2284	iexplore.exe	28
PID 2284 wrote to memory of 2304	2284	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5d304bda889482ee7d6afb80a4f295f1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32836ff7379eed348aff53e4cb6e5958

SHA1
ceb2ba44a423974065873fdf2ab2ba1665191646

SHA256
d29d240523e4a956c8630c184d218601d3ce2d1d31e68608f32f9f496d0a3496

SHA512
26c4f1c7a3e64f11bc72ab8752f62b3111e4d3e81375a1deae48891db893153f976d161090282329802b3473a3973935440a94aafcb1cf6ac75c239c8924417a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdf4f2fac84c5dd207f222375af337c4

SHA1
b4b0e53df4aeea1d6d39710e1768766394e2d65f

SHA256
8bd23af2d0e4f57ffeced0266f050e0a7ce2f749e1fcdd685773801db596e89d

SHA512
e7e1042dfda6cdc0772ae29fe0b8356cea538e586227cc082254fbab130d44544b5ef6d18e0b388f66174ba543cefc182e2491db92e1f8b59740f8d8bc09c099

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ce898c1102fc5b0bb9ff1cb026e7ec7

SHA1
0b4df1d5d3d1628daa1a7138ef80f48e699ac964

SHA256
c387cdd4085cb6c427467dc71356e860b187a215184d448d343581d4b217f7be

SHA512
21f3be50ca617cf116427cf5671a56d42b9a93aee976f81572fdc251b253a77fd0e3da118dbaf5aaabdadaad12cc3696998780a194edec454cc2a40d4425a4ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9edde4fb4d648fb3b3b875bc2e3626e

SHA1
f1514dbb43dc08a49bb8d1d848bcb05df3341a93

SHA256
f1092995bff7b34b0a7fe57b6513b864f8487f885c0952b96d3d4584275c6f0b

SHA512
928349f638592d6eafe70ff97c24552470d8a705bfeaf7135280ade0231db9aad7da487c033ab23eae5277005191139c68a83d40971406e519a7474d94416087

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dbab82f6766d5f9aa2d87a6247df2b2

SHA1
663ddb163f45fc1b664d0f8cbc1acd410751a99f

SHA256
b2022cec55ad9fdebc3a9cb11122cce36acbd834207675d716f707d63cd49d1c

SHA512
63d2835075f029d5201c1b57a3738e3c704f9d317f250c245c493f3910ca2b4fa6a8ecc2d37513381d2171bf412773e51b9d495f019d685b221d1523e27b3bbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
197735ba61bf73bb881f002033fc2178

SHA1
12eb1e7ca831d2b515b5272a9cb6e6e90218579c

SHA256
715db55add7459432c0e6abd81598dafbdb181a6a754fe7ec892397a0f32da96

SHA512
0ea11f41b92dc29a613a22487943a5a8b89add9bf29516bbd1e77430c581ca0ddf2f28d1087cdabfd8a89a7953206c598df7ac257f44c3d08d22928f709d325c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a4a3150a16aaa79b0a47b9000832177

SHA1
12402192a6dffb142bcf7134028633d995fcfbd5

SHA256
989bf6f5255c8fe9b2e186b5939f90868c06be9a983a53284452cf0e26089d47

SHA512
1fc9ca40f6e3257f49192b2936fbd2e8a282a2ca69e0b0c50c1348b52391a97eca2793df854ff241d640ed61c048fa68be0f791d8f073fdb88f18bc87c1794e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31af8c1d9c35dc1b2e6ca198fd11d741

SHA1
aa041f12003573511fb81ebfada07df2c98feb49

SHA256
5fbc32053ed9d7aafcc087f7423545ea8b095e5493f1ceddc91e2b474ec1faee

SHA512
4475388231ccac39a496e14e43b1a839f9607c7a2d40d06af422d09d8ef2284e19bab02c689b93000a610f670837664a0d6b012e2964e7c0c272b2afb65cd65d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
461fddd5c8bc693fdaef4b857640ee2d

SHA1
63cfc8e793766f6f9c59e439845bb3576c313742

SHA256
ee168ccb7c692657300b683be84f2a3c4c614be94d6bdadac28f75fba25196e7

SHA512
f145298d703372b653570698978e5e6638bb8cedb0b4db14d198e2042443d7eeb44bdcb85c7ff2e6f550b9504cef6946c859493e5038facc5f676dfa764b1de5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C7.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar92A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit